rage.fail

create-key-capability

A principal whose effective permissions include key or service-account-key creation can mint new keys.

derived any cloud emits CanCreateKey

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'target': None}

where

node_type(?target) in [EncryptionKey, ServiceAccount] effective_action_on(?principal, ?target) intersects ['kms:CreateKey', 'iam:CreateServiceAccountKey', 'iam.serviceAccountKeys.create', 'cloudkms.cryptoKeys.create']

emit

source type	`Identity`
target type	`EncryptionKey`
source	`?principal`
target	`?target`
conditions	`iam_permission`

Narrative

{principal.name} can create keys on {target.name}.

Raw rule rules/derived/capability-completions.yaml

id: create-key-capability
emits: CanCreateKey
description: A principal whose effective permissions include key or service-account-key creation can mint
  new keys.
applies_to:
- '*'
match:
- - principal: null
  - HasPermission
  - target: null
where:
- node_type(?target) in [EncryptionKey, ServiceAccount]
- effective_action_on(?principal, ?target) intersects ['kms:CreateKey', 'iam:CreateServiceAccountKey',
  'iam.serviceAccountKeys.create', 'cloudkms.cryptoKeys.create']
emit:
  source_type: Identity
  target_type: EncryptionKey
  source: ?principal
  target: ?target
  conditions:
  - iam_permission
  derived_from:
  - ?principal HasPermission ?target
  narrative: '{principal.name} can create keys on {target.name}.'