aws-kms-sign-forges-identity

Signing with a key that anchors an auth system forges the trusted identity.

derived aws emits CanImpersonate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanSignAs {'key': None}

where

node_type(?key) == SigningKey and DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric only; exclude GENERATE_VERIFY_MAC/HMAC keys — symmetric MACs do not forge public-key-verified identities) ?key's public key trust-anchors a workload/application identity (?appidentity) node_class(?appidentity) == Identity AND node_type(?appidentity) in [ApplicationIdentity, ServiceAccount, MachineIdentity] (CanImpersonate.target = [ServiceAccount, MachineIdentity, ApplicationIdentity]; a FederatedIdentity, Role, or code-signing trust anchor is NOT a valid CanImpersonate target)

emit

source type	`Identity`
source	`?principal`
target	`?appidentity`
permissions	`kms:Sign`
conditions	`trust_relationship`
state logic	if a concrete ApplicationIdentity/ServiceAccount/MachineIdentity anchored on ?key is known: ACTIVE; if the signing key's downstream trust is not resolved in the graph: POTENTIAL(trust_relationship)

Narrative

{principal.name} can sign as {key.name} (kms:Sign) and forge signatures that {appidentity.name}'s verifiers accept, impersonating it.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-sign-forges-identity
emits: CanImpersonate
description: Signing with a key that anchors an auth system forges the trusted identity.
match:
- - principal: null
  - CanSignAs
  - key: null
where:
- "node_type(?key) == SigningKey and DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric only; exclude GENERATE_VERIFY_MAC/HMAC\
  \ keys \u2014 symmetric MACs do not forge public-key-verified identities)"
- ?key's public key trust-anchors a workload/application identity (?appidentity)
- node_class(?appidentity) == Identity AND node_type(?appidentity) in [ApplicationIdentity, ServiceAccount,
  MachineIdentity] (CanImpersonate.target = [ServiceAccount, MachineIdentity, ApplicationIdentity]; a
  FederatedIdentity, Role, or code-signing trust anchor is NOT a valid CanImpersonate target)
emit:
  source_type: Identity
  source: ?principal
  target: ?appidentity
  permissions:
  - kms:Sign
  conditions:
  - trust_relationship
  state_logic: 'if a concrete ApplicationIdentity/ServiceAccount/MachineIdentity anchored on ?key is known:
    ACTIVE; if the signing key''s downstream trust is not resolved in the graph: POTENTIAL(trust_relationship)'
  confidence: min(contributing_confidences) * 0.7
  derived_from:
  - <CanSignAs edge_id>
  false_positive_note: "Only emit when a real trust anchor resolves to an ApplicationIdentity / ServiceAccount\
    \ / MachineIdentity (the public key verifies tokens/artifacts for that specific identity). If the\
    \ anchor is a SAML/OIDC issuer, a Role, or a FederatedIdentity, do NOT emit CanImpersonate \u2014\
    \ reach that identity via CanSignAs -> CanFederateAs/CanEscalateTo instead. Code-signing trust is\
    \ not an identity at all and yields no CanImpersonate. A SIGN_VERIFY key with no known downstream\
    \ verifier is CanSignAs only -> POTENTIAL, not a concrete impersonation. HMAC (GENERATE_VERIFY_MAC)\
    \ keys are excluded (symmetric MAC, not public-key signing)."
  narrative: '{principal.name} can sign as {key.name} (kms:Sign) and forge signatures that {appidentity.name}''s
    verifiers accept, impersonating it.'