rage.fail

azure-kv-administer-derives-decrypt

Key Vault Administrator can decrypt/unwrap with every key in the vault.

derived azure emits CanDecrypt

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanAdminister {'vault': None} {'vault': None} Contains {'key': None}

where

the CanAdminister was produced by azure-kv-administer-dataplane on ?vault (data-plane vaults/*) node_class(?key) == EncryptionKey

emit

target type	`EncryptionKey`
source	`?principal`
target	`?key`
permissions	`Microsoft.KeyVault/vaults/keys/decrypt/action` `Microsoft.KeyVault/vaults/keys/unwrap/action`
conditions	`key_permission` `network_reachability`
state logic	inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)

Narrative

{principal.name}, as Key Vault Administrator on {vault.name}, can decrypt/unwrap with key {key.name}.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-administer-derives-decrypt
emits: CanDecrypt
description: Key Vault Administrator can decrypt/unwrap with every key in the vault.
match:
- - principal: null
  - CanAdminister
  - vault: null
- - vault: null
  - Contains
  - key: null
where:
- the CanAdminister was produced by azure-kv-administer-dataplane on ?vault (data-plane vaults/*)
- node_class(?key) == EncryptionKey
emit:
  target_type: EncryptionKey
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/vaults/keys/decrypt/action
  - Microsoft.KeyVault/vaults/keys/unwrap/action
  conditions:
  - key_permission
  - network_reachability
  state_logic: inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)
  confidence: min(contributing_confidences) * 0.98
  derived_from:
  - <azure-kv-administer-dataplane CanAdminister edge_id>
  - <Contains edge_id>
  false_positive_note: Fans out only from the DATA-plane CanAdminister (vaults/* includes keys/decrypt
    + keys/unwrap). Not from control-plane vaults/write.
  narrative: '{principal.name}, as Key Vault Administrator on {vault.name}, can decrypt/unwrap with key
    {key.name}.'