azure-mhsm-admin-self-grant

id: azure-mhsm-admin-self-grant
emits: CanGrantPermission
description: Any Managed HSM local role that carries roleAssignments/write can assign any local role,
  including to itself.
match:
- - principal: null
  - HasPolicy
  - assignment: null
where:
- "?assignment is a Managed HSM LOCAL role assignment whose dataActions include Microsoft.KeyVault/managedHsm/roleAssignments/write/action\
  \ (held by Managed HSM Administrator, Crypto Officer, OR Policy Administrator \u2014 match on the DATA\
  \ ACTION, not a single role name)"
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - Microsoft.KeyVault/managedHsm/roleAssignments/write/action
  conditions:
  - iam_permission
  state_logic: ACTIVE if a local assignment carrying roleAssignments/write/action resolves; POTENTIAL(iam_permission)
    if local assignments not collected
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - '?principal HasPolicy ?assignment (roleAssignments/write/action: Administrator, Crypto Officer, or
    Policy Administrator)'
  false_positive_note: "Microsoft.KeyVault/managedHsm/roleAssignments/write/action is held by THREE built-in\
    \ local roles \u2014 Managed HSM Administrator, Managed HSM Crypto Officer, AND Managed HSM Policy\
    \ Administrator \u2014 so ALL THREE can self-assign Crypto User (full key usage) exactly like Administrator;\
    \ gating solely on the Administrator role name silently drops the Crypto-Officer and Policy-Administrator\
    \ escalation paths. None of these three carries a crypto data action by itself (Administrator holds\
    \ securitydomain + roleAssignments; Crypto Officer holds role/deleted-key management; Policy Administrator\
    \ holds role management), so each reaches decrypt/sign only by first granting itself Crypto User \u2014\
    \ this edge models exactly that self-grant. Local RBAC has no deny model, so the only block is loss\
    \ of the assignment. Do not confuse with Azure RBAC \"Managed HSM Contributor\" (management-plane,\
    \ cannot touch local roleAssignments)."
  narrative: '{principal.name} holds a Managed HSM local role with roleAssignments/write (Administrator,
    Crypto Officer, or Policy Administrator) and can assign itself (or any principal) Crypto User, self-granting
    full key usage.'