aws-cloudhsm-sign-with-cu

id: aws-cloudhsm-sign-with-cu
emits: CanSignAs
description: A CloudHSM CU credential (with VPC reach) can sign with the HSM private key.
match:
- - principal: null
  - CredentialsFor
  - hsm_user: null
- - hsm_user: null
  - Controls
  - key: null
where:
- node_class(?key) == SigningKey
- node_class(?hsm_user) == Identity
- ?hsm_user is a CloudHSM Crypto User (CU) that owns or shares ?key
optional:
- - principal: null
  - CanNetworkReach
  - cluster: null
emit:
  source_type: Identity
  source: ?hsm_user
  target: ?key
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'never ACTIVE from IAM; if matched(optional[0]) AND CU owns/shares ?key: CONDITIONAL(network_reachability)
    else POTENTIAL(network_reachability)'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <CredentialsFor edge_id>
  - <Controls(hsm_user,key) edge_id>
  - <CanNetworkReach edge_id?>
  false_positive_note: "CanSignAs.source is [Identity] only, so the emit source is the HSM user identity\
    \ ?hsm_user (a MachineIdentity), reached from the client host via CredentialsFor(login -> hsm_user)\
    \ \u2014 never the Compute host directly. Raw signing capability, not identity forgery by itself.\
    \ Same gate as decrypt: possession of the CU login credential (NOT an IAM key_permission) plus reachability.\
    \ It becomes impersonation/escalation only when ?key is the private key backing a token/cert issuer\
    \ for a concrete identity (see aws-cloudhsm-sign-escalates) \u2014 that binding lives outside CloudHSM\
    \ (ACM Private CA, app JWT/SAML signer) and must be independently known. CO credentials do not qualify."
  narrative: CloudHSM Crypto User {hsm_user.name} (authenticated via credential {principal.name}) can
    sign blobs with HSM signing key {key.name} once it can reach the cluster.