gcp-kms-can-sign
cloudkms.cryptoKeyVersions.useToSign on an ASYMMETRIC_SIGN key forges signatures.
match (effective permission)
{
"action": "cloudkms.cryptoKeyVersions.useToSign",
"resource_type": "google.cloud.kms.CryptoKey"
}
where
CryptoKey.purpose == ASYMMETRIC_SIGN
at least one CryptoKeyVersion is ENABLED
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <CryptoKey (SigningKey subtype)> |
| permissions | cloudkms.cryptoKeyVersions.useToSign |
| conditions | iam_permission resource_policy key_permission service_state |
| state logic | ACTIVE if useToSign resolves on an ASYMMETRIC_SIGN key with >=1 ENABLED version; CONDITIONAL(service_state) if all versions DISABLED; BLOCKED if all DESTROYED or a VPC-SC/IAM deny denies useToSign. |
Narrative
{principal.name} can sign as key {key.name} (cloudkms.cryptoKeyVersions.useToSign on an ASYMMETRIC_SIGN key) - forging signatures verifiable against its public key.
Raw rule rules/derived/gcp/kms.yaml
id: gcp-kms-can-sign
emits: CanSignAs
description: cloudkms.cryptoKeyVersions.useToSign on an ASYMMETRIC_SIGN key forges signatures.
match_effective_permission:
action: cloudkms.cryptoKeyVersions.useToSign
resource_type: google.cloud.kms.CryptoKey
where:
- CryptoKey.purpose == ASYMMETRIC_SIGN
- at least one CryptoKeyVersion is ENABLED
emit:
source_type: Identity
source: <principal>
target: <CryptoKey (SigningKey subtype)>
permissions:
- cloudkms.cryptoKeyVersions.useToSign
conditions:
- iam_permission
- resource_policy
- key_permission
- service_state
state_logic: ACTIVE if useToSign resolves on an ASYMMETRIC_SIGN key with >=1 ENABLED version; CONDITIONAL(service_state)
if all versions DISABLED; BLOCKED if all DESTROYED or a VPC-SC/IAM deny denies useToSign.
confidence: min(contributing_confidences) * 0.97
derived_from:
- <effective cloudkms.cryptoKeyVersions.useToSign grant>
false_positive_note: "Only on purpose == ASYMMETRIC_SIGN. useToVerify / viewPublicKey (getPublicKey)\
\ are read-only recon, NOT signing \u2014 do not emit from them. Signing capability is not identity\
\ impersonation by itself; the roll-up to CanImpersonate/ CanEscalateTo requires evidence the public\
\ key is a trust anchor (see gcp-kms-sign-forge-identity)."
narrative: "{principal.name} can sign as key {key.name} (cloudkms.cryptoKeyVersions.useToSign on an\
\ ASYMMETRIC_SIGN key) \u2014 forging signatures verifiable against its public key."