brief

# Lab: `kms_key_overbroad`

b2b_saas / medium / `secrets-store` · prod

## Your job

A customer data store is encrypted with a KMS key. Who can decrypt with that key, and what does the key unlock?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n22_571e/acct-main`: **Account** prod-account-571e
- `n08_571e/role-reader`: **IAMRole** SecretsReader-571e
- `n09_571e/pol-reader`: **IAMPolicy** SecretsReaderPolicy-571e
- `n10_571e/kms-data`: **KmsKey** customer-data-key-571e
- `n33_571e/s3-encrypted`: **S3Bucket** encrypted-exports-571e
- `n05_571e/s3-locked-backups`: **S3Bucket** public-looking-backups-571e
- `n29_571e/app-secrets-store`: **Application** secrets-store-571e
- `n26_571e/data-secrets`: **DataSet** customer-secrets-571e
- `n27_571e/trail-main`: **LogTrail** main-trail-571e
- `n19_571e/s3-exchange-drop`: **S3Bucket** exchange-dropbox-571e
- `n30_571e/role-migration-helper`: **IAMRole** MigrationHelperRole-571e
- `n12_571e/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-571e
- `n11_571e/role-reporting-read`: **IAMRole** ReportingReadRole-571e
- `n06_571e/pol-reporting-read-read`: **IAMPolicy** ReportingReadPolicy-571e
- `n31_571e/s3-static-site`: **S3Bucket** static-site-assets-571e
- `n14_571e/s3-static-site`: **S3Bucket** static-site-assets-2-571e
- `n20_571e/s3-audit-evidence`: **S3Bucket** audit-evidence-571e
- `n24_571e/trail-audit-evidence`: **LogTrail** trail-audit-evidence-571e
- `n36_571e/data-audit-evidence`: **DataSet** audit-evidence-files-571e
- `n28_571e/s3-billing-exports`: **S3Bucket** billing-exports-archive-571e
- `n18_571e/trail-billing-exports`: **LogTrail** trail-billing-exports-571e
- `n23_571e/data-billing-exports`: **DataSet** billing-statements-571e
- `n00_571e/kms-storage-general`: **KmsKey** kms-storage-general-571e
- `n16_571e/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-571e
- `n17_571e/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-2-571e
- `n07_571e/sqs-metrics-queue`: **SqsQueue** metrics-queue-571e
- `n13_571e/data-reporting-store`: **DataSet** data-reporting-store-571e
- `n37_571e/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-571e
- `n02_571e/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-3-571e
- `n40_571e/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-571e
- `n38_571e/s3-media-cache`: **S3Bucket** media-cache-571e
- `n15_571e/sqs-metrics-queue`: **SqsQueue** metrics-queue-2-571e
- `n34_571e/ecr-collector-agent`: **EcrRepository** repo-collector-agent-571e
- `n32_571e/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-571e
- `n21_571e/s3-assets-archive`: **S3Bucket** assets-archive-571e
- `n01_571e/s3-telemetry-logs`: **S3Bucket** telemetry-logs-571e
- `n35_571e/s3-backup-vault`: **S3Bucket** backup-vault-571e
- `n25_571e/data-operational-metrics`: **DataSet** data-operational-metrics-571e
- `n03_571e/role-metrics-collector`: **IAMRole** MetricsCollectorRole-571e
- `n04_571e/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-2-571e
- `n39_571e/s3-exports-staging`: **S3Bucket** exports-staging-571e

## Relationships

- `n08_571e/role-reader` --attached_policy--> `n09_571e/pol-reader`
- `n08_571e/role-reader` --can_decrypt--> `n10_571e/kms-data`
- `n08_571e/role-reader` --can_read--> `n33_571e/s3-encrypted`
- `n33_571e/s3-encrypted` --encrypted_with--> `n10_571e/kms-data`
- `n33_571e/s3-encrypted` --stores_sensitive_data--> `n26_571e/data-secrets`
- `n33_571e/s3-encrypted` --belongs_to_app--> `n29_571e/app-secrets-store`
- `n05_571e/s3-locked-backups` --belongs_to_app--> `n29_571e/app-secrets-store`
- `n08_571e/role-reader` --can_read--> `n19_571e/s3-exchange-drop`
- `n30_571e/role-migration-helper` --attached_policy--> `n12_571e/pol-migration-helper-read`
- `n11_571e/role-reporting-read` --attached_policy--> `n06_571e/pol-reporting-read-read`
- `n20_571e/s3-audit-evidence` --logs_to--> `n24_571e/trail-audit-evidence`
- `n20_571e/s3-audit-evidence` --stores_sensitive_data--> `n36_571e/data-audit-evidence`
- `n28_571e/s3-billing-exports` --logs_to--> `n18_571e/trail-billing-exports`
- `n28_571e/s3-billing-exports` --stores_sensitive_data--> `n23_571e/data-billing-exports`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub