CanDecrypt
Source can use a key to decrypt data/secrets (gates CanReadData on encrypted stores).
Identity, Compute
── CanDecrypt ──▸
EncryptionKey
Source types
IdentityComputeTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
kms:Decrypt
|
|
| gcp |
cloudkms.cryptoKeyVersions.useToDecrypt
|
|
| azure |
Key Vault key decrypt/unwrapKey
|
Rules that emit CanDecrypt 15
Holding a CloudHSM Crypto User credential (with VPC reach) lets a principal decrypt with the HSM key.
awsderived
GenerateDataKey* returns a usable plaintext data key -> envelope decryption of ciphertext under the key.
awsderived
ReEncryptFrom proves KMS can decrypt the source ciphertext; with an attacker-decryptable destination key, data is recoverable.
awsderived
Admin of a key (PutKeyPolicy/CreateGrant) can self-grant kms:Decrypt then use it.
awsderived
An external principal permitted by the key policy/grant can use the key cross-account.
awsderived
Key Vault Administrator can decrypt/unwrap with every key in the vault.
azurederived
A vault self-grant equally yields decrypt/unwrap on every key in the vault.
azurederived
A Managed HSM local Crypto User role can decrypt/unwrap with an HSM key.
azurederived
cloudkms.cryptoKeyVersions.useToDecrypt lets a principal decrypt with the key.
gcpderived
cloudkms.cryptoKeyVersions.useToDecapsulate lets a principal decapsulate a shared secret with a KEM key.
gcpderived
A key manager that can setIamPolicy can self-grant and then decrypt.
gcpderived
A principal that can execute as a workload SA holding useToDecrypt can decrypt.
gcpderived
awsexplicit
azureexplicit
gcpexplicit