rage.fail

azure-mhsm-can-release

explicit azure emits CanExportKey

match (effective permission)

{ "action": "Microsoft.KeyVault/managedHsm/keys/release/action", "resource_type": "Microsoft.KeyVault/managedHSMs/keys" }

where

effective grant is a Managed HSM LOCAL role carrying keys/release/action (Crypto User OR Crypto Service Release User — match on the data action, not a single role name) key.attributes.exportable == true AND a release policy is present (else do not emit — see derived rule state)

emit

source type	`Identity`
source	`<principal>`
target	`<key node>`
permissions	`Microsoft.KeyVault/managedHsm/keys/release/action`

Narrative

{principal.name} can request Secure Key Release of exportable key {key.name}.

Raw rule rules/explicit/azure-managedhsm.yaml

id: azure-mhsm-can-release
emits: CanExportKey
applies_to:
- azure
match_effective_permission:
  action: Microsoft.KeyVault/managedHsm/keys/release/action
  resource_type: Microsoft.KeyVault/managedHSMs/keys
where:
- "effective grant is a Managed HSM LOCAL role carrying keys/release/action (Crypto User OR Crypto Service\
  \ Release User \u2014 match on the data action, not a single role name)"
- "key.attributes.exportable == true AND a release policy is present (else do not emit \u2014 see derived\
  \ rule state)"
emit:
  source_type: Identity
  source: <principal>
  target: <key node>
  api_source: GET {hsm}/RoleAssignments + GET {hsm}/keys/{name} (exportable, release_policy)
  permissions:
  - Microsoft.KeyVault/managedHsm/keys/release/action
  narrative: '{principal.name} can request Secure Key Release of exportable key {key.name}.'