aws-cloudfront-modify-distribution-config

A principal with cloudfront:UpdateDistribution can change origins, behaviors, WAF association, Lambda@Edge bindings, HTTPS policy, OAC/OAI, and trusted signers - altering the effective network posture and access controls of the distribution.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'distribution': None}

where

node_type(?distribution) == PublicEndpoint ?distribution.provider_type == 'AWS::CloudFront::Distribution' effective_action_on(?principal, ?distribution) contains 'cloudfront:UpdateDistribution'

emit

source type	`Identity`
target type	`PublicEndpoint`
source	`?principal`
target	`?distribution`
permissions	`cloudfront:UpdateDistribution`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective-permission evaluator confirms cloudfront:UpdateDistribution on the distribution ARN (or a wildcard resource covering it). CloudFront does not have resource-based policies on distributions — only IAM identity policies and SCPs/permission-boundaries gate this action. BLOCKED if an SCP or permission boundary explicitly denies cloudfront:UpdateDistribution on the distribution ARN. CRITICAL: CloudFront is a global service whose control plane runs exclusively in us-east-1. An SCP with Condition: StringNotEquals aws:RequestedRegion: us-east-1 blocks ALL CloudFront API calls — this is a common SCP pattern. Evaluate scp_or_org_policy conditions against us-east-1 region; if an SCP denies any CloudFront action with a region condition excluding us-east-1, the capability is BLOCKED.

Narrative

{principal.name} can call cloudfront:UpdateDistribution on distribution {target.name}, modifying its origins, behaviors, HTTPS policy, WAF association, and Lambda@Edge bindings. Key attacks: swap an OAC-protected S3 origin to serve private data publicly; detach WAF (defense evasion); add a Lambda@Edge trigger for code execution; downgrade HTTPS enforcement to expose credentials in transit.

Raw rule rules/derived/aws/cloudfront.yaml

id: aws-cloudfront-modify-distribution-config
emits: CanModifyConfiguration
description: "A principal with cloudfront:UpdateDistribution can change origins, behaviors, WAF association,\
  \ Lambda@Edge bindings, HTTPS policy, OAC/OAI, and trusted signers \u2014 altering the effective network\
  \ posture and access controls of the distribution."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - distribution: null
where:
- node_type(?distribution) == PublicEndpoint
- ?distribution.provider_type == 'AWS::CloudFront::Distribution'
- effective_action_on(?principal, ?distribution) contains 'cloudfront:UpdateDistribution'
emit:
  source_type: Identity
  target_type: PublicEndpoint
  source: ?principal
  target: ?distribution
  permissions:
  - cloudfront:UpdateDistribution
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms cloudfront:UpdateDistribution on the\
    \ distribution ARN (or a wildcard resource covering it). CloudFront does not have resource-based policies\
    \ on distributions \u2014 only IAM identity policies and SCPs/permission-boundaries gate this action.\
    \ BLOCKED if an SCP or permission boundary explicitly denies cloudfront:UpdateDistribution on the\
    \ distribution ARN. CRITICAL: CloudFront is a global service whose control plane runs exclusively\
    \ in us-east-1. An SCP with Condition: StringNotEquals aws:RequestedRegion: us-east-1 blocks ALL CloudFront\
    \ API calls \u2014 this is a common SCP pattern. Evaluate scp_or_org_policy conditions against us-east-1\
    \ region; if an SCP denies any CloudFront action with a region condition excluding us-east-1, the\
    \ capability is BLOCKED."
  confidence: 0.95
  derived_from:
  - ?principal HasPermission ?distribution (cloudfront:UpdateDistribution)
  false_positive_note: "cloudfront:UpdateDistribution requires a two-step read-modify-write cycle: the\
    \ caller must first GET the current ETag (cloudfront:GetDistributionConfig) and include it in the\
    \ update request. Without cloudfront:GetDistributionConfig the update will fail (ETag mismatch). However,\
    \ the primary permission is cloudfront:UpdateDistribution \u2014 emit CanModifyConfiguration on that\
    \ action alone (GetDistributionConfig is a read-only prerequisite that is typically co-granted). Do\
    \ NOT require cloudfront:GetDistributionConfig as a hard prerequisite for ACTIVE state; note it in\
    \ evidence. WAF disassociation (setting webACLId to empty) is modeled in waf.yaml as CanModifyConfiguration\
    \ on the WAF ACL node \u2014 do NOT re-derive it here. Lambda@Edge association via UpdateDistribution\
    \ chains into lambda.yaml (CanTrigger -> CanExecuteAs via messaging-chains) \u2014 CITE, do not re-derive.\
    \ SCPs restricting aws:RequestedRegion to exclude us-east-1 block all CloudFront control-plane actions;\
    \ evaluate region conditions as part of scp_or_org_policy to determine BLOCKED vs. ACTIVE state."
  narrative: '{principal.name} can call cloudfront:UpdateDistribution on distribution {target.name}, modifying
    its origins, behaviors, HTTPS policy, WAF association, and Lambda@Edge bindings. Key attacks: swap
    an OAC-protected S3 origin to serve private data publicly; detach WAF (defense evasion); add a Lambda@Edge
    trigger for code execution; downgrade HTTPS enforcement to expose credentials in transit.'