Restrict the decrypt, sign, and MAC-generation operations to authorised principals only, applying the principle of least privilege to protect sensitive data and the integrity of signed content.
Limit Cryptographic Operation Grants
CCC.KeyMgmt.CN02 · Access Control
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP10 | Decrypt Data | The service can decrypt ciphertext submitted by a user with a managed key and return the plaintext without exposing the key material. |
| CCC.KeyMgmt.CP17 | Enable Key | The service can re-enable a disabled managed key or key version so that cryptographic operations with it resume. |
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
| CCC.KeyMgmt.CP11 | Create Digital Signature | The service can generate a digital signature over data or a digest submitted by a user with a managed asymmetric key. |
| CCC.KeyMgmt.CP12 | Verify Digital Signature | The service can verify a digital signature over data or a digest submitted by a user with the public half of a managed asymmetric key. |
| CCC.KeyMgmt.CP26 | Message Authentication Code Generation and Verification | The service can generate and verify hash-based message authentication codes (HMAC) over data submitted by a user with a managed symmetric key, so that the MAC key never leaves the service. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH02 | A KMS Key is Used to Decrypt Data Without Restriction | Misconfigured permissions that allow broad invocation of the Decrypt API can expose plaintext data, enabling unintended disclosure or exfiltration of sensitive information. |
| CCC.KeyMgmt.TH07 | Signing or MAC Key is Used to Authenticate Unauthorized Content | Permission to invoke sign or MAC operations may be granted more broadly than intended, or a signing key may be reachable from a compromised workload. Signatures or authentication codes are then produced over content the key owner did not approve, and verifiers accept that content as genuine. Integrity of the code, tokens, or messages that trust the key is compromised, and the key owner cannot distinguish forged artifacts from legitimate ones. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.KeyMgmt.CN02.AR01 | When a key policy or role grants the decrypt operation, the grant MUST name specific principals rather than a wildcard. | tlp-green, tlp-amber, tlp-red |
| CCC.KeyMgmt.CN02.AR02 | When a key policy or role grants the sign or MAC-generation operation, the grant MUST name specific principals rather than a wildcard. | tlp-green, tlp-amber, tlp-red |