azure-mhsm-crypto-user-decrypt

id: azure-mhsm-crypto-user-decrypt
emits: CanDecrypt
description: A Managed HSM local Crypto User role can decrypt/unwrap with an HSM key.
match:
- - principal: null
  - HasPolicy
  - assignment: null
- - pool: null
  - Contains
  - key: null
where:
- node_type(?key) == EncryptionKey
- ?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
- ?assignment is a Managed HSM LOCAL role assignment whose role definition dataActions include Microsoft.KeyVault/managedHsm/keys/decrypt/action
  OR .../keys/unwrap/action (carried by Crypto User; match on the DATA ACTION, not the role name)
- ?assignment.scope covers ?key (scope '/' = the whole pool ?pool, or the specific key ?key)
emit:
  target_type: EncryptionKey
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/managedHsm/keys/decrypt/action
  - Microsoft.KeyVault/managedHsm/keys/unwrap/action
  conditions:
  - iam_permission
  state_logic: 'if a Managed HSM local assignment with keys/decrypt or keys/unwrap resolves at the key
    scope: ACTIVE; if the local assignment set is not collected/resolvable: POTENTIAL(iam_permission)'
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPolicy ?assignment (Managed HSM local role)
  - ?pool Contains ?key
  - ?assignment.scope covers ?key
  false_positive_note: "Do NOT emit from Azure RBAC. Contributor/Owner/\"Managed HSM Contributor\" are\
    \ management-plane and grant NO key usage. Match on the presence of the keys/decrypt/action or keys/unwrap/action\
    \ data action, NOT on a role name: among the built-in roles ONLY Managed HSM Crypto User carries these\
    \ crypto data actions. Crypto Officer does NOT (it is role/deleted-key management only), and Administrator\
    \ does NOT have a decrypt data action either \u2014 neither authorizes this edge on its own (Administrator/Crypto\
    \ Officer reach decrypt only by first self-granting Crypto User; see azure-mhsm-admin-self-grant).\
    \ If local role assignments were not collected (requires Microsoft.KeyVault/managedHsm/roleAssignments/read),\
    \ downgrade to POTENTIAL(iam_permission) rather than asserting ACTIVE."
  narrative: '{principal.name} holds a Managed HSM local Crypto User role granting keys/decrypt on {key.name}
    and can decrypt any ciphertext or unwrap any wrapped key protected by it.'