aws-kms-sign-via-key-admin

Admin of a SIGN_VERIFY key can self-grant kms:Sign and forge signatures.

derived aws emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanAdminister {'key': None}

where

node_type(?key) == SigningKey (SIGN_VERIFY / HMAC keys carry the SigningKey subtype; required so the CanSignAs target conforms to edges.yaml target set [SigningKey, ServiceAccount, ApplicationIdentity]) DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric) OR GENERATE_VERIFY_MAC (HMAC) DescribeKey.KeyManager == CUSTOMER

emit

source type	`Identity`
source	`?principal`
target	`?key`
permissions	`kms:PutKeyPolicy` `kms:CreateGrant` `kms:Sign` `kms:GenerateMac`
conditions	`scp_or_org_policy` `resource_policy` `condition_expression`
state logic	if PutKeyPolicy is confirmed unconstrained (the existing key policy contains no Deny the admin cannot remove) AND CreateGrant is not constrained by kms:GranteePrincipal/kms:GrantConstraintType/kms:GrantIsForAWSResource: ACTIVE; elif the key policy retains a Deny the admin cannot lift, or CreateGrant is grant-constrained: CONDITIONAL(resource_policy); else BLOCKED(scp_or_org_policy) when an SCP/boundary denies PutKeyPolicy/CreateGrant

Narrative

{principal.name} administers signing key {key.name} and can self-grant kms:Sign, forging signatures trusted by anything anchored on its public key.

Raw rule rules/derived/aws/kms.yaml

id: aws-kms-sign-via-key-admin
emits: CanSignAs
description: Admin of a SIGN_VERIFY key can self-grant kms:Sign and forge signatures.
match:
- - principal: null
  - CanAdminister
  - key: null
where:
- node_type(?key) == SigningKey (SIGN_VERIFY / HMAC keys carry the SigningKey subtype; required so the
  CanSignAs target conforms to edges.yaml target set [SigningKey, ServiceAccount, ApplicationIdentity])
- DescribeKey.KeyUsage == SIGN_VERIFY (asymmetric) OR GENERATE_VERIFY_MAC (HMAC)
- DescribeKey.KeyManager == CUSTOMER
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions:
  - kms:PutKeyPolicy
  - kms:CreateGrant
  - kms:Sign
  - kms:GenerateMac
  conditions:
  - scp_or_org_policy
  - resource_policy
  - condition_expression
  state_logic: 'if PutKeyPolicy is confirmed unconstrained (the existing key policy contains no Deny the
    admin cannot remove) AND CreateGrant is not constrained by kms:GranteePrincipal/kms:GrantConstraintType/kms:GrantIsForAWSResource:
    ACTIVE; elif the key policy retains a Deny the admin cannot lift, or CreateGrant is grant-constrained:
    CONDITIONAL(resource_policy); else BLOCKED(scp_or_org_policy) when an SCP/boundary denies PutKeyPolicy/CreateGrant'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanAdminister edge_id>
  false_positive_note: 'Only for SIGN_VERIFY / GENERATE_VERIFY_MAC customer-managed keys (both carry the
    SigningKey subtype); an ENCRYPT_DECRYPT key cannot sign. Self-grant is doubly gated: kms:PutKeyPolicy
    must not be blocked by an SCP/boundary AND the default key-policy rule that at least one principal
    retains access can leave a residual Deny the admin cannot remove; kms:CreateGrant is further constrained
    by kms:GranteePrincipal / kms:GrantConstraintType / kms:GrantIsForAWSResource. Keep ACTIVE only when
    PutKeyPolicy is confirmed unconstrained -> otherwise CONDITIONAL(resource_policy). Blocked by SCP/boundary
    denying PutKeyPolicy/CreateGrant.'
  narrative: '{principal.name} administers signing key {key.name} and can self-grant kms:Sign, forging
    signatures trusted by anything anchored on its public key.'