rage.fail

aws-kms-can-sign

explicit aws emits CanSignAs

match (effective permission)

{ "action": "kms:Sign", "resource_type": "AWS::KMS::Key" }

where

DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric) node_type(key) == SigningKey (SIGN_VERIFY keys carry the SigningKey subtype; required so the CanSignAs target conforms to edges.yaml target set [SigningKey, ServiceAccount, ApplicationIdentity]) key policy or a grant permits the principal

emit

source type	`Identity`
source	`<principal>`
target	`<key node (SigningKey subtype)>`
permissions	`kms:Sign`

Narrative

{principal.name} can sign as {key.name} (kms:Sign on a SIGN_VERIFY key) - forge signatures anchored on its public key.

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-can-sign
emits: CanSignAs
applies_to:
- aws
match_effective_permission:
  action: kms:Sign
  resource_type: AWS::KMS::Key
where:
- DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric)
- node_type(key) == SigningKey (SIGN_VERIFY keys carry the SigningKey subtype; required so the CanSignAs
  target conforms to edges.yaml target set [SigningKey, ServiceAccount, ApplicationIdentity])
- key policy or a grant permits the principal
emit:
  source_type: Identity
  source: <principal>
  target: <key node (SigningKey subtype)>
  api_source: kms:DescribeKey (KeyUsage) + policy evaluation
  permissions:
  - kms:Sign
  narrative: "{principal.name} can sign as {key.name} (kms:Sign on a SIGN_VERIFY key) \u2014 forge signatures\
    \ anchored on its public key."