rage.fail

aws-kms-can-decrypt

explicit aws emits CanDecrypt

match (effective permission)

{ "action": "kms:Decrypt", "resource_type": "AWS::KMS::Key" }

where

key policy or a grant permits the principal (directly, via account-root IAM delegation, or grant) any kms:ViaService / kms:EncryptionContext condition on the grant is recorded as a condition

emit

target type	`EncryptionKey`
source	`<principal>`
target	`<key node>`
permissions	`kms:Decrypt`

Narrative

{principal.name} can decrypt with {key.name} (kms:Decrypt, permitted by identity + key policy).

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-can-decrypt
emits: CanDecrypt
applies_to:
- aws
match_effective_permission:
  action: kms:Decrypt
  resource_type: AWS::KMS::Key
where:
- key policy or a grant permits the principal (directly, via account-root IAM delegation, or grant)
- any kms:ViaService / kms:EncryptionContext condition on the grant is recorded as a condition
emit:
  target_type: EncryptionKey
  source: <principal>
  target: <key node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation (intersect identity + key policy + grants)
  permissions:
  - kms:Decrypt
  narrative: '{principal.name} can decrypt with {key.name} (kms:Decrypt, permitted by identity + key policy).'