rage.fail

gcp-gce-metadata-token

Metadata server vends the attached SA's OAuth token to on-host code.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'instance': None} ExecutesAs {'sa': None}

where

instance has a service account attached (serviceAccounts[] non-empty) access scopes permit the target API (cloud-platform by default on modern SAs)

emit

source	`<instance>`
target	`<service account>`
conditions	`service_state` `network_reachability`

Narrative

{instance.name} exposes {sa.name}'s OAuth token at the metadata server (computeMetadata/v1/instance/service-accounts/default/token) to any code running on it.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-metadata-token
emits: ExposesCredential
description: Metadata server vends the attached SA's OAuth token to on-host code.
match:
- - instance: null
  - ExecutesAs
  - sa: null
where:
- instance has a service account attached (serviceAccounts[] non-empty)
- access scopes permit the target API (cloud-platform by default on modern SAs)
emit:
  source: <instance>
  target: <service account>
  permissions: []
  conditions:
  - service_state
  - network_reachability
  false_positive_note: No SA attached -> no token (BLOCKED). Legacy/narrow access scopes cap the token
    even if the SA holds the role (access scopes are not an enumerated condition_type, so this caveat
    is prose-only). Metadata server must be reachable from the executing context (network_reachability).
  narrative: '{instance.name} exposes {sa.name}''s OAuth token at the metadata server (computeMetadata/v1/instance/service-accounts/default/token)
    to any code running on it.'