azure-mhsm-security-domain-clone

id: azure-mhsm-security-domain-clone
emits: CanExportKey
description: Possession of the security domain + quorum keys can clone all HSM keys to a new pool.
match:
- - principal: null
  - CanAdminister
  - pool: null
- - pool: null
  - Contains
  - key: null
where:
- node_type(?pool) == ManagementService and ?pool.provider_type == 'Microsoft.KeyVault/managedHSMs'
- node_type(?key) in [EncryptionKey, SigningKey] (CanExportKey target set)
- ?principal (or an out-of-band actor) possesses the security-domain file AND the quorum of security-domain
  private keys
emit:
  source_type: Identity
  source: ?principal
  target: ?key
  permissions:
  - Microsoft.KeyVault/managedHsm/securitydomain/download/action
  - Microsoft.KeyVault/managedHsm/securitydomain/upload/action
  conditions:
  - condition_expression
  state_logic: 'POTENTIAL(condition_expression) always: security-domain custody (file + quorum of SD private
    keys) is an offline possession fact we generally cannot observe from ARM. Never assert ACTIVE without
    evidence of custody; if custody is unknown emit POTENTIAL for analyst review'
  confidence: min(contributing_confidences) * 0.4
  derived_from:
  - ?principal CanAdminister ?pool (explicit azure-mhsm-mgmt-admin, Azure RBAC managedHSMs/write)
  - ?pool Contains ?key
  - security-domain custody (out-of-band)
  false_positive_note: "This is a possession-based, offline capability: cloning requires the SD file plus\
    \ the quorum of private keys that encrypted it \u2014 NOT observable from ARM RBAC. Management-plane\
    \ control can DOWNLOAD the SD blob but cannot decrypt it without the quorum keys. Emit POTENTIAL only\
    \ (one edge per HSM key under the pool); never ACTIVE unless SD custody is independently evidenced.\
    \ Do not treat pool Contributor as key export."
  narrative: "{principal.name}, if it possesses {pool.name}'s security domain file and the quorum of security-domain\
    \ private keys, could clone {key.name} (and every key under {pool.name}) into a new pool \u2014 offline\
    \ export of the key material."