azure-kv-selfgrant-derives-sign
A vault self-grant equally yields sign on every signing-capable key in the vault.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
the
CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac on ?vault
node_class(?key) == SigningKey # collector dual-types a KV key whose keyOps includes 'sign' as SigningKey; CanSignAs target set is [SigningKey, ServiceAccount, ApplicationIdentity]
emit
| source type | Identity |
|---|---|
| source | ?principal |
| target | ?key |
| permissions | Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write Microsoft.KeyVault/vaults/keys/sign/action |
| conditions | key_permission network_reachability |
| state logic | inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks caller: CONDITIONAL(network_reachability) |
Narrative
{principal.name} can self-grant data-plane access to {vault.name} and then sign with key {key.name}.
Raw rule rules/derived/azure/keyvault.yaml
id: azure-kv-selfgrant-derives-sign
emits: CanSignAs
description: A vault self-grant equally yields sign on every signing-capable key in the vault.
match:
- - principal: null
- CanGrantPermission
- principal: null
- - vault: null
- Contains
- key: null
where:
- the CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac
on ?vault
- 'node_class(?key) == SigningKey # collector dual-types a KV key whose keyOps includes ''sign'' as SigningKey;
CanSignAs target set is [SigningKey, ServiceAccount, ApplicationIdentity]'
emit:
source_type: Identity
source: ?principal
target: ?key
permissions:
- Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write
- Microsoft.KeyVault/vaults/keys/sign/action
conditions:
- key_permission
- network_reachability
state_logic: 'inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks
caller: CONDITIONAL(network_reachability)'
confidence: min(contributing_confidences) * 0.88
derived_from:
- <self-grant CanGrantPermission edge_id>
- <Contains edge_id>
false_positive_note: "Only for keys whose keyOps include 'sign' (dual-typed SigningKey). The self-grant\
\ carries keys/sign. CanSignAs is a capability, not automatic escalation \u2014 do not roll up to\
\ CanEscalateTo without issuer evidence."
narrative: '{principal.name} can self-grant data-plane access to {vault.name} and then sign with key
{key.name}.'