CanExportKey
Source can export raw key material (rare; high impact - persistent offline decrypt/sign).
Identity
── CanExportKey ──▸
EncryptionKey, SigningKey, Certificate
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Rules that emit CanExportKey 6
A CU with wrap rights can wrap an EXTRACTABLE key out of the HSM for offline use.
awsderived
Keys with imported material (Origin: EXTERNAL) may be controllable offline by the importer.
awsderived
A holder of keys/release/action (Crypto User or Crypto Service Release User) can export an exportable HSM key via Secure Key Release.
azurederived
Possession of the security domain + quorum keys can clone all HSM keys to a new pool.
azurederived
awsexplicit
azureexplicit