aws-kms-decrypt-exposes-credential

A KMS-decryptable secret exposes the credential of the identity it belongs to once the KMS gate is satisfied.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`?secret`
target	`?identity`
state logic	inherit state from the contributing CanReadSecret edge (ACTIVE only if the secret is actually readable — both the store-read and KMS-decrypt halves met)

source

?secret

target

?identity

state logic

inherit state from the contributing CanReadSecret edge (ACTIVE only if the secret is actually readable — both the store-read and KMS-decrypt halves met)

Narrative

The secret {secret.name}, unlocked via KMS decrypt, exposes credentials for {identity.name}; reading it authenticates as {identity.name}.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-decrypt-exposes-credential
emits: ExposesCredential
description: A KMS-decryptable secret exposes the credential of the identity it belongs to once the KMS
  gate is satisfied.
match:
- - principal: null
  - CanReadSecret
  - secret: null
- - secret: null
  - CredentialsFor
  - identity: null
where:
- node_class(?secret) == Secret
- the CanReadSecret was gated by a KMS CanDecrypt (rule aws-kms-decrypt-unlocks-secret)
emit:
  source: ?secret
  target: ?identity
  permissions: []
  conditions: []
  state_logic: "inherit state from the contributing CanReadSecret edge (ACTIVE only if the secret is actually\
    \ readable \u2014 both the store-read and KMS-decrypt halves met)"
  confidence: min(contributing_confidences)
  derived_from:
  - <CanReadSecret edge_id>
  - <CredentialsFor secret->identity edge_id>
  note: "emitsConformance: this emits ExposesCredential (nature=derived, source set includes Secret, target\
    \ set includes Identity) rather than re-emitting the already-explicit CredentialsFor(?secret->?identity)\
    \ that the match itself binds. It adds a NEW derived fact \u2014 'reaching this secret through the\
    \ KMS gate exposes the identity's credential' \u2014 instead of duplicating an input edge, resolving\
    \ the derived-file explicit-nature concern."
  false_positive_note: "Zero-cost pivot expressing that satisfying the KMS gate on the secret yields the\
    \ identity's credential. Do not emit if the secret cannot actually be read (KEY or store-read half\
    \ unmet). The underlying CredentialsFor(secret->identity) fact is established by the secret store's\
    \ own explicit rules (e.g. secretsmanager), not invented here \u2014 this rule only surfaces the exposure\
    \ once the gate is met."
  narrative: The secret {secret.name}, unlocked via KMS decrypt, exposes credentials for {identity.name};
    reading it authenticates as {identity.name}.