aws-kms-decrypt-via-generate-datakey

GenerateDataKey* returns a usable plaintext data key -> envelope decryption of ciphertext under the key.

derived aws emits CanDecrypt

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

target type	`EncryptionKey`
source	`?principal`
target	`?key`
permissions	`kms:GenerateDataKey` `kms:GenerateDataKeyWithoutPlaintext` `kms:GenerateDataKeyPair` `kms:GenerateDataKeyPairWithoutPlaintext`
conditions	`key_permission` `resource_policy` `condition_expression`
state logic	if key policy/grant permits AND no unmet kms:ViaService/EncryptionContext condition: ACTIVE; elif key-policy side unconfirmed: CONDITIONAL(resource_policy); elif ViaService/EncryptionContext gates it: CONDITIONAL(condition_expression)

target type

EncryptionKey

source

?principal

target

?key

permissions

kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext kms:GenerateDataKeyPair kms:GenerateDataKeyPairWithoutPlaintext

conditions

key_permission resource_policy condition_expression

state logic

if key policy/grant permits AND no unmet kms:ViaService/EncryptionContext condition: ACTIVE; elif key-policy side unconfirmed: CONDITIONAL(resource_policy); elif ViaService/EncryptionContext gates it: CONDITIONAL(condition_expression)

Narrative

{principal.name} can call GenerateDataKey on {key.name} (kms:GenerateDataKey), enabling envelope decryption of data protected by it.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-decrypt-via-generate-datakey
emits: CanDecrypt
description: GenerateDataKey* returns a usable plaintext data key -> envelope decryption of ciphertext
  under the key.
match:
- - principal: null
  - CanRead
  - key: null
where:
- node_type(?key) == EncryptionKey
- DescribeKey.KeyUsage == ENCRYPT_DECRYPT
- ?principal has EFFECTIVE kms:GenerateDataKey OR kms:GenerateDataKeyWithoutPlaintext OR kms:GenerateDataKeyPair
  OR kms:GenerateDataKeyPairWithoutPlaintext on ?key, permitted by identity + key policy
emit:
  target_type: EncryptionKey
  source: ?principal
  target: ?key
  permissions:
  - kms:GenerateDataKey
  - kms:GenerateDataKeyWithoutPlaintext
  - kms:GenerateDataKeyPair
  - kms:GenerateDataKeyPairWithoutPlaintext
  conditions:
  - key_permission
  - resource_policy
  - condition_expression
  state_logic: 'if key policy/grant permits AND no unmet kms:ViaService/EncryptionContext condition: ACTIVE;
    elif key-policy side unconfirmed: CONDITIONAL(resource_policy); elif ViaService/EncryptionContext
    gates it: CONDITIONAL(condition_expression)'
  confidence: min(contributing_confidences) * 0.75
  derived_from:
  - <effective kms:GenerateDataKey permission>
  false_positive_note: GenerateDataKey alone yields plaintext for NEW ciphertext; decrypting an EXISTING
    stored blob still needs the stored (wrapped) data key plus this call, or direct kms:Decrypt. It is
    decrypt-ADJACENT, hence 0.75 prior. Honor kms:ViaService (only usable through the named service) and
    kms:EncryptionContext* (only the matching context). Never for SIGN_VERIFY keys.
  narrative: '{principal.name} can call GenerateDataKey on {key.name} (kms:GenerateDataKey), enabling
    envelope decryption of data protected by it.'