aws-acmpca-cross-account-issue

Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.

derived aws emits CanEnterAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Account`
source	`?external`
target	`<account of ?ca>`
permissions	`acm-pca:IssueCertificate` `acm-pca:GetCertificate`
conditions	`resource_policy` `trust_relationship` `condition_expression` `service_state`
state logic	if resource_policy/RAM grants cross-account IssueCertificate AND a concrete in-account trust consumer maps a forgeable cert to an in-account identity: ACTIVE; else CONDITIONAL(trust_relationship)

source type

Identity

target type

Account

source

?external

target

<account of ?ca>

permissions

acm-pca:IssueCertificate acm-pca:GetCertificate

conditions

resource_policy trust_relationship condition_expression service_state

state logic

if resource_policy/RAM grants cross-account IssueCertificate AND a concrete in-account trust consumer maps a forgeable cert to an in-account identity: ACTIVE; else CONDITIONAL(trust_relationship)

Narrative

{external.name} (account {external.account}) can issue certificates from CA {ca.name} that a system in account {ca.account} trusts, gaining a foothold in account {ca.account}.

Raw rule rules/derived/aws/acmpca.yaml

id: aws-acmpca-cross-account-issue
emits: CanEnterAccount
description: Cross-account issuance on a CA whose certs are trusted in the owner account enters that account.
match:
- - ca: null
  - HasPolicy
  - policy: null
- - policy: null
  - CrossAccountTrust
  - external: null
- - external: null
  - CanSignAs
  - ca: null
where:
- node_type(?ca) == AWS::ACMPCA::CertificateAuthority
- node_type(?policy) == ResourcePolicy
- a downstream authenticator IN THE CA-OWNER ACCOUNT trusts ?ca-issued certs
- ?external.account != ?ca.account
emit:
  source_type: Identity
  target_type: Account
  source: ?external
  target: <account of ?ca>
  permissions:
  - acm-pca:IssueCertificate
  - acm-pca:GetCertificate
  conditions:
  - resource_policy
  - trust_relationship
  - condition_expression
  - service_state
  state_logic: 'if resource_policy/RAM grants cross-account IssueCertificate AND a concrete in-account
    trust consumer maps a forgeable cert to an in-account identity: ACTIVE; else CONDITIONAL(trust_relationship)'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <HasPolicy edge_id>
  - <CrossAccountTrust edge_id>
  - <CanSignAs edge_id>
  false_positive_note: Requires (1) the CA resource policy or RAM share to actually grant the external
    principal acm-pca:IssueCertificate, AND (2) a concrete consumer in the CA-owner account that trusts
    CA-issued certs for authentication. Cross-account issuance without an in-account trust consumer is
    only CrossAccountTrust + CanSignAs, NOT account entry. Honor acm-pca:TemplateArn in the granting statement.
  narrative: '{external.name} (account {external.account}) can issue certificates from CA {ca.name} that
    a system in account {ca.account} trusts, gaining a foothold in account {ca.account}.'