rage.fail

azure-mhsm-contains-key

explicit azure emits Contains

match (record)

{ "field": "id", "resource_type": "Microsoft.KeyVault/managedHSMs/keys" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<Managed HSM pool boundary node (AdministrativeBoundary/KMS boundary)>`
target	`<key node>`

Narrative

Managed HSM pool {pool.name} contains HSM key {key.name}.

Raw rule rules/explicit/azure-managedhsm.yaml

id: azure-mhsm-contains-key
emits: Contains
applies_to:
- azure
match_record:
  resource_type: Microsoft.KeyVault/managedHSMs/keys
  field: id
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <Managed HSM pool boundary node (AdministrativeBoundary/KMS boundary)>
  target: <key node>
  api_source: GET {hsm}/keys
  evidence_field: id
  narrative: Managed HSM pool {pool.name} contains HSM key {key.name}.