azure-mhsm-release-export-key
A holder of keys/release/action (Crypto User or Crypto Service Release User) can export an exportable HSM key via Secure Key Release.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
?assignment is a Managed HSM LOCAL role assignment whose dataActions include Microsoft.KeyVault/managedHsm/keys/release/action (carried by Crypto User OR Crypto Service Release User; match on the DATA ACTION, not the role name)
?assignment.scope covers ?key
?key.attributes.exportable == true
?key has a release policy
emit
| source type | Identity |
|---|---|
| source | ?principal |
| target | ?key |
| permissions | Microsoft.KeyVault/managedHsm/keys/release/action |
| conditions | iam_permission condition_expression |
| state logic | POTENTIAL(condition_expression) by default: release requires the caller/enclave to present an attestation the release policy accepts. ACTIVE only if key.exportable==true AND a release policy is present AND a satisfiable attestation is available; if exportable is false or no release policy: do NOT emit |
Narrative
{principal.name} holds a Managed HSM local role with keys/release/action (Crypto User or Crypto Service Release User) on exportable key {key.name}; with a satisfiable release policy/attestation it could export the raw key material for offline decrypt/sign.
Raw rule rules/derived/azure/managedhsm.yaml
id: azure-mhsm-release-export-key
emits: CanExportKey
description: A holder of keys/release/action (Crypto User or Crypto Service Release User) can export an
exportable HSM key via Secure Key Release.
match:
- - principal: null
- HasPolicy
- assignment: null
- - pool: null
- Contains
- key: null
where:
- ?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
- ?assignment is a Managed HSM LOCAL role assignment whose dataActions include Microsoft.KeyVault/managedHsm/keys/release/action
(carried by Crypto User OR Crypto Service Release User; match on the DATA ACTION, not the role name)
- ?assignment.scope covers ?key
- ?key.attributes.exportable == true
- ?key has a release policy
emit:
source_type: Identity
source: ?principal
target: ?key
permissions:
- Microsoft.KeyVault/managedHsm/keys/release/action
conditions:
- iam_permission
- condition_expression
state_logic: 'POTENTIAL(condition_expression) by default: release requires the caller/enclave to present
an attestation the release policy accepts. ACTIVE only if key.exportable==true AND a release policy
is present AND a satisfiable attestation is available; if exportable is false or no release policy:
do NOT emit'
confidence: min(contributing_confidences) * 0.6
derived_from:
- '?principal HasPolicy ?assignment (keys/release/action: Crypto User or Crypto Service Release User)'
- ?pool Contains ?key
- ?assignment.scope covers ?key
false_positive_note: "Gate on the keys/release/action data action, NOT a single role name: keys/release/action\
\ is held by BOTH Managed HSM Crypto User AND Managed HSM Crypto Service Release User, so a plain\
\ Crypto User can also request Secure Key Release of an exportable key \u2014 attributing it solely\
\ to Crypto Service Release User misses the Crypto-User export path. Keys are non-exportable by default.\
\ Secure Key Release (SKR) still requires the key attribute exportable==true, a configured release\
\ policy, AND a valid attestation from a trusted enclave that satisfies that policy. Role/action membership\
\ alone is NOT sufficient -> emit POTENTIAL(condition_expression), not ACTIVE. Never emit for a key\
\ without exportable==true and a release policy. Do not derive from Azure RBAC."
narrative: '{principal.name} holds a Managed HSM local role with keys/release/action (Crypto User or
Crypto Service Release User) on exportable key {key.name}; with a satisfiable release policy/attestation
it could export the raw key material for offline decrypt/sign.'