aws-acmpca-impersonate-via-forged-cert

Forging a CA-trusted cert lets the principal act as the downstream identity.

derived aws emits CanImpersonate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?identity`
permissions	`acm-pca:IssueCertificate` `acm-pca:GetCertificate`
conditions	`trust_relationship` `condition_expression` `service_state`
state logic	inherit the weakest state of (CanSignAs, CredentialsFor); ACTIVE only when both are ACTIVE (CA ACTIVE, retrievable PEM, template admits the subject, concrete consumer maps it)

source type

Identity

source

?principal

target

?identity

permissions

acm-pca:IssueCertificate acm-pca:GetCertificate

conditions

trust_relationship condition_expression service_state

state logic

inherit the weakest state of (CanSignAs, CredentialsFor); ACTIVE only when both are ACTIVE (CA ACTIVE, retrievable PEM, template admits the subject, concrete consumer maps it)

Narrative

{principal.name} can impersonate {identity.name} by forging a certificate from CA {ca.name} that {identity.name}'s authenticator trusts.

Raw rule rules/derived/aws/acmpca.yaml

id: aws-acmpca-impersonate-via-forged-cert
emits: CanImpersonate
description: Forging a CA-trusted cert lets the principal act as the downstream identity.
match:
- - principal: null
  - CanSignAs
  - ca: null
- - <forged Certificate node issued by ?ca>
  - CredentialsFor
  - identity: null
where:
- node_type(?ca) == AWS::ACMPCA::CertificateAuthority
- node_type(?identity) in [ApplicationIdentity, ServiceAccount, MachineIdentity]
emit:
  source_type: Identity
  source: ?principal
  target: ?identity
  permissions:
  - acm-pca:IssueCertificate
  - acm-pca:GetCertificate
  conditions:
  - trust_relationship
  - condition_expression
  - service_state
  state_logic: inherit the weakest state of (CanSignAs, CredentialsFor); ACTIVE only when both are ACTIVE
    (CA ACTIVE, retrievable PEM, template admits the subject, concrete consumer maps it)
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanSignAs edge_id>
  - <CredentialsFor edge_id>
  false_positive_note: Requires BOTH the minting capability AND a concrete downstream consumer that maps
    the forged cert to ?identity. Never emit from CanSignAs alone. Only ApplicationIdentity/ServiceAccount/MachineIdentity
    targets are valid for CanImpersonate per the edge schema.
  narrative: '{principal.name} can impersonate {identity.name} by forging a certificate from CA {ca.name}
    that {identity.name}''s authenticator trusts.'