aws-backup-vault-lock-persistence

id: aws-backup-vault-lock-persistence
emits: CanModifyConfiguration
description: "backup:PutBackupVaultLockConfiguration allows locking a backup vault in compliance mode,\
  \ preventing deletion of recovery points and vault access policy changes for a configured retention\
  \ period \u2014 a persistence/ransomware primitive."
match:
- - principal: null
  - HasPermission
  - vault: null
where:
- node_type(?vault) == Backup
- ?vault.provider_type == 'AWS::Backup::BackupVault'
- ?principal has EFFECTIVE backup:PutBackupVaultLockConfiguration on ?vault ARN
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: <Backup Vault lock configuration node>
  permissions:
  - backup:PutBackupVaultLockConfiguration
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'POTENTIAL when backup:PutBackupVaultLockConfiguration is confirmed EFFECTIVE on ?vault.
    The lock is POTENTIAL until it is written and the cool-off period elapses (typically 0 days for immediate
    lock, or 3 days for compliance mode by default). Once active, the vault becomes BLOCKED for deletion/policy-change
    operations for the configured MinRetentionDays retention window. CONDITIONAL(scp_or_org_policy) when
    an SCP may restrict backup:PutBackupVaultLockConfiguration. BLOCKED when: an SCP or vault policy explicitly
    denies backup:PutBackupVaultLockConfiguration for the principal; OR the vault is a Logically Air-Gapped
    (LAG) vault (no lock modification possible by design).'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?principal HasPermission ?vault (backup:PutBackupVaultLockConfiguration effective permission)
  false_positive_note: "PutBackupVaultLockConfiguration is a control-plane permission that enables vault\
    \ lock configuration. Once applied and the cool-off period passes, the lock becomes ACTIVE and prevents\
    \ backup:DeleteBackupVaultAccessPolicy and backup:DeleteRecoveryPoint. This is a powerful ransomware/persistence\
    \ primitive \u2014 the attacker locks the vault to prevent the defender from reverting policy changes\
    \ or deleting backups during the retention window. LAG vaults do not support lock configuration by\
    \ design."
  narrative: "{principal.name} can lock backup vault {vault.name} in compliance mode (backup:PutBackupVaultLockConfiguration),\
    \ preventing deletion of recovery points and vault access policy changes for a configured retention\
    \ period (days or years). This is an attacker-initiated persistence mechanism \u2014 once locked,\
    \ recovery point and policy deletion are blocked until the retention period expires."