aws-cloudhsm-export-wrappable-key

A CU with wrap rights can wrap an EXTRACTABLE key out of the HSM for offline use.

derived aws emits CanExportKey

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
source	`?hsm_user`
target	`?key`
conditions	`network_reachability`
state logic	if ?key extractability is unknown: POTENTIAL(network_reachability); elif ?key is non-EXTRACTABLE: BLOCKED (denied_by=key_attribute EXTRACTABLE=false); elif matched(optional[0]) AND CU has wrap rights: CONDITIONAL(network_reachability) else POTENTIAL(network_reachability)

source type

Identity

source

?hsm_user

target

?key

conditions

network_reachability

state logic

if ?key extractability is unknown: POTENTIAL(network_reachability); elif ?key is non-EXTRACTABLE: BLOCKED (denied_by=key_attribute EXTRACTABLE=false); elif matched(optional[0]) AND CU has wrap rights: CONDITIONAL(network_reachability) else POTENTIAL(network_reachability)

Narrative

CloudHSM CU {hsm_user.name} (authenticated via credential {principal.name}) can wrap key {key.name} out of the HSM for durable offline use - only if {key.name} is EXTRACTABLE.

Raw rule rules/derived/aws/cloudhsm.yaml

id: aws-cloudhsm-export-wrappable-key
emits: CanExportKey
description: A CU with wrap rights can wrap an EXTRACTABLE key out of the HSM for offline use.
match:
- - principal: null
  - CredentialsFor
  - hsm_user: null
- - hsm_user: null
  - Controls
  - key: null
where:
- node_class(?key) in [EncryptionKey, SigningKey]
- node_class(?hsm_user) == Identity
- ?hsm_user is a CloudHSM Crypto User (CU) with wrap/unwrap rights on ?key
- ?key was created EXTRACTABLE / wrappable
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
emit:
  source_type: Identity
  source: ?hsm_user
  target: ?key
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'if ?key extractability is unknown: POTENTIAL(network_reachability); elif ?key is non-EXTRACTABLE:
    BLOCKED (denied_by=key_attribute EXTRACTABLE=false); elif matched(optional[0]) AND CU has wrap rights:
    CONDITIONAL(network_reachability) else POTENTIAL(network_reachability)'
  confidence: min(contributing_confidences) * 0.75
  derived_from:
  - <CredentialsFor edge_id>
  - <Controls(hsm_user,key) edge_id>
  - <CanNetworkReach edge_id?>
  false_positive_note: "CanExportKey.source is [Identity] only, so the emit source is the HSM user identity\
    \ ?hsm_user (a MachineIdentity), reached from the client host via CredentialsFor(login -> hsm_user)\
    \ \u2014 never the Compute host directly. Keys created non-EXTRACTABLE CANNOT be wrapped out \u2014\
    \ emit BLOCKED, never CONDITIONAL. Extractability is usually UNKNOWN to the collector (only visible\
    \ with CU creds via CloudHSM CLI `key list`), so default to POTENTIAL rather than over-claiming. Requires\
    \ wrap/unwrap authorization on the CU (possession of the HSM login, NOT an IAM key_permission), not\
    \ just use rights."
  narrative: "CloudHSM CU {hsm_user.name} (authenticated via credential {principal.name}) can wrap key\
    \ {key.name} out of the HSM for durable offline use \u2014 only if {key.name} is EXTRACTABLE."