aws-cloudtrail-delete-event-data-store

Principal with cloudtrail:DeleteEventDataStore can permanently destroy a CloudTrail Lake event data store, eliminating the long-term audit retention store for the organization. This is a high-impact anti-forensic primitive.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?datastore`
permissions	`cloudtrail:DeleteEventDataStore`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the principal holds cloudtrail:DeleteEventDataStore with no effective deny on the data store ARN. BLOCKED when an SCP or permission boundary denies cloudtrail:DeleteEventDataStore or cloudtrail:*. Organization data stores are managed at org level; member-account principals cannot delete org data stores — emit BLOCKED for member-account access attempts.

source type

Identity

target type

LoggingService

source

?principal

target

?datastore

permissions

cloudtrail:DeleteEventDataStore

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when the principal holds cloudtrail:DeleteEventDataStore with no effective deny on the data store ARN. BLOCKED when an SCP or permission boundary denies cloudtrail:DeleteEventDataStore or cloudtrail:*. Organization data stores are managed at org level; member-account principals cannot delete org data stores — emit BLOCKED for member-account access attempts.

Narrative

{principal.name} can permanently delete {datastore.name} (cloudtrail:DeleteEventDataStore), destroying the CloudTrail Lake event data store and eliminating long-term audit retention. This is a high-impact anti-forensic primitive with no accompanying resource access gain.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-delete-event-data-store
emits: CanDelete
description: Principal with cloudtrail:DeleteEventDataStore can permanently destroy a CloudTrail Lake
  event data store, eliminating the long-term audit retention store for the organization. This is a high-impact
  anti-forensic primitive.
match:
- - principal: null
  - HasPermission
  - datastore: null
where:
- node_type(?datastore) == LoggingService
- ?datastore.provider_type == 'AWS::CloudTrail::EventDataStore'
- effective_action(?principal, ?datastore) includes 'cloudtrail:DeleteEventDataStore'
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?datastore
  permissions:
  - cloudtrail:DeleteEventDataStore
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when the principal holds cloudtrail:DeleteEventDataStore with no effective deny\
    \ on the data store ARN. BLOCKED when an SCP or permission boundary denies cloudtrail:DeleteEventDataStore\
    \ or cloudtrail:*. Organization data stores are managed at org level; member-account principals cannot\
    \ delete org data stores \u2014 emit BLOCKED for member-account access attempts."
  confidence: 0.97
  derived_from:
  - HasPermission(?principal, cloudtrail:DeleteEventDataStore, ?datastore)
  false_positive_note: "DEFENSE EVASION ONLY. Deleting a Lake event data store is permanent and destroys\
    \ long-term audit retention (typically the organization's sole persistent audit store). However, it\
    \ does not grant access to other resources. Do NOT emit CanEnterAccount or escalation edges. SCP deny\
    \ on cloudtrail:DeleteEventDataStore is a strong security baseline. An org-scoped data store deletion\
    \ requires management account privileges \u2014 emit BLOCKED for member-account callers."
  narrative: '{principal.name} can permanently delete {datastore.name} (cloudtrail:DeleteEventDataStore),
    destroying the CloudTrail Lake event data store and eliminating long-term audit retention. This is
    a high-impact anti-forensic primitive with no accompanying resource access gain.'