aws-acmpca-escalate-via-impersonate
Forging a cert to act as a more-privileged identity is privilege escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
the
CanImpersonate was derived from an ACM PCA forged certificate
?identity.privilege_level > ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?identity |
| conditions | trust_relationship condition_expression service_state |
| state logic | inherit the state of the contributing CanImpersonate edge verbatim (ACTIVE/CONDITIONAL/POTENTIAL/BLOCKED); this roll-up adds no new gate beyond the strictly-greater-privilege check in the where-clause, so it never strengthens the inherited state. |
Narrative
{principal.name} can escalate to {identity.name} by forging a certificate from CA {ca.name} that {identity.name}'s authenticator trusts.
Raw rule rules/derived/aws/acmpca.yaml
id: aws-acmpca-escalate-via-impersonate
emits: CanEscalateTo
description: Forging a cert to act as a more-privileged identity is privilege escalation.
match:
- - principal: null
- CanImpersonate
- identity: null
where:
- the CanImpersonate was derived from an ACM PCA forged certificate
- ?identity.privilege_level > ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?identity
permissions: []
conditions:
- trust_relationship
- condition_expression
- service_state
state_logic: inherit the state of the contributing CanImpersonate edge verbatim (ACTIVE/CONDITIONAL/POTENTIAL/BLOCKED);
this roll-up adds no new gate beyond the strictly-greater-privilege check in the where-clause, so
it never strengthens the inherited state.
confidence: min(contributing_confidences)
derived_from:
- <CanImpersonate edge_id>
false_positive_note: Only emit when the forged identity is strictly more privileged than the caller;
forging a lateral or lower-privilege identity is not escalation. Inherits state from the contributing
CanImpersonate edge.
narrative: '{principal.name} can escalate to {identity.name} by forging a certificate from CA {ca.name}
that {identity.name}''s authenticator trusts.'