rage.fail

gcp-gce-metadata-token-retrieve

Any principal with code exec on the instance can read the metadata token.

derived gcp emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'instance': None} {'instance': None} ExposesCredential {'sa': None}

emit

source	`<principal>`
target	`<service account>`

Narrative

{principal.name} can execute on {instance.name} and read the metadata server to obtain {sa.name}'s access token.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-metadata-token-retrieve
emits: CanRetrieveToken
description: Any principal with code exec on the instance can read the metadata token.
match:
- - principal: null
  - CanExecuteCommand
  - instance: null
- - instance: null
  - ExposesCredential
  - sa: null
emit:
  source: <principal>
  target: <service account>
  permissions: []
  note: Chains CanExecuteCommand + metadata exposure into direct token theft; feeds CanExecuteAs.
  narrative: '{principal.name} can execute on {instance.name} and read the metadata server to obtain {sa.name}''s
    access token.'