rage.fail

gcp-certmanager-kms-key-ref

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "keySpec.cloudKmsKeyVersion | tier", "resource_type": "google.privateca.CertificateAuthority" }

where

CA is KMS-backed (Enterprise tier over a customer Cloud KMS/HSM key)

emit

target type	`*`
source	`<CertificateAuthority node>`
target	`<Cloud KMS CryptoKeyVersion referenced by keySpec>`

Narrative

{ca.name} signs with Cloud KMS key {key.name}; the CAS service agent (not the caller) must hold cloudkms.cryptoKeyVersions.useToSign on it.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-kms-key-ref
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type: google.privateca.CertificateAuthority
  field: keySpec.cloudKmsKeyVersion | tier
where:
- CA is KMS-backed (Enterprise tier over a customer Cloud KMS/HSM key)
emit:
  target_type: '*'
  source: <CertificateAuthority node>
  target: <Cloud KMS CryptoKeyVersion referenced by keySpec>
  api_source: privateca.projects.locations.caPools.certificateAuthorities.get
  evidence_field: keySpec.cloudKmsKeyVersion / tier
  note: The CAS service agent (service-PROJECT_NUMBER@gcp-sa-privateca.iam.gserviceaccount.com), not the
    caller, signs with this key via cloudkms.cryptoKeyVersions.useToSign; drives the key_permission service-agent
    gate in gcp-certmanager-sign-cmek-gate.
  narrative: '{ca.name} signs with Cloud KMS key {key.name}; the CAS service agent (not the caller) must
    hold cloudkms.cryptoKeyVersions.useToSign on it.'