gcp-certmanager-escalate-via-forged-identity

Forging a cert that impersonates a strictly more-privileged identity is escalation.

derived gcp emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<forged identity>`
permissions	`privateca.certificates.create` `privateca.caPools.use`
conditions	`iam_permission` `condition_expression` `trust_relationship`
state logic	Inherits the CanImpersonate state (double-gated on the issuance policy and the trust consumer; KMS-backed CAs remain CONDITIONAL(key_permission) until the service-agent grant is confirmed).

source type

Identity

target type

Identity

source

<principal>

target

<forged identity>

permissions

privateca.certificates.create privateca.caPools.use

conditions

iam_permission condition_expression trust_relationship

state logic

Inherits the CanImpersonate state (double-gated on the issuance policy and the trust consumer; KMS-backed CAs remain CONDITIONAL(key_permission) until the service-agent grant is confirmed).

Narrative

{principal.name} can escalate to {target.name} by forging a certificate from {capool.name} that a downstream trust accepts as {target.name}.

Raw rule rules/derived/gcp/certmanager.yaml

id: gcp-certmanager-escalate-via-forged-identity
emits: CanEscalateTo
description: Forging a cert that impersonates a strictly more-privileged identity is escalation.
match:
- - principal: null
  - CanImpersonate
  - target: null
where:
- ?target.privilege_level > ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <forged identity>
  permissions:
  - privateca.certificates.create
  - privateca.caPools.use
  conditions:
  - iam_permission
  - condition_expression
  - trust_relationship
  state_logic: Inherits the CanImpersonate state (double-gated on the issuance policy and the trust consumer;
    KMS-backed CAs remain CONDITIONAL(key_permission) until the service-agent grant is confirmed).
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanImpersonate edge_id>
  false_positive_note: "Only emit when the forged identity is strictly more privileged than the caller;\
    \ a cert for a same/lower-privilege subject is lateral, not escalation. Inherits the issuance-policy\
    \ and trust gates from CanImpersonate \u2014 never ACTIVE while either is unconfirmed."
  narrative: '{principal.name} can escalate to {target.name} by forging a certificate from {capool.name}
    that a downstream trust accepts as {target.name}.'