aws-cloudhsm-decrypt-with-cu

id: aws-cloudhsm-decrypt-with-cu
emits: CanDecrypt
description: Holding a CloudHSM Crypto User credential (with VPC reach) lets a principal decrypt with
  the HSM key.
match:
- - principal: null
  - CredentialsFor
  - hsm_user: null
- - hsm_user: null
  - Controls
  - key: null
where:
- node_class(?key) == EncryptionKey
- node_class(?hsm_user) == Identity
- ?hsm_user is a CloudHSM Crypto User (CU) that owns or shares ?key
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
emit:
  target_type: EncryptionKey
  source: ?hsm_user
  target: ?key
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'never ACTIVE from IAM; if matched(optional[0]) (VPC reachability to the HSM on TCP 2223-2225)
    AND the CU owns/shares ?key: CONDITIONAL(network_reachability) else POTENTIAL(network_reachability)'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <CredentialsFor edge_id>
  - <Controls(hsm_user,key) edge_id>
  - <CanNetworkReach edge_id?>
  false_positive_note: "NEVER emit ACTIVE. Decrypt is a data-plane operation requiring possession of the\
    \ CU login credential AND reachability to the HSM ENIs; IAM cloudhsm:* alone grants nothing. The gate\
    \ is HSM-CU-credential possession (the CredentialsFor premise), which is NOT an IAM key grant \u2014\
    \ do not label it key_permission (that condition_type means a KMS/Key Vault decrypt/use grant, which\
    \ CloudHSM does not have). Only the CU that owns or is shared the key can use it \u2014 a CO/PCO credential\
    \ does NOT qualify (CO manages users, cannot do crypto). If reachability is unproven, downgrade to\
    \ POTENTIAL. An SCP cannot block this (it is not an IAM action); only key deletion or credential rotation\
    \ removes it."
  narrative: CloudHSM Crypto User {hsm_user.name} (authenticated via credential {principal.name}) can
    decrypt data with HSM key {key.name} once it can reach the cluster (TCP 2223-2225).