aws-cloudhsm-sign-escalates
Signing with an HSM key that issues tokens/certs for a more-privileged identity is escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?key is the private key backing a token/cert issuer for ?identity (ACM Private CA, JWT/SAML signer)
?identity.privilege_level > ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?identity |
| conditions | network_reachability |
| state logic | inherits state from the contributing CanSignAs (network_reachability + CU-credential possession; never stronger than CONDITIONAL) |
Narrative
{principal.name} can escalate to {identity.name} by signing its tokens/certs with HSM key {key.name} (via a CloudHSM Crypto User credential).
Raw rule rules/derived/aws/cloudhsm.yaml
id: aws-cloudhsm-sign-escalates
emits: CanEscalateTo
description: Signing with an HSM key that issues tokens/certs for a more-privileged identity is escalation.
match:
- - principal: null
- CanSignAs
- key: null
- - key: null
- CredentialsFor
- identity: null
where:
- ?key is the private key backing a token/cert issuer for ?identity (ACM Private CA, JWT/SAML signer)
- ?identity.privilege_level > ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?identity
permissions: []
conditions:
- network_reachability
state_logic: inherits state from the contributing CanSignAs (network_reachability + CU-credential possession;
never stronger than CONDITIONAL)
confidence: min(contributing_confidences) * 0.9
derived_from:
- <CanSignAs edge_id>
- <CredentialsFor(key,identity) edge_id>
false_positive_note: "Only emit when ?key is actually bound to an identity issuer AND ?identity is STRICTLY\
\ more privileged than the caller \u2014 a lateral or unbound signing key is not escalation. The key->identity\
\ binding is external to CloudHSM and must be independently established; do not infer it from the\
\ mere existence of a signing key. Inherits the CONDITIONAL(network_reachability) gate (plus CU-credential\
\ possession) from CanSignAs \u2014 NOT key_permission."
narrative: '{principal.name} can escalate to {identity.name} by signing its tokens/certs with HSM key
{key.name} (via a CloudHSM Crypto User credential).'