aws-acm-key-credentials-for-domain

An exported ACM private key authenticates as the certificate's DNS/TLS server identity.

derived aws emits CredentialsFor

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`?cert`
target	`?serverIdentity`
conditions	`condition_expression`
state logic	inherit state from aws-acm-exposes-private-key (ACTIVE only for an exportable cert whose key is retrievable)

source

?cert

target

?serverIdentity

conditions

condition_expression

state logic

inherit state from aws-acm-exposes-private-key (ACTIVE only for an exportable cert whose key is retrievable)

Narrative

The private key of {cert.name} is a credential that authenticates as the TLS/DNS server identity {serverIdentity.name} ({cert.DomainName}).

Raw rule rules/derived/aws/acm.yaml

id: aws-acm-key-credentials-for-domain
emits: CredentialsFor
description: An exported ACM private key authenticates as the certificate's DNS/TLS server identity.
match:
- - cert: null
  - ExposesCredential
  - serverIdentity: null
where:
- node_class(?cert) == Secret
- node_subtype(?cert) == Certificate
- 'node_class(?serverIdentity) == Identity  # concrete subtype: ExternalIdentity'
- '?cert.exportable == true  # per-cert flag: Type==PRIVATE OR a public cert requested exportable (>=2025-06-17)'
emit:
  source: ?cert
  target: ?serverIdentity
  permissions: []
  conditions:
  - condition_expression
  state_logic: inherit state from aws-acm-exposes-private-key (ACTIVE only for an exportable cert whose
    key is retrievable)
  confidence: min(contributing_confidences)
  derived_from:
  - <ExposesCredential derived edge_id (aws-acm-exposes-private-key)>
  false_positive_note: 'Zero-cost credential link completing the export chain: the exported PEM key authenticates
    as the certificate''s server identity (DomainName + SANs) for offline TLS impersonation / MITM OUTSIDE
    AWS. The target resolves to an ExternalIdentity (out-of-AWS server/DNS principal), NOT an AWS IAM
    principal, so no CanEscalateTo/CanEnterAccount roll-up follows from it. Emit only for certs whose
    per-cert exportable flag is true (incl. exportable public certs on/after 2025-06-17).'
  narrative: The private key of {cert.name} is a credential that authenticates as the TLS/DNS server identity
    {serverIdentity.name} ({cert.DomainName}).