aws-apigw-modify-resource-policy

Modifying a REST API resource policy (apigateway:PATCH/PUT) to grant execute-api:Invoke to external principals or Principal '*'.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Policy`
source	`?principal`
target	`<ResourcePolicy node on the REST API>`
permissions	`apigateway:PUT /restapis/{id}/policy`
conditions	`iam_permission`
state logic	ACTIVE when the principal has apigateway:PUT on the RestAPI policy resource (the /restapis/{id}/policy endpoint). This permission alone is sufficient to modify the policy; downstream consequences (cross-account trust, internet exposure) depend on the modified policy content.

source type

Identity

target type

Policy

source

?principal

target

<ResourcePolicy node on the REST API>

permissions

apigateway:PUT /restapis/{id}/policy

conditions

iam_permission

state logic

ACTIVE when the principal has apigateway:PUT on the RestAPI policy resource (the /restapis/{id}/policy endpoint). This permission alone is sufficient to modify the policy; downstream consequences (cross-account trust, internet exposure) depend on the modified policy content.

Narrative

{principal.name} can modify the resource policy of REST API {api.name} (apigateway:PUT /restapis/{id}/policy), enabling policy-grant escalation (granting cross-account/internet access).

Raw rule rules/derived/aws/apigateway.yaml

id: aws-apigw-modify-resource-policy
emits: CanModifyPolicy
description: Modifying a REST API resource policy (apigateway:PATCH/PUT) to grant execute-api:Invoke to
  external principals or Principal '*'.
match:
- - principal: null
  - CanModifyConfiguration
  - api: null
where:
- node_type(?api) == APIGateway
- ?principal has EFFECTIVE apigateway:PUT on /restapis/{id}/policy (RestAPI resource-policy update endpoint)
emit:
  source_type: Identity
  target_type: Policy
  source: ?principal
  target: <ResourcePolicy node on the REST API>
  permissions:
  - apigateway:PUT /restapis/{id}/policy
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal has apigateway:PUT on the RestAPI policy resource (the /restapis/{id}/policy
    endpoint). This permission alone is sufficient to modify the policy; downstream consequences (cross-account
    trust, internet exposure) depend on the modified policy content.
  derived_from: []
  false_positive_note: "This rule emits the capability to modify the policy, not the consequences. An\
    \ attacker with this permission can grant themselves cross-account execute-api:Invoke access (CanEnterAccount\
    \ via can-control) or open the API to the internet (ExposedToInternet), but those are derived downstream.\
    \ HTTP API (V2) has no resource policy \u2014 do NOT emit for V2."
  narrative: '{principal.name} can modify the resource policy of REST API {api.name} (apigateway:PUT /restapis/{id}/policy),
    enabling policy-grant escalation (granting cross-account/internet access).'