aws-ca-delete-domain-policy

Deleting the CodeArtifact domain resource policy removes all access controls and opens the publish surface to all principals with domain access - CanModifyPolicy via deletion.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<domain ResourcePolicy node of ?domain>`
permissions	`codeartifact:DeleteDomainPermissionsPolicy`
conditions	`iam_permission`
state logic	ACTIVE when the principal has effective codeartifact:DeleteDomainPermissionsPolicy on the domain. Deletion removes the policy entirely, opening all repositories in the domain to any principal that can authenticate to the CodeArtifact domain service. BLOCKED when an SCP or permission boundary explicitly denies the action.

source type

Identity

target type

ResourcePolicy

source

?principal

target

<domain ResourcePolicy node of ?domain>

permissions

codeartifact:DeleteDomainPermissionsPolicy

conditions

iam_permission

state logic

ACTIVE when the principal has effective codeartifact:DeleteDomainPermissionsPolicy on the domain. Deletion removes the policy entirely, opening all repositories in the domain to any principal that can authenticate to the CodeArtifact domain service. BLOCKED when an SCP or permission boundary explicitly denies the action.

Narrative

{principal.name} can delete the domain-level resource policy of {domain.name} (codeartifact:DeleteDomainPermissionsPolicy). Deletion removes all policy-based access controls, opening publish access to all authenticated principals and creating an immediate supply-chain write path.

Raw rule rules/derived/aws/codeartifact.yaml

id: aws-ca-delete-domain-policy
emits: CanModifyPolicy
description: "Deleting the CodeArtifact domain resource policy removes all access controls and opens the\
  \ publish surface to all principals with domain access \u2014 CanModifyPolicy via deletion."
match:
- - principal: null
  - HasPermission
  - domain: null
where:
- node_type(?domain) == ArtifactRepository
- provider_type(?domain) == AWS::CodeArtifact::Domain
- effective permission includes codeartifact:DeleteDomainPermissionsPolicy on ?domain
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <domain ResourcePolicy node of ?domain>
  permissions:
  - codeartifact:DeleteDomainPermissionsPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal has effective codeartifact:DeleteDomainPermissionsPolicy on the
    domain. Deletion removes the policy entirely, opening all repositories in the domain to any principal
    that can authenticate to the CodeArtifact domain service. BLOCKED when an SCP or permission boundary
    explicitly denies the action.
  confidence: 0.95
  derived_from:
  - effective codeartifact:DeleteDomainPermissionsPolicy on ?domain (permission evaluator)
  false_positive_note: Deletion is irreversible without a backup/snapshot of the previous policy; many
    organizations use auto-recovery / Config rules to restore it. However, the immediate impact (removing
    the policy) is real and enables temporary access. Do not emit for cross-account principals whose only
    grant is via the domain resource policy (deletion cannot be granted cross-account via policy).
  narrative: '{principal.name} can delete the domain-level resource policy of {domain.name} (codeartifact:DeleteDomainPermissionsPolicy).
    Deletion removes all policy-based access controls, opening publish access to all authenticated principals
    and creating an immediate supply-chain write path.'