rage.fail

aws-cloudhsm-user-controls-key

explicit aws emits Controls

match (record)

{ "field": "KeyHandle", "resource_type": "CloudHSM::Key" }

where

HSM user owns or is shared the key (KeyOwner / SharedUsers includes user)

emit

source type	`Identity`
target type	`*`
source	`<HSM user identity node (Identity / MachineIdentity)>`
target	`<HSM key node (EncryptionKey/SigningKey)>`

Narrative

CloudHSM user {hsm_user.name} owns/shares HSM key {key.name}.

Raw rule rules/explicit/aws-cloudhsm.yaml

id: aws-cloudhsm-user-controls-key
emits: Controls
applies_to:
- aws
match_record:
  resource_type: CloudHSM::Key
  field: KeyHandle
where:
- HSM user owns or is shared the key (KeyOwner / SharedUsers includes user)
emit:
  source_type: Identity
  target_type: '*'
  source: <HSM user identity node (Identity / MachineIdentity)>
  target: <HSM key node (EncryptionKey/SigningKey)>
  api_source: "CloudHSM CLI `key list` (requires CU creds) \u2014 often UNKNOWN to collector"
  evidence_field: KeyOwner / SharedUsers / attributes (extractable, class)
  narrative: CloudHSM user {hsm_user.name} owns/shares HSM key {key.name}.