rage.fail

aws-kms-can-sign-hmac

explicit aws emits CanSignAs

match (effective permission)

{ "action": "kms:GenerateMac", "resource_type": "AWS::KMS::Key" }

where

DescribeKey.KeyUsage == GENERATE_VERIFY_MAC (HMAC) node_type(key) == SigningKey (HMAC keys carry the SigningKey subtype — conforms to CanSignAs target set) key policy or a grant permits the principal

emit

source type	`Identity`
source	`<principal>`
target	`<key node (SigningKey subtype)>`
permissions	`kms:GenerateMac`

Narrative

{principal.name} can forge MACs with {key.name} (kms:GenerateMac on an HMAC key) - symmetric-MAC forgery, not public-key signing.

Raw rule rules/explicit/aws-kms.yaml

id: aws-kms-can-sign-hmac
emits: CanSignAs
applies_to:
- aws
match_effective_permission:
  action: kms:GenerateMac
  resource_type: AWS::KMS::Key
where:
- DescribeKey.KeyUsage == GENERATE_VERIFY_MAC (HMAC)
- "node_type(key) == SigningKey (HMAC keys carry the SigningKey subtype \u2014 conforms to CanSignAs target\
  \ set)"
- key policy or a grant permits the principal
emit:
  source_type: Identity
  source: <principal>
  target: <key node (SigningKey subtype)>
  api_source: kms:DescribeKey (KeyUsage) + policy evaluation
  permissions:
  - kms:GenerateMac
  false_positive_note: "This is symmetric-MAC forgery (kms:GenerateMac on a GENERATE_VERIFY_MAC key),\
    \ NOT public-key signing. It lets the attacker forge a valid MAC for any message, but because verification\
    \ requires the same secret KMS key (kms:VerifyMac), it does NOT forge public-key-verified identities\
    \ the way a SIGN_VERIFY key does \u2014 the derived rule aws-kms-sign-forges-identity therefore excludes\
    \ HMAC keys."
  narrative: "{principal.name} can forge MACs with {key.name} (kms:GenerateMac on an HMAC key) \u2014\
    \ symmetric-MAC forgery, not public-key signing."