CanCreateKey
Source can create keys (SA key creation overlaps CanCreateCredentialFor).
Identity
── CanCreateKey ──▸
EncryptionKey, ServiceAccount
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Rules that emit CanCreateKey 1
A principal whose effective permissions include key or service-account-key creation can mint new keys.
derived