Token
OAuth/OIDC/session token.
class: Secret derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
As edge target
Exposure sites
Rules that touch Token 10
CodeArtifact GetAuthorizationToken returns a short-lived bearer credential (up to 12 hours) for authenticated repository access - a credential-access primitive often exfiltrated from CI/CD environments.
aws
CanRetrieveTokenA SecureString parameter exposes credential material to any reader.
generateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential type) for external distribution.
azure
CanReadCredentialA listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.
azure
CanReadSecretA host with a bound MI exposes that identity's bearer token credential via the IMDS / App Service identity endpoint to any code running inside it.
azure
ExposesCredentialSynthesize an IMDS bearer token node for each host+MI pair where the host executes as the MI.
azure
LocatedInAn IMDS bearer token minted from a host+MI pair is valid authentication as that MI.
azure
CredentialsForlistAccountSas/action generates a pre-formed account-level SAS token, providing scoped but key-equivalent data-plane access.
azure
CanReadCredentialRetargeting an existing HTTP job's URI (via jobs.update) to an attacker-controlled endpoint causes the existing SA's OIDC/OAuth2 bearer token to be delivered on the next invocation - no actAs on the SA required since the SA is unchanged.
gcp
CanRetrieveToken