azure-kv-selfgrant-derives-sign

A vault self-grant equally yields sign on every signing-capable key in the vault.

derived azure emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanGrantPermission {'principal': None} {'vault': None} Contains {'key': None}

where

the CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac on ?vault node_class(?key) == SigningKey # collector dual-types a KV key whose keyOps includes 'sign' as SigningKey; CanSignAs target set is [SigningKey, ServiceAccount, ApplicationIdentity]

emit

source typeIdentity
source?principal
target?key
permissionsMicrosoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write Microsoft.KeyVault/vaults/keys/sign/action
conditionskey_permission network_reachability
state logicinherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks caller: CONDITIONAL(network_reachability)

Narrative

{principal.name} can self-grant data-plane access to {vault.name} and then sign with key {key.name}.

Raw rule rules/derived/azure/keyvault.yaml

id: azure-kv-selfgrant-derives-sign
emits: CanSignAs
description: A vault self-grant equally yields sign on every signing-capable key in the vault.
match:
- - principal: null
  - CanGrantPermission
  - principal: null
- - vault: null
  - Contains
  - key: null
where:
- the CanGrantPermission was produced by azure-kv-contributor-selfgrant-accesspolicy or azure-kv-selfgrant-rbac
  on ?vault
- 'node_class(?key) == SigningKey  # collector dual-types a KV key whose keyOps includes ''sign'' as SigningKey;
  CanSignAs target set is [SigningKey, ServiceAccount, ApplicationIdentity]'
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/vaults/accessPolicies/write | Microsoft.Authorization/roleAssignments/write
  - Microsoft.KeyVault/vaults/keys/sign/action
  conditions:
  - key_permission
  - network_reachability
  state_logic: 'inherit the self-grant state (ACTIVE/BLOCKED); then if networkAcls Deny-default blocks
    caller: CONDITIONAL(network_reachability)'
  confidence: min(contributing_confidences) * 0.88
  derived_from:
  - <self-grant CanGrantPermission edge_id>
  - <Contains edge_id>
  false_positive_note: "Only for keys whose keyOps include 'sign' (dual-typed SigningKey). The self-grant\
    \ carries keys/sign. CanSignAs is a capability, not automatic escalation \u2014 do not roll up to\
    \ CanEscalateTo without issuer evidence."
  narrative: '{principal.name} can self-grant data-plane access to {vault.name} and then sign with key
    {key.name}.'
move · open · esc close