aws-kms-export-imported-material

Keys with imported material (Origin: EXTERNAL) may be controllable offline by the importer.

derived aws emits CanExportKey

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?key`
conditions	`iam_permission`
state logic	POTENTIAL(iam_permission) — KMS never releases key material; this only reflects that imported material exists offline with the importer and could be re-imported/rotated by an admin. Never ACTIVE from KMS APIs alone.

source type

Identity

source

?principal

target

?key

conditions

iam_permission

state logic

POTENTIAL(iam_permission) — KMS never releases key material; this only reflects that imported material exists offline with the importer and could be re-imported/rotated by an admin. Never ACTIVE from KMS APIs alone.

Narrative

{key.name} uses imported (EXTERNAL) key material; its plaintext lives offline with the importer and is not retrievable from KMS.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-export-imported-material
emits: CanExportKey
description: 'Keys with imported material (Origin: EXTERNAL) may be controllable offline by the importer.'
match:
- - principal: null
  - CanAdminister
  - key: null
where:
- node_type(?key) == EncryptionKey
- DescribeKey.Origin == EXTERNAL (imported key material)
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions: []
  conditions:
  - iam_permission
  state_logic: "POTENTIAL(iam_permission) \u2014 KMS never releases key material; this only reflects that\
    \ imported material exists offline with the importer and could be re-imported/rotated by an admin.\
    \ Never ACTIVE from KMS APIs alone."
  confidence: min(contributing_confidences) * 0.4
  derived_from:
  - <CanAdminister edge_id>
  note: "No permissions are listed because NO KMS API returns private key material. The capability is\
    \ derived from possession of the original offline material plus CanAdminister on the key, not from\
    \ any KMS action. kms:GetParametersForImport / kms:ImportKeyMaterial are re-import/rotation primitives\
    \ (they push material IN, returning only a wrapping key + import token), NOT export \u2014 listing\
    \ them as the 'permissions' would over-claim an export path that does not exist via any KMS API."
  false_positive_note: 'KMS key material is NON-exportable. Emit at most POTENTIAL and ONLY for Origin:
    EXTERNAL keys, to flag that the plaintext material lives offline with whoever imported it. NEVER emit
    CanExportKey for AWS_KMS-origin or AWS_CLOUDHSM-origin keys, and never treat kms:GetParametersForImport/
    kms:ImportKeyMaterial as an export grant.'
  narrative: '{key.name} uses imported (EXTERNAL) key material; its plaintext lives offline with the importer
    and is not retrievable from KMS.'