aws-cloudhsm-host-exposes-cu
A CloudHSM client host with a configured CU login leaks it to any code it runs.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?host) == Compute
?cu_cred is a CloudHSM Crypto User (or CO/PCO) credential (env CLOUDHSM_PIN / PKCS#11 pin / cloudhsm_mgmt_util config)
emit
| source | ?host |
|---|---|
| target | ?cu_cred |
| state logic | ACTIVE (the credential material is present on the host); the downstream key-use edges remain CONDITIONAL on reachability |
Narrative
{host.name} has a CloudHSM Crypto User login configured on it, exposing {cu_cred.name} to any code running on the host.
Raw rule rules/derived/aws/cloudhsm.yaml
id: aws-cloudhsm-host-exposes-cu
emits: ExposesCredential
description: A CloudHSM client host with a configured CU login leaks it to any code it runs.
match:
- - host: null
- ContainsCredential
- cu_cred: null
where:
- node_class(?host) == Compute
- ?cu_cred is a CloudHSM Crypto User (or CO/PCO) credential (env CLOUDHSM_PIN / PKCS#11 pin / cloudhsm_mgmt_util
config)
emit:
source: ?host
target: ?cu_cred
permissions: []
conditions: []
state_logic: ACTIVE (the credential material is present on the host); the downstream key-use edges remain
CONDITIONAL on reachability
confidence: min(contributing_confidences) * 0.9
derived_from:
- <ContainsCredential edge_id>
false_positive_note: "Only emit when the credential material is actually present (hard-coded pin, pin\
\ file, mgmt_util config). A host that merely has the SDK installed but pulls the pin at runtime from\
\ Secrets Manager does NOT expose it here \u2014 the exposure belongs to that secret store, and this\
\ becomes a CanReadSecret on the store instead. This edge is not escalation by itself; value comes\
\ when it chains into CanDecrypt/CanSignAs."
narrative: '{host.name} has a CloudHSM Crypto User login configured on it, exposing {cu_cred.name} to
any code running on the host.'