CanCreateCredentialFor
Source can mint a NEW long-lived/short-lived credential for the target and thus authenticate as it.
Identity
── CanCreateCredentialFor ──▸
Identity, ApplicationIdentity, ServiceAccount, MachineIdentity
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:CreateAccessKey iam:CreateLoginProfile iam:UpdateLoginProfile
|
|
| gcp |
iam.serviceAccountKeys.create
|
|
| azure |
add password/cert to app or SP (Application.ReadWrite / MS Graph)
|
Rules that emit CanCreateCredentialFor 11
A Crypto Officer credential can create a new CU or reset a CU password.
awsderived
awsderived
awsderived
awsderived
azurederived
azurederived
A service principal holding Application.ReadWrite.All (or Directory.ReadWrite.All) can add a password or certificate credential to any app registration or service principal in the tenant and then authenticate as that identity, inheriting all its permissions - the identity-plane equivalent of sts:AssumeRole.
azurederived
storage.hmacKeys.create generates a long-lived HMAC key (ID + secret) for a Service Account; the secret grants S3-compatible access to all GCS buckets the SA can reach but is scoped to the GCS API only, not full SA impersonation.
gcpderived
gcpderived
awsexplicit
azureexplicit