aws-accessanalyzer-delete-analyzer

Delete an Access Analyzer, removing all findings and disabling ongoing IAM access analysis for the zone of trust - a hard delete of a detective control that reduces detection fidelity without granting access (non-walkable edge).

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'analyzer': None}

where

node_class(?analyzer) == ManagementService node_type(?analyzer) == SecurityService ?analyzer.origin_service == aws:accessanalyzer ?principal has EFFECTIVE access-analyzer:DeleteAnalyzer on ?analyzer ARN scope

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?analyzer`
permissions	`access-analyzer:DeleteAnalyzer`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds effective access-analyzer:DeleteAnalyzer on the analyzer ARN scope; BLOCKED when an SCP, permission boundary, or AWS Organizations guardrail explicitly denies the action at the effective scope (e.g. an SCP in the management account preventing member accounts from deleting org-level analyzers).

Narrative

{principal.name} can call access-analyzer:DeleteAnalyzer on {analyzer.name}, removing all current findings and disabling ongoing IAM access analysis for the zone of trust ({analyzer.zone_of_trust}). Subsequent external-access grants on resources in this account will not be flagged, reducing detection fidelity. This is a cover-tracks primitive; it does not grant any additional access.

Raw rule rules/derived/aws/accessanalyzer.yaml

id: aws-accessanalyzer-delete-analyzer
emits: CanDelete
description: "Delete an Access Analyzer, removing all findings and disabling ongoing IAM access analysis\
  \ for the zone of trust \u2014 a hard delete of a detective control that reduces detection fidelity\
  \ without granting access (non-walkable edge)."
match:
- - principal: null
  - HasPermission
  - analyzer: null
where:
- node_class(?analyzer) == ManagementService
- node_type(?analyzer) == SecurityService
- ?analyzer.origin_service == aws:accessanalyzer
- ?principal has EFFECTIVE access-analyzer:DeleteAnalyzer on ?analyzer ARN scope
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?analyzer
  permissions:
  - access-analyzer:DeleteAnalyzer
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal holds effective access-analyzer:DeleteAnalyzer on the analyzer
    ARN scope; BLOCKED when an SCP, permission boundary, or AWS Organizations guardrail explicitly denies
    the action at the effective scope (e.g. an SCP in the management account preventing member accounts
    from deleting org-level analyzers).
  confidence: 0.95
  derived_from:
  - ?principal HasPermission access-analyzer:DeleteAnalyzer on ?analyzer
  false_positive_note: "This is a DEFENSE EVASION / TAMPERING edge, classified as CanDelete (destructive,\
    \ non-walkable). Deleting an analyzer removes detective-control visibility \u2014 it does NOT grant\
    \ IAM permissions, does NOT expose credentials, and does NOT block or bypass any preventive guardrail\
    \ (SCP, permission boundary, resource policy). Do NOT emit CanExecuteAs, CanEnterAccount, or CanEscalateTo\
    \ as a consequence of this edge. Do NOT set BLOCKED state on other edges because an analyzer was deleted;\
    \ detective controls only reduce detection confidence, they do not prevent access. An org-scoped analyzer\
    \ (zone_of_trust: ORGANIZATION) deletion disables monitoring across all member accounts \u2014 this\
    \ expands the evasion blast radius and should be noted in the narrative, but still does NOT yield\
    \ CanEnterOrganization. Separately, access-analyzer:CreateArchiveRule / UpdateFindings (finding archival)\
    \ are lower-severity evasion variants that silence findings without deleting the analyzer; those actions\
    \ would also produce CanModifyConfiguration at reduced confidence (0.7) \u2014 not modeled here to\
    \ keep rules minimal for this low-relevance service."
  narrative: '{principal.name} can call access-analyzer:DeleteAnalyzer on {analyzer.name}, removing all
    current findings and disabling ongoing IAM access analysis for the zone of trust ({analyzer.zone_of_trust}).
    Subsequent external-access grants on resources in this account will not be flagged, reducing detection
    fidelity. This is a cover-tracks primitive; it does not grant any additional access.'