aws-acmpca-sign-as-via-putpolicy

Rewrite the CA resource policy to grant self issuance, then sign as the CA.

derived aws emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?ca`
permissions	`acm-pca:PutPolicy` `acm-pca:IssueCertificate` `acm-pca:GetCertificate`
conditions	`iam_permission` `service_state`
state logic	if CA.Status != ACTIVE: CONDITIONAL(service_state); else POTENTIAL(iam_permission) — this is a two-step self-grant the source can CREATE but has not yet realized: PutPolicy must first write a statement granting itself acm-pca:IssueCertificate, and the principal must then hold/obtain acm-pca:GetCertificate to retrieve the signed PEM. Upgrade to CONDITIONAL(iam_permission) once GetCertificate is confirmed, and to ACTIVE only after the self-granting policy statement is actually written. Consistent with the POTENTIAL definition (capability could be created by the source but is not yet realized).

source type

Identity

source

?principal

target

?ca

permissions

acm-pca:PutPolicy acm-pca:IssueCertificate acm-pca:GetCertificate

conditions

iam_permission service_state

state logic

if CA.Status != ACTIVE: CONDITIONAL(service_state); else POTENTIAL(iam_permission) — this is a two-step self-grant the source can CREATE but has not yet realized: PutPolicy must first write a statement granting itself acm-pca:IssueCertificate, and the principal must then hold/obtain acm-pca:GetCertificate to retrieve the signed PEM. Upgrade to CONDITIONAL(iam_permission) once GetCertificate is confirmed, and to ACTIVE only after the self-granting policy statement is actually written. Consistent with the POTENTIAL definition (capability could be created by the source but is not yet realized).

Narrative

{principal.name} can rewrite the resource policy of CA {ca.name} (acm-pca:PutPolicy) to grant itself acm-pca:IssueCertificate, then sign arbitrary certificates as the CA.

Raw rule rules/derived/aws/acmpca.yaml

id: aws-acmpca-sign-as-via-putpolicy
emits: CanSignAs
description: Rewrite the CA resource policy to grant self issuance, then sign as the CA.
match:
- - principal: null
  - CanModifyPolicy
  - ca: null
where:
- node_type(?ca) == AWS::ACMPCA::CertificateAuthority
- ?ca node_class == SigningKey
emit:
  source_type: Identity
  source: ?principal
  target: ?ca
  permissions:
  - acm-pca:PutPolicy
  - acm-pca:IssueCertificate
  - acm-pca:GetCertificate
  conditions:
  - iam_permission
  - service_state
  state_logic: "if CA.Status != ACTIVE: CONDITIONAL(service_state); else POTENTIAL(iam_permission) \u2014\
    \ this is a two-step self-grant the source can CREATE but has not yet realized: PutPolicy must first\
    \ write a statement granting itself acm-pca:IssueCertificate, and the principal must then hold/obtain\
    \ acm-pca:GetCertificate to retrieve the signed PEM. Upgrade to CONDITIONAL(iam_permission) once GetCertificate\
    \ is confirmed, and to ACTIVE only after the self-granting policy statement is actually written. Consistent\
    \ with the POTENTIAL definition (capability could be created by the source but is not yet realized)."
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <CanModifyPolicy edge_id>
  false_positive_note: acm-pca:PutPolicy alone grants issuance only after the principal writes a statement
    granting itself acm-pca:IssueCertificate (and GetCertificate). This is a two-step self-grant; downgrade
    priors accordingly. An SCP denying PutPolicy or IssueCertificate -> BLOCKED. Still gated by CA Status
    == ACTIVE.
  narrative: '{principal.name} can rewrite the resource policy of CA {ca.name} (acm-pca:PutPolicy) to
    grant itself acm-pca:IssueCertificate, then sign arbitrary certificates as the CA.'