rage.fail

gcp-kms-can-mac-explicit

explicit gcp emits CanSignAs

match (effective permission)

{ "action": "cloudkms.cryptoKeyVersions.macSign", "resource_type": "google.cloud.kms.CryptoKey" }

where

CryptoKey.purpose == MAC >=1 CryptoKeyVersion is ENABLED

emit

source type	`Identity`
source	`<principal>`
target	`<CryptoKey node (SigningKey subtype, MAC)>`
permissions	`cloudkms.cryptoKeyVersions.macSign`

Narrative

{principal.name} can produce valid MACs with {key.name} (cloudkms.cryptoKeyVersions.macSign).

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-can-mac-explicit
emits: CanSignAs
applies_to:
- gcp
match_effective_permission:
  action: cloudkms.cryptoKeyVersions.macSign
  resource_type: google.cloud.kms.CryptoKey
where:
- CryptoKey.purpose == MAC
- '>=1 CryptoKeyVersion is ENABLED'
emit:
  source_type: Identity
  source: <principal>
  target: <CryptoKey node (SigningKey subtype, MAC)>
  api_source: policy evaluation + cryptoKeys.list (purpose)
  permissions:
  - cloudkms.cryptoKeyVersions.macSign
  narrative: '{principal.name} can produce valid MACs with {key.name} (cloudkms.cryptoKeyVersions.macSign).'