rage.fail

gcp-kms-can-decrypt-explicit

explicit gcp emits CanDecrypt

match (effective permission)

{ "action": "cloudkms.cryptoKeyVersions.useToDecrypt", "resource_type": "google.cloud.kms.CryptoKey" }

where

CryptoKey.purpose in [ENCRYPT_DECRYPT, RAW_ENCRYPT_DECRYPT, ASYMMETRIC_DECRYPT] >=1 CryptoKeyVersion is ENABLED

emit

target type	`EncryptionKey`
source	`<principal>`
target	`<CryptoKey node (EncryptionKey subtype)>`
permissions	`cloudkms.cryptoKeyVersions.useToDecrypt`

Narrative

{principal.name} can decrypt with {key.name} (cloudkms.cryptoKeyVersions.useToDecrypt).

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-can-decrypt-explicit
emits: CanDecrypt
applies_to:
- gcp
match_effective_permission:
  action: cloudkms.cryptoKeyVersions.useToDecrypt
  resource_type: google.cloud.kms.CryptoKey
where:
- CryptoKey.purpose in [ENCRYPT_DECRYPT, RAW_ENCRYPT_DECRYPT, ASYMMETRIC_DECRYPT]
- '>=1 CryptoKeyVersion is ENABLED'
emit:
  target_type: EncryptionKey
  source: <principal>
  target: <CryptoKey node (EncryptionKey subtype)>
  api_source: "policy evaluation (Policy Analyzer) \u2014 NOT a live decrypt call"
  permissions:
  - cloudkms.cryptoKeyVersions.useToDecrypt
  narrative: '{principal.name} can decrypt with {key.name} (cloudkms.cryptoKeyVersions.useToDecrypt).'