gcp-kms-selfgrant-to-sign

A key manager that can setIamPolicy can self-grant and then sign.

derived gcp emits CanSignAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
source	`<principal>`
target	`<CryptoKey (SigningKey subtype)>`
permissions	`cloudkms.cryptoKeys.setIamPolicy` `cloudkms.cryptoKeyVersions.useToSign`
conditions	`iam_permission` `key_permission` `service_state`
state logic	POTENTIAL(key_permission) — requires FIRST self-binding roles/cloudkms.signer (or signerVerifier); ACTIVE once applied AND >=1 version ENABLED. BLOCKED if setIamPolicy or useToSign is denied.

source type

Identity

source

<principal>

target

<CryptoKey (SigningKey subtype)>

permissions

cloudkms.cryptoKeys.setIamPolicy cloudkms.cryptoKeyVersions.useToSign

conditions

iam_permission key_permission service_state

state logic

POTENTIAL(key_permission) — requires FIRST self-binding roles/cloudkms.signer (or signerVerifier); ACTIVE once applied AND >=1 version ENABLED. BLOCKED if setIamPolicy or useToSign is denied.

Narrative

{principal.name} can grant itself signing on {key.name} via setIamPolicy, then sign as it (potential - requires applying the self-binding).

Raw rule rules/derived/gcp/kms.yaml

id: gcp-kms-selfgrant-to-sign
emits: CanSignAs
description: A key manager that can setIamPolicy can self-grant and then sign.
match:
- - principal: null
  - CanGrantPermission
  - principal: null
where:
- the CanGrantPermission edge derives from cloudkms.cryptoKeys/keyRings.setIamPolicy on ?key
- CryptoKey.purpose == ASYMMETRIC_SIGN (or MAC for macSign)
emit:
  source_type: Identity
  source: <principal>
  target: <CryptoKey (SigningKey subtype)>
  permissions:
  - cloudkms.cryptoKeys.setIamPolicy
  - cloudkms.cryptoKeyVersions.useToSign
  conditions:
  - iam_permission
  - key_permission
  - service_state
  state_logic: "POTENTIAL(key_permission) \u2014 requires FIRST self-binding roles/cloudkms.signer (or\
    \ signerVerifier); ACTIVE once applied AND >=1 version ENABLED. BLOCKED if setIamPolicy or useToSign\
    \ is denied."
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <CanGrantPermission (setIamPolicy) edge_id>
  false_positive_note: Two-step capability -> POTENTIAL until the self-binding is applied. Only on ASYMMETRIC_SIGN
    (or MAC) keys. Do not double-count with gcp-kms-can-sign.
  narrative: "{principal.name} can grant itself signing on {key.name} via setIamPolicy, then sign as it\
    \ (potential \u2014 requires applying the self-binding)."