gcp-kms-escalate-via-selfgrant
A key manager self-granting crypto use gains the key's crypto capability.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
the
CanGrantPermission derives from cloudkms.cryptoKeys/keyRings.setIamPolicy
the resulting crypto capability (decrypt/sign) grants strictly-more access than the principal already holds (e.g. unlocks CMEK data or forges a trusted signature it could not before)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <principal-with-crypto-capability | anchored identity> |
| permissions | cloudkms.cryptoKeys.setIamPolicy |
| conditions | iam_permission key_permission |
| state logic | POTENTIAL until the self-binding is applied (two-step), then inherits the realized CanDecrypt/CanSignAs state. BLOCKED if setIamPolicy is denied. |
Narrative
{principal.name} can escalate by self-granting crypto use on {key.name} via setIamPolicy (KMS separation-of-duties break).
Raw rule rules/derived/gcp/kms.yaml
id: gcp-kms-escalate-via-selfgrant
emits: CanEscalateTo
description: A key manager self-granting crypto use gains the key's crypto capability.
match:
- - principal: null
- CanGrantPermission
- principal: null
where:
- the CanGrantPermission derives from cloudkms.cryptoKeys/keyRings.setIamPolicy
- the resulting crypto capability (decrypt/sign) grants strictly-more access than the principal already
holds (e.g. unlocks CMEK data or forges a trusted signature it could not before)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <principal-with-crypto-capability | anchored identity>
permissions:
- cloudkms.cryptoKeys.setIamPolicy
conditions:
- iam_permission
- key_permission
state_logic: POTENTIAL until the self-binding is applied (two-step), then inherits the realized CanDecrypt/CanSignAs
state. BLOCKED if setIamPolicy is denied.
confidence: min(contributing_confidences) * 0.85
derived_from:
- <CanGrantPermission (setIamPolicy) edge_id>
false_positive_note: Only escalation when the self-granted crypto capability is strictly more than the
caller already has. A manager who is ALSO already a crypto user gains nothing new -> not escalation.
Two-step -> at best POTENTIAL until applied.
narrative: '{principal.name} can escalate by self-granting crypto use on {key.name} via setIamPolicy
(KMS separation-of-duties break).'