gcp-kms-can-mac
cloudkms.cryptoKeyVersions.macSign on a MAC key forges message authentication codes.
match (effective permission)
{
"action": "cloudkms.cryptoKeyVersions.macSign",
"resource_type": "google.cloud.kms.CryptoKey"
}
where
CryptoKey.purpose == MAC
at least one CryptoKeyVersion is ENABLED
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <CryptoKey (SigningKey subtype, MAC)> |
| permissions | cloudkms.cryptoKeyVersions.macSign |
| conditions | iam_permission resource_policy key_permission service_state |
| state logic | ACTIVE if macSign resolves on a MAC key with >=1 ENABLED version; CONDITIONAL(service_state) if all versions DISABLED; BLOCKED if DESTROYED or denied by VPC-SC/IAM deny. |
Narrative
{principal.name} can produce valid MACs with key {key.name} (cloudkms.cryptoKeyVersions.macSign) - forging message authentication codes.
Raw rule rules/derived/gcp/kms.yaml
id: gcp-kms-can-mac
emits: CanSignAs
description: cloudkms.cryptoKeyVersions.macSign on a MAC key forges message authentication codes.
match_effective_permission:
action: cloudkms.cryptoKeyVersions.macSign
resource_type: google.cloud.kms.CryptoKey
where:
- CryptoKey.purpose == MAC
- at least one CryptoKeyVersion is ENABLED
emit:
source_type: Identity
source: <principal>
target: <CryptoKey (SigningKey subtype, MAC)>
permissions:
- cloudkms.cryptoKeyVersions.macSign
conditions:
- iam_permission
- resource_policy
- key_permission
- service_state
state_logic: ACTIVE if macSign resolves on a MAC key with >=1 ENABLED version; CONDITIONAL(service_state)
if all versions DISABLED; BLOCKED if DESTROYED or denied by VPC-SC/IAM deny.
confidence: min(contributing_confidences) * 0.9
derived_from:
- <effective cloudkms.cryptoKeyVersions.macSign grant>
false_positive_note: "MAC is symmetric integrity, not asymmetric identity signing \u2014 value is forging/validating\
\ MACs for a protocol that trusts this key, not minting JWTs. macVerify is read-only. Only on purpose\
\ == MAC. A MAC key has NO public key and is NEVER a JWKS/JWT/OIDC trust anchor: do NOT roll this\
\ CanSignAs up to CanImpersonate / CanEscalateTo via gcp-kms-sign-forge-identity (that rule matches\
\ [?principal, CanSignAs, ?key] generically). gcp-kms-sign-forge-identity MUST require purpose ==\
\ ASYMMETRIC_SIGN with a published public-key anchor and skip MAC keys."
narrative: "{principal.name} can produce valid MACs with key {key.name} (cloudkms.cryptoKeyVersions.macSign)\
\ \u2014 forging message authentication codes."