azure-kv-selfgrant-derives-decrypt

A vault self-grant equally yields decrypt/unwrap on every key in the vault.

derived azure emits CanDecrypt

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

target type	`EncryptionKey`
source	`?principal`
target	`?key`
permissions	`Microsoft.KeyVault/vaults/accessPolicies/write \| Microsoft.Authorization/roleAssignments/write` `Microsoft.KeyVault/vaults/keys/decrypt/action` `Microsoft.KeyVault/vaults/keys/unwrap/action`
conditions	`key_permission` `network_reachability`
state logic	inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks caller: CONDITIONAL(network_reachability)

target type

EncryptionKey

source

?principal

target

?key

permissions

Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write Microsoft.KeyVault/vaults/keys/decrypt/action Microsoft.KeyVault/vaults/keys/unwrap/action

conditions

key_permission network_reachability

state logic

inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks caller: CONDITIONAL(network_reachability)

Narrative

{principal.name} can self-grant data-plane access to {vault.name} and then decrypt/unwrap with key {key.name}.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-selfgrant-derives-decrypt
emits: CanDecrypt
description: A vault self-grant equally yields decrypt/unwrap on every key in the vault.
match:
- - principal: null
  - CanGrantPermission
  - principal: null
- - vault: null
  - Contains
  - key: null
where:
- the CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac
  on ?vault
- node_class(?key) == EncryptionKey
emit:
  target_type: EncryptionKey
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write
  - Microsoft.KeyVault/vaults/keys/decrypt/action
  - Microsoft.KeyVault/vaults/keys/unwrap/action
  conditions:
  - key_permission
  - network_reachability
  state_logic: 'inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks
    caller: CONDITIONAL(network_reachability)'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <self-grant CanGrantPermission edge_id>
  - <Contains edge_id>
  false_positive_note: "The self-grant (access-policy write or roleAssignments/write) grants the full\
    \ key permission set, not just secrets \u2014 including keys/decrypt + keys/unwrap. Two-step but fully\
    \ within the principal's control; vault-wide."
  narrative: '{principal.name} can self-grant data-plane access to {vault.name} and then decrypt/unwrap
    with key {key.name}.'