aws-cloudhsm-backup-exfiltrates-keys

A principal that can copy/share/restore a cluster backup duplicates the encrypted key material out of the source cluster.

derived aws emits CanExfiltrate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`?principal`
target	`?backup`
permissions	`cloudhsm:CopyBackupToRegion` `cloudhsm:ModifyBackupAttributes` `cloudhsm:RestoreBackup` `ram:CreateResourceShare?`
conditions	`iam_permission`
state logic	if ?principal has EFFECTIVE cloudhsm:CopyBackupToRegion / ModifyBackupAttributes (share) / RestoreBackup on the backup: ACTIVE (the exfil/duplication action succeeds); if an SCP/RAM policy denies the relevant action: BLOCKED (denied_by=<SCP/RAM statement>); else CONDITIONAL(iam_permission)

source

?principal

target

?backup

permissions

cloudhsm:CopyBackupToRegion cloudhsm:ModifyBackupAttributes cloudhsm:RestoreBackup ram:CreateResourceShare?

conditions

iam_permission

state logic

if ?principal has EFFECTIVE cloudhsm:CopyBackupToRegion / ModifyBackupAttributes (share) / RestoreBackup on the backup: ACTIVE (the exfil/duplication action succeeds); if an SCP/RAM policy denies the relevant action: BLOCKED (denied_by=<SCP/RAM statement>); else CONDITIONAL(iam_permission)

Narrative

{principal.name} can copy, share, or restore backup {backup.name} of CloudHSM cluster {cluster.name} (cloudhsm:CopyBackupToRegion / ModifyBackupAttributes / RestoreBackup), duplicating the encrypted key material out of the source cluster.

Raw rule rules/derived/aws/cloudhsm.yaml

id: aws-cloudhsm-backup-exfiltrates-keys
emits: CanExfiltrate
description: A principal that can copy/share/restore a cluster backup duplicates the encrypted key material
  out of the source cluster.
match:
- - principal: null
  - CanAdminister
  - cluster: null
- - backup: null
  - ContainsResourceReference
  - cluster: null
where:
- node_class(?principal) == Identity
- node_class(?backup) == Data
- ?backup is a CloudHSM cluster backup (encrypted image of the cluster's key material)
- ?principal has EFFECTIVE cloudhsm:CopyBackupToRegion, cloudhsm:ModifyBackupAttributes (backup share),
  or cloudhsm:RestoreBackup on ?backup/?cluster
emit:
  source: ?principal
  target: ?backup
  permissions:
  - cloudhsm:CopyBackupToRegion
  - cloudhsm:ModifyBackupAttributes
  - cloudhsm:RestoreBackup
  - ram:CreateResourceShare?
  conditions:
  - iam_permission
  state_logic: 'if ?principal has EFFECTIVE cloudhsm:CopyBackupToRegion / ModifyBackupAttributes (share)
    / RestoreBackup on the backup: ACTIVE (the exfil/duplication action succeeds); if an SCP/RAM policy
    denies the relevant action: BLOCKED (denied_by=<SCP/RAM statement>); else CONDITIONAL(iam_permission)'
  confidence: min(contributing_confidences) * 0.8
  derived_from:
  - <CanAdminister edge_id>
  - <ContainsResourceReference(backup,cluster) edge_id>
  false_positive_note: 'This models key-MATERIAL duplication/exfiltration, NOT a cross-account IAM session:
    a copied/shared/restored backup reproduces the keys in a new cluster, but that cluster STILL enforces
    HSM-user auth, so no key bytes are exposed to IAM and no CanEnterAccount is emitted (see NON-EMITTED
    note). The backup is encrypted; "exfiltration" here means removing the durable key image from the
    source boundary, not obtaining cleartext key bytes. Only emit when the principal actually holds the
    relevant cloudhsm:/ram: action; a bare cluster admin without CopyBackupToRegion/RestoreBackup/share
    does not qualify.'
  narrative: '{principal.name} can copy, share, or restore backup {backup.name} of CloudHSM cluster {cluster.name}
    (cloudhsm:CopyBackupToRegion / ModifyBackupAttributes / RestoreBackup), duplicating the encrypted
    key material out of the source cluster.'