rage.fail

aws-kms-escalate-via-sign

Forging a signature for a more-privileged identity is privilege escalation.

derived aws emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanImpersonate {'identity': None}

where

?identity.privilege_level > ?principal.privilege_level the CanImpersonate was produced by aws-kms-sign-forges-identity

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?identity`
permissions	`kms:Sign`
state logic	inherit state from the contributing CanImpersonate edge

Narrative

{principal.name} can escalate to {identity.name} by forging signatures with a KMS signing key that {identity.name}'s verifiers trust.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-escalate-via-sign
emits: CanEscalateTo
description: Forging a signature for a more-privileged identity is privilege escalation.
match:
- - principal: null
  - CanImpersonate
  - identity: null
where:
- ?identity.privilege_level > ?principal.privilege_level
- the CanImpersonate was produced by aws-kms-sign-forges-identity
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?identity
  permissions:
  - kms:Sign
  conditions: []
  state_logic: inherit state from the contributing CanImpersonate edge
  confidence: min(contributing_confidences)
  derived_from:
  - <CanImpersonate edge_id>
  false_positive_note: Only when the forged identity is strictly more privileged than the caller. Lateral/same-privilege
    forgery is not escalation. Inherits state from CanImpersonate (POTENTIAL if the trust anchor is unresolved).
  narrative: '{principal.name} can escalate to {identity.name} by forging signatures with a KMS signing
    key that {identity.name}''s verifiers trust.'