aws-acmpca-subca-mint

Issue a SubordinateCACertificate to create a new issuer chaining to the trusted CA.

derived aws emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?ca`
permissions	`acm-pca:IssueCertificate` `acm-pca:GetCertificate`
conditions	`condition_expression` `service_state`
state logic	if acm-pca:TemplateArn is pinned to a non-SubordinateCA template: BLOCKED (denied_by=TemplateArn condition); elif CA.Status != ACTIVE: CONDITIONAL(service_state); else ACTIVE

source type

Identity

source

?principal

target

?ca

permissions

acm-pca:IssueCertificate acm-pca:GetCertificate

conditions

condition_expression service_state

state logic

if acm-pca:TemplateArn is pinned to a non-SubordinateCA template: BLOCKED (denied_by=TemplateArn condition); elif CA.Status != ACTIVE: CONDITIONAL(service_state); else ACTIVE

Narrative

{principal.name} can issue a SubordinateCACertificate from CA {ca.name}, creating a new issuer that chains to it and enables unbounded downstream certificate forging.

Raw rule rules/derived/aws/acmpca.yaml

id: aws-acmpca-subca-mint
emits: CanSignAs
description: Issue a SubordinateCACertificate to create a new issuer chaining to the trusted CA.
match:
- - principal: null
  - CanSignAs
  - ca: null
where:
- node_type(?ca) == AWS::ACMPCA::CertificateAuthority
- ?ca node_class == SigningKey
- acm-pca:TemplateArn permits a SubordinateCACertificate* template (or is unconstrained)
emit:
  source_type: Identity
  source: ?principal
  target: ?ca
  permissions:
  - acm-pca:IssueCertificate
  - acm-pca:GetCertificate
  conditions:
  - condition_expression
  - service_state
  state_logic: 'if acm-pca:TemplateArn is pinned to a non-SubordinateCA template: BLOCKED (denied_by=TemplateArn
    condition); elif CA.Status != ACTIVE: CONDITIONAL(service_state); else ACTIVE'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanSignAs edge_id>
  false_positive_note: Only valid when the effective policy permits a SubordinateCACertificate template
    (acm-pca:TemplateArn unconstrained or explicitly allowing it) and the CA path length allows a subordinate.
    If TemplateArn pins EndEntity-only templates, sub-CA minting is BLOCKED. Modeled as CanSignAs on the
    same CA (the new issuer chains to it); a separate node for the minted sub-CA is created by the collector
    on the next run.
  narrative: '{principal.name} can issue a SubordinateCACertificate from CA {ca.name}, creating a new
    issuer that chains to it and enables unbounded downstream certificate forging.'