azure-mhsm-crypto-user-sign

id: azure-mhsm-crypto-user-sign
emits: CanSignAs
description: A Managed HSM local Crypto User role can sign with an HSM signing key.
match:
- - principal: null
  - HasPolicy
  - assignment: null
- - pool: null
  - Contains
  - key: null
where:
- node_type(?key) == SigningKey
- ?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
- ?key.keyOps includes 'sign'
- ?assignment is a Managed HSM LOCAL role assignment whose role definition dataActions include Microsoft.KeyVault/managedHsm/keys/sign/action
  (carried by Crypto User; match on the DATA ACTION, not the role name)
- ?assignment.scope covers ?key (scope '/' = the whole pool ?pool, or the specific key ?key)
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/managedHsm/keys/sign/action
  conditions:
  - iam_permission
  state_logic: 'if a Managed HSM local assignment with keys/sign resolves at the key scope: ACTIVE; if
    not collected/resolvable: POTENTIAL(iam_permission)'
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal HasPolicy ?assignment (Managed HSM local role)
  - ?pool Contains ?key
  - ?assignment.scope covers ?key
  false_positive_note: 'Signing alone is escalation only when the key backs a token/cert issuer or an
    application''s client-assertion (see azure-mhsm-sign-as-issuer). A key that only signs opaque data
    (e.g. code-signing unrelated to identity) is CanSignAs but does not roll up to impersonation. Match
    on the presence of the keys/sign/action data action, NOT on a role name: among the built-in roles
    ONLY Managed HSM Crypto User carries keys/sign/action. Crypto Officer does NOT (it is role/deleted-key
    management only) and Administrator does NOT; neither can sign without first self-granting Crypto User.
    Never emit from Azure RBAC.'
  narrative: '{principal.name} holds a Managed HSM local Crypto User role granting keys/sign on {key.name}
    and can produce signatures as that key.'