azure-mhsm-admin-escalate
A self-grant of a crypto role (via roleAssignments/write) is privilege escalation to key usage.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
the grantable local roles include Crypto User (keys/decrypt|sign|unwrap|release)
those crypto data actions are strictly more privileged than what ?principal currently holds
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?principal |
| permissions | Microsoft.KeyVault/managedHsm/roleAssignments/write/action |
| conditions | iam_permission |
| state logic | inherit from CanGrantPermission: ACTIVE if the self-grant is ACTIVE |
Narrative
{principal.name} can escalate to full Managed HSM key usage by granting itself Crypto User via its roleAssignments/write (Administrator, Crypto Officer, or Policy Administrator) role.
Raw rule rules/derived/azure/managedhsm.yaml
id: azure-mhsm-admin-escalate
emits: CanEscalateTo
description: A self-grant of a crypto role (via roleAssignments/write) is privilege escalation to key
usage.
match:
- - principal: null
- CanGrantPermission
- principal: null
where:
- the grantable local roles include Crypto User (keys/decrypt|sign|unwrap|release)
- those crypto data actions are strictly more privileged than what ?principal currently holds
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?principal
permissions:
- Microsoft.KeyVault/managedHsm/roleAssignments/write/action
conditions:
- iam_permission
state_logic: 'inherit from CanGrantPermission: ACTIVE if the self-grant is ACTIVE'
confidence: min(contributing_confidences) * 0.9
derived_from:
- ?principal CanGrantPermission ?principal (Administrator, Crypto Officer, or Policy Administrator)
false_positive_note: Only escalation if the crypto capability gained is strictly greater than the principal
already holds. Any of the three roleAssignments/write holders (Administrator, Crypto Officer, Policy
Administrator) can perform the self-grant; none carries a crypto data action already, so each gains
keys/decrypt|sign|unwrap by assigning itself Crypto User. A principal that is already Crypto User
gains nothing new -> do not emit. Inherits state from the self-grant edge.
narrative: '{principal.name} can escalate to full Managed HSM key usage by granting itself Crypto User
via its roleAssignments/write (Administrator, Crypto Officer, or Policy Administrator) role.'