rage.fail

gcp-kms-can-sign-explicit

explicit gcp emits CanSignAs

match (effective permission)

{ "action": "cloudkms.cryptoKeyVersions.useToSign", "resource_type": "google.cloud.kms.CryptoKey" }

where

CryptoKey.purpose == ASYMMETRIC_SIGN >=1 CryptoKeyVersion is ENABLED

emit

source type	`Identity`
source	`<principal>`
target	`<CryptoKey node (SigningKey subtype)>`
permissions	`cloudkms.cryptoKeyVersions.useToSign`

Narrative

{principal.name} can sign as {key.name} (cloudkms.cryptoKeyVersions.useToSign) - forge signatures against its public key.

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-can-sign-explicit
emits: CanSignAs
applies_to:
- gcp
match_effective_permission:
  action: cloudkms.cryptoKeyVersions.useToSign
  resource_type: google.cloud.kms.CryptoKey
where:
- CryptoKey.purpose == ASYMMETRIC_SIGN
- '>=1 CryptoKeyVersion is ENABLED'
emit:
  source_type: Identity
  source: <principal>
  target: <CryptoKey node (SigningKey subtype)>
  api_source: policy evaluation + cryptoKeys.list (purpose)
  permissions:
  - cloudkms.cryptoKeyVersions.useToSign
  narrative: "{principal.name} can sign as {key.name} (cloudkms.cryptoKeyVersions.useToSign) \u2014 forge\
    \ signatures against its public key."