azure-kv-administer-derives-sign

Key Vault Administrator can sign with every signing-capable key in the vault.

derived azure emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?key`
permissions	`Microsoft.KeyVault/vaults/keys/sign/action`
conditions	`key_permission` `network_reachability`
state logic	inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)

source type

Identity

source

?principal

target

?key

permissions

Microsoft.KeyVault/vaults/keys/sign/action

conditions

key_permission network_reachability

state logic

inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)

Narrative

{principal.name}, as Key Vault Administrator on {vault.name}, can sign with key {key.name}.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-administer-derives-sign
emits: CanSignAs
description: Key Vault Administrator can sign with every signing-capable key in the vault.
match:
- - principal: null
  - CanAdminister
  - vault: null
- - vault: null
  - Contains
  - key: null
where:
- the CanAdminister was produced by azure-kv-administer-dataplane on ?vault (data-plane vaults/*)
- 'node_class(?key) == SigningKey  # collector dual-types a KV key whose keyOps includes ''sign'' as SigningKey;
  CanSignAs target set is [SigningKey, ServiceAccount, ApplicationIdentity]'
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/vaults/keys/sign/action
  conditions:
  - key_permission
  - network_reachability
  state_logic: inherit the CanAdminister state (ACTIVE / CONDITIONAL(network_reachability) / BLOCKED)
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <azure-kv-administer-dataplane CanAdminister edge_id>
  - <Contains edge_id>
  false_positive_note: "Only for keys whose keyOps include 'sign' (dual-typed SigningKey by the collector).\
    \ vaults/* includes keys/sign. CanSignAs is a capability, not automatic escalation \u2014 do not auto-roll-up\
    \ to CanEscalateTo (see \xA714)."
  narrative: '{principal.name}, as Key Vault Administrator on {vault.name}, can sign with key {key.name}.'