aws-cloudhsm-co-mints-cu
A Crypto Officer credential can create a new CU or reset a CU password.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?co_user) == Identity
node_class(?cu_user) == Identity
?co_user is a CloudHSM Crypto Officer (CO) or Primary Crypto Officer (PCO)
?cu_user is a Crypto User in the same cluster (target of the mint/reset)
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanNetworkReach {'cluster': None}
emit
| source type | Identity |
|---|---|
| source | ?co_user |
| target | ?cu_user |
| conditions | network_reachability |
| state logic | never ACTIVE from IAM; creating/resetting a CU is a user-management (not a key-use) operation, so it is NOT gated on key_permission. The real gates are possession of the CO/PCO login (the CredentialsFor premise), reachability, and any configured MofN quorum. If matched(optional[0]) (reachability to run CloudHSM CLI `user create` / `user change-password`) AND no unmet quorum: CONDITIONAL(network_reachability); if a CO quorum (M-of-N) is configured and not satisfiable by the held credentials: POTENTIAL(quorum); else POTENTIAL(network_reachability) |
Narrative
CloudHSM Crypto Officer {co_user.name} (held via credential {principal.name}) can create or reset Crypto User {cu_user.name}, minting a usable HSM credential.
Raw rule rules/derived/aws/cloudhsm.yaml
id: aws-cloudhsm-co-mints-cu
emits: CanCreateCredentialFor
description: A Crypto Officer credential can create a new CU or reset a CU password.
match:
- - principal: null
- CredentialsFor
- co_user: null
- - co_user: null
- Controls
- cluster: null
where:
- node_class(?co_user) == Identity
- node_class(?cu_user) == Identity
- ?co_user is a CloudHSM Crypto Officer (CO) or Primary Crypto Officer (PCO)
- ?cu_user is a Crypto User in the same cluster (target of the mint/reset)
optional:
- - principal: null
- CanNetworkReach
- cluster: null
emit:
source_type: Identity
source: ?co_user
target: ?cu_user
permissions: []
conditions:
- network_reachability
state_logic: 'never ACTIVE from IAM; creating/resetting a CU is a user-management (not a key-use) operation,
so it is NOT gated on key_permission. The real gates are possession of the CO/PCO login (the CredentialsFor
premise), reachability, and any configured MofN quorum. If matched(optional[0]) (reachability to run
CloudHSM CLI `user create` / `user change-password`) AND no unmet quorum: CONDITIONAL(network_reachability);
if a CO quorum (M-of-N) is configured and not satisfiable by the held credentials: POTENTIAL(quorum);
else POTENTIAL(network_reachability)'
confidence: min(contributing_confidences) * 0.8
derived_from:
- <CredentialsFor(principal,co_user) edge_id>
- <Controls(co_user,cluster) edge_id>
- <CanNetworkReach edge_id?>
false_positive_note: "The only intra-HSM escalation primitive: a CO/PCO cannot use keys but CAN create\
\ a CU or reset a CU password, minting a usable crypto credential. This is user management, NOT crypto\
\ \u2014 do NOT gate it on key_permission (that condition_type means a KMS/Key Vault decrypt/use grant\
\ and mislabels this non-crypto op; consumers filtering on key_permission would be misrouted). The\
\ true gates are CO/PCO credential possession (surfaced by the CredentialsFor premise) and network\
\ reachability; there is no exact condition_type for \"has CO credential\" or \"MofN quorum\", so\
\ those are stated here and in state_logic. Privileged CO operations may require an M-of-N (MofN)\
\ quorum \u2014 if quorum is configured and unsatisfiable, downgrade to POTENTIAL(quorum). No IAM\
\ action grants this. CanCreateCredentialFor.source/target are both Identity; the emit uses the CO\
\ Identity ?co_user (not the Credential ?principal) as source and the CU Identity ?cu_user as target\
\ for conformance."
narrative: CloudHSM Crypto Officer {co_user.name} (held via credential {principal.name}) can create
or reset Crypto User {cu_user.name}, minting a usable HSM credential.