gcp-kms-cross-project-cmek-grant
A key binding naming a principal/service-agent in another project is cross-project trust.
match (record)
{
"field": "iamPolicy.bindings[].members",
"resource_type": "google.cloud.kms.CryptoKey"
}
where
a binding on the key (or its keyRing) grants a cloudkms.* role to a member (user/SA/service-agent) whose project != key.project
emit
| source | <key.project> |
|---|---|
| target | <member.project | external identity> |
| permissions | cloudkms.cryptoKeys.getIamPolicy |
| conditions | resource_policy |
| state logic | ACTIVE if the cross-project binding is present and not neutralized by an IAM deny / DOMAIN_RESTRICTED_SHARING org policy / VPC-SC perimeter; else BLOCKED. |
Narrative
Key {key.name} in project {key.project} grants crypto use to {member.name} in project {member.project} (cross-project CMEK trust).
Raw rule rules/derived/gcp/kms.yaml
id: gcp-kms-cross-project-cmek-grant
emits: CrossProjectTrust
description: A key binding naming a principal/service-agent in another project is cross-project trust.
match_record:
resource_type: google.cloud.kms.CryptoKey
field: iamPolicy.bindings[].members
where:
- a binding on the key (or its keyRing) grants a cloudkms.* role to a member (user/SA/service-agent) whose
project != key.project
emit:
source: <key.project>
target: <member.project | external identity>
permissions:
- cloudkms.cryptoKeys.getIamPolicy
conditions:
- resource_policy
state_logic: ACTIVE if the cross-project binding is present and not neutralized by an IAM deny / DOMAIN_RESTRICTED_SHARING
org policy / VPC-SC perimeter; else BLOCKED.
confidence: '0.9'
derived_from:
- <key iamPolicy binding to a foreign-project member>
false_positive_note: 'Common and often legitimate: cross-project CMEK grants a consuming project''s
SERVICE AGENT cryptoKeyEncrypterDecrypter. This edge records the trust; it is only attack-relevant
when the granted principal is attacker-controllable and privileged in the key''s project (see gcp-kms-cross-project-enter).
Honor condition expressions on the binding.'
narrative: Key {key.name} in project {key.project} grants crypto use to {member.name} in project {member.project}
(cross-project CMEK trust).