aws-acmpca-forged-cert-credentials-for
A CA-issued certificate authenticates as the downstream identity a trust consumer maps it to.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?ca) == AWS::ACMPCA::CertificateAuthority
?consumer is a downstream authenticator (EKS client-cert auth, mTLS mesh,
VPN, DB cert auth) that trusts ?ca-issued certs
?consumer maps the forgeable cert subject/SAN to ?identity
emit
| source | <forged Certificate node issued by ?ca> |
|---|---|
| target | ?identity |
| conditions | trust_relationship condition_expression |
| state logic | if a concrete trust consumer maps the forgeable subject/SAN to ?identity AND acm-pca:TemplateArn admits that subject/SAN: ACTIVE; else CONDITIONAL(trust_relationship) |
Narrative
A certificate forged by {principal.name} from CA {ca.name} authenticates as {identity.name} to a system that trusts the CA.
Raw rule rules/derived/aws/acmpca.yaml
id: aws-acmpca-forged-cert-credentials-for
emits: CredentialsFor
description: A CA-issued certificate authenticates as the downstream identity a trust consumer maps it
to.
match:
- - principal: null
- CanSignAs
- ca: null
- - identity: null
- AuthenticatesTo
- consumer: null
where:
- node_type(?ca) == AWS::ACMPCA::CertificateAuthority
- ?consumer is a downstream authenticator (EKS client-cert auth, mTLS mesh, VPN, DB cert auth) that trusts
?ca-issued certs
- ?consumer maps the forgeable cert subject/SAN to ?identity
emit:
source: <forged Certificate node issued by ?ca>
target: ?identity
permissions: []
conditions:
- trust_relationship
- condition_expression
state_logic: 'if a concrete trust consumer maps the forgeable subject/SAN to ?identity AND acm-pca:TemplateArn
admits that subject/SAN: ACTIVE; else CONDITIONAL(trust_relationship)'
confidence: min(contributing_confidences) * 0.9
derived_from:
- <CanSignAs edge_id>
- <AuthenticatesTo edge_id (downstream trust-consumer)>
false_positive_note: "Emitted only when a modeled downstream system actually trusts this CA and maps\
\ a certificate subject/SAN to ?identity. Without a concrete consumer, do NOT emit \u2014 the capability\
\ stays at CanSignAs. Honor acm-pca:TemplateArn: if the allowed template cannot express the subject/SAN\
\ the consumer keys on, downgrade to CONDITIONAL(condition_expression)."
narrative: A certificate forged by {principal.name} from CA {ca.name} authenticates as {identity.name}
to a system that trusts the CA.