aws-cloudtrail-deregister-delegated-admin

Principal with cloudtrail:DeregisterOrganizationDelegatedAdmin can remove the delegated admin role from an account, preventing it from managing organization trails and reducing the security team's ability to respond to and restore logging. This is a persistence / evasion amplifier in multi-account environments.

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Organization`
source	`?principal`
target	`?org`
permissions	`cloudtrail:DeregisterOrganizationDelegatedAdmin`
conditions	`iam_permission`
state logic	ACTIVE when the principal (must be in the management account) holds cloudtrail:DeregisterOrganizationDelegatedAdmin. This action is management-account-only; member-account principals cannot call it (API returns AccessDenied). BLOCKED only when an org-level SCP denies the action.

source type

Identity

target type

Organization

source

?principal

target

?org

permissions

cloudtrail:DeregisterOrganizationDelegatedAdmin

conditions

iam_permission

state logic

ACTIVE when the principal (must be in the management account) holds cloudtrail:DeregisterOrganizationDelegatedAdmin. This action is management-account-only; member-account principals cannot call it (API returns AccessDenied). BLOCKED only when an org-level SCP denies the action.

Narrative

{principal.name} can call cloudtrail:DeregisterOrganizationDelegatedAdmin to remove the delegated admin role from an organization, preventing the security team's dedicated account from managing organization trails. This reduces the organization's ability to respond to and restore logging, acting as a persistence and detection-evasion amplifier.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-deregister-delegated-admin
emits: CanModify
description: Principal with cloudtrail:DeregisterOrganizationDelegatedAdmin can remove the delegated admin
  role from an account, preventing it from managing organization trails and reducing the security team's
  ability to respond to and restore logging. This is a persistence / evasion amplifier in multi-account
  environments.
match:
- - principal: null
  - HasPermission
  - org: null
where:
- node_type(?org) == Organization
- effective_action(?principal, ?org) includes 'cloudtrail:DeregisterOrganizationDelegatedAdmin'
emit:
  source_type: Identity
  target_type: Organization
  source: ?principal
  target: ?org
  permissions:
  - cloudtrail:DeregisterOrganizationDelegatedAdmin
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal (must be in the management account) holds cloudtrail:DeregisterOrganizationDelegatedAdmin.
    This action is management-account-only; member-account principals cannot call it (API returns AccessDenied).
    BLOCKED only when an org-level SCP denies the action.
  confidence: 0.92
  derived_from:
  - HasPermission(?principal, cloudtrail:DeregisterOrganizationDelegatedAdmin, ?org)
  false_positive_note: "This is an ORG-LEVEL TAMPERING action, not resource access. Removing the delegated\
    \ admin prevents the security team's dedicated account from managing CloudTrail across the organization.\
    \ This is a persistence/response-impairment primitive \u2014 do NOT chain to resource access edges.\
    \ Only the management account can call this action; member-account access attempts fail with AccessDenied."
  narrative: '{principal.name} can call cloudtrail:DeregisterOrganizationDelegatedAdmin to remove the
    delegated admin role from an organization, preventing the security team''s dedicated account from
    managing organization trails. This reduces the organization''s ability to respond to and restore logging,
    acting as a persistence and detection-evasion amplifier.'