gcp-kms-cmek-secret-credentials-for

A CMEK-encrypted Secret Manager payload authenticates as another identity, completing CanExecuteAs -> CanReadSecret -> CredentialsFor.

derived gcp emits CredentialsFor

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`<secret (Secret-class node / its payload Credential)>`
target	`<identity \| service account \| data store the payload authenticates as>`
state logic	ACTIVE when the payload class AND its target are determined from secret metadata; POTENTIAL when the credential type or target is unresolved (unknown payload). Zero base weight — value is realized only when paired with the CanReadSecret from gcp-kms-service-agent-cmek-gate.

source

<secret (Secret-class node / its payload Credential)>

target

<identity | service account | data store the payload authenticates as>

state logic

ACTIVE when the payload class AND its target are determined from secret metadata; POTENTIAL when the credential type or target is unresolved (unknown payload). Zero base weight — value is realized only when paired with the CanReadSecret from gcp-kms-service-agent-cmek-gate.

Narrative

CMEK secret {secret.name} holds credentials for {target.name}; reading its decrypted payload yields usable credentials for {target.name}.

Raw rule rules/derived/gcp/kms.yaml

id: gcp-kms-cmek-secret-credentials-for
emits: CredentialsFor
description: A CMEK-encrypted Secret Manager payload authenticates as another identity, completing CanExecuteAs
  -> CanReadSecret -> CredentialsFor.
match:
- - principal: null
  - CanReadSecret
  - secret: null
where:
- ?secret is a CMEK-encrypted Secret Manager secret (the CanReadSecret was gated by gcp-kms-service-agent-cmek-gate)
- '?secret''s payload is classified as a credential from metadata (name/labels/annotations), NEVER by
  reading the payload: SA JSON key -> ServiceAccount; OAuth/API token -> owning Identity; DB connection
  string / password -> Data store'
- the target identity/service-account/data store the payload authenticates as is identifiable from that
  metadata
emit:
  source: <secret (Secret-class node / its payload Credential)>
  target: <identity | service account | data store the payload authenticates as>
  permissions: []
  conditions: []
  state_logic: "ACTIVE when the payload class AND its target are determined from secret metadata; POTENTIAL\
    \ when the credential type or target is unresolved (unknown payload). Zero base weight \u2014 value\
    \ is realized only when paired with the CanReadSecret from gcp-kms-service-agent-cmek-gate."
  confidence: "0.7 (heuristic classification) \u2014 raise to 0.95 when the SA/user/DB is explicitly named\
    \ in labels/annotations"
  derived_from:
  - <CanReadSecret edge_id>
  - <secret payload classification evidence>
  false_positive_note: "ASSERTION, not an observed value \u2014 NEVER read the payload to confirm. Emit\
    \ only when metadata indicates a credential AND identifies the target; otherwise emit POTENTIAL or\
    \ omit rather than guess an identity. This completes the Phase-5 chain CanExecuteAs -> CanReadSecret\
    \ -> CredentialsFor for CMEK-gated Secret Manager secrets. Overlaps gcp-secretmanager-credentials-for\
    \ (same fact keyed from Secret Manager metadata) \u2014 de-duplicate on (secret, target) so the payload\
    \ credential is asserted once, not double-counted."
  narrative: CMEK secret {secret.name} holds credentials for {target.name}; reading its decrypted payload
    yields usable credentials for {target.name}.