azure-mhsm-sign-as-issuer

Signing with an HSM key that backs a token/cert issuer lets the caller sign as that identity.

derived azure emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`?principal`
target	`?identity`
permissions	`Microsoft.KeyVault/managedHsm/keys/sign/action`
conditions	`iam_permission`
state logic	inherit_weakest(CanSignAs input): ACTIVE if the CanSignAs on ?key is ACTIVE and the key->issuer CredentialsFor is evidenced; else inherits the weaker state

source type

Identity

source

?principal

target

?identity

permissions

Microsoft.KeyVault/managedHsm/keys/sign/action

conditions

iam_permission

state logic

inherit_weakest(CanSignAs input): ACTIVE if the CanSignAs on ?key is ACTIVE and the key->issuer CredentialsFor is evidenced; else inherits the weaker state

Narrative

{principal.name} can sign as {identity.name} by using HSM key {key.name}, which backs that identity's token/certificate issuer.

Raw rule rules/derived/azure/managedhsm.yaml

id: azure-mhsm-sign-as-issuer
emits: CanSignAs
description: Signing with an HSM key that backs a token/cert issuer lets the caller sign as that identity.
match:
- - principal: null
  - CanSignAs
  - key: null
- - key: null
  - CredentialsFor
  - identity: null
where:
- ?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
- ?key is the signing key of a token issuer / SAML IdP / application client-assertion (evidenced CredentialsFor
  link)
- node_class(?identity) in [ApplicationIdentity, ServiceAccount] (CanSignAs target set)
emit:
  source_type: Identity
  source: ?principal
  target: ?identity
  permissions:
  - Microsoft.KeyVault/managedHsm/keys/sign/action
  conditions:
  - iam_permission
  state_logic: 'inherit_weakest(CanSignAs input): ACTIVE if the CanSignAs on ?key is ACTIVE and the key->issuer
    CredentialsFor is evidenced; else inherits the weaker state'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?principal CanSignAs ?key
  - ?key CredentialsFor ?identity
  false_positive_note: "Requires an EVIDENCED link that the key signs tokens/assertions for ?identity\
    \ (key CredentialsFor issuer). Do not assume every HSM signing key is an identity issuer; many sign\
    \ artifacts unrelated to authentication. When the issuer binding is unknown, do not emit \u2014 leave\
    \ the plain CanSignAs(principal -> key) only."
  narrative: '{principal.name} can sign as {identity.name} by using HSM key {key.name}, which backs that
    identity''s token/certificate issuer.'