EncryptionKey

Holding a CloudHSM Crypto User credential (with VPC reach) lets a principal decrypt with the HSM key.

A CU with wrap rights can wrap an EXTRACTABLE key out of the HSM for offline use.

An external principal permitted by the key policy/grant can use the key cross-account.

GenerateDataKey* returns a usable plaintext data key -> envelope decryption of ciphertext under the key.

Admin of a key (PutKeyPolicy/CreateGrant) can self-grant kms:Decrypt then use it.

ReEncryptFrom proves KMS can decrypt the source ciphertext; with an attacker-decryptable destination key, data is recoverable.

Keys with imported material (Origin: EXTERNAL) may be controllable offline by the importer.

A principal with CanModifyConfiguration(DES) can upgrade a CONDITIONAL(key_permission) CanReadData edge to ACTIVE by pointing the DES at an attacker-controlled Key Vault key and triggering VM lifecycle (re-encrypt under attacker key on next attach/detach).

diskEncryptionSets/write allows changing the Key Vault key reference in a DES, enabling attacker-controlled key wrapping for re-encryption at next attachment.

Key Vault Administrator can decrypt/unwrap with every key in the vault.

A vault self-grant equally yields decrypt/unwrap on every key in the vault.

A Managed HSM local Crypto User role can decrypt/unwrap with an HSM key.

Possession of the security domain + quorum keys can clone all HSM keys to a new pool.

A principal whose effective permissions include key or service-account-key creation can mint new keys.

Holding decrypt on a secret's wrapping key upgrades a key-gated (CONDITIONAL) secret read to ACTIVE.

cloudkms.cryptoKeyVersions.useToDecapsulate lets a principal decapsulate a shared secret with a KEM key.

cloudkms.cryptoKeyVersions.useToDecrypt lets a principal decrypt with the key.

A principal that can execute as a workload SA holding useToDecrypt can decrypt.

A key manager that can setIamPolicy can self-grant and then decrypt.