aws-cloudtrail-disable-lake-ingestion

Principal with cloudtrail:UpdateEventDataStore can disable ingestion (IngestionEnabled: false) on a CloudTrail Lake event data store, halting new audit-event collection while the store remains accessible - a reversible detection-suppression primitive.

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?datastore`
permissions	`cloudtrail:UpdateEventDataStore`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the principal holds cloudtrail:UpdateEventDataStore with no effective deny AND the IAM policy permits IngestionEnabled parameter changes (detected via policy analysis or analyst annotation). BLOCKED on SCP/boundary deny or policy conditions that restrict this capability.

source type

Identity

target type

LoggingService

source

?principal

target

?datastore

permissions

cloudtrail:UpdateEventDataStore

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when the principal holds cloudtrail:UpdateEventDataStore with no effective deny AND the IAM policy permits IngestionEnabled parameter changes (detected via policy analysis or analyst annotation). BLOCKED on SCP/boundary deny or policy conditions that restrict this capability.

Narrative

{principal.name} can call cloudtrail:UpdateEventDataStore on {datastore.name} to disable ingestion (IngestionEnabled: false), halting new audit-event collection. Stored events remain accessible, but future API activity goes unrecorded - a reversible detection-suppression primitive.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-disable-lake-ingestion
emits: CanModify
description: "Principal with cloudtrail:UpdateEventDataStore can disable ingestion (IngestionEnabled:\
  \ false) on a CloudTrail Lake event data store, halting new audit-event collection while the store remains\
  \ accessible \u2014 a reversible detection-suppression primitive."
match:
- - principal: null
  - HasPermission
  - datastore: null
where:
- node_type(?datastore) == LoggingService
- ?datastore.provider_type == 'AWS::CloudTrail::EventDataStore'
- effective_action(?principal, ?datastore) includes 'cloudtrail:UpdateEventDataStore'
- policy_allows_parameter_modification(?principal, 'IngestionEnabled')
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?datastore
  permissions:
  - cloudtrail:UpdateEventDataStore
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the principal holds cloudtrail:UpdateEventDataStore with no effective deny
    AND the IAM policy permits IngestionEnabled parameter changes (detected via policy analysis or analyst
    annotation). BLOCKED on SCP/boundary deny or policy conditions that restrict this capability.
  confidence: 0.88
  derived_from:
  - HasPermission(?principal, cloudtrail:UpdateEventDataStore, ?datastore)
  false_positive_note: DEFENSE EVASION ONLY. Disabling ingestion is reversible (StartIngestion re-enables
    it) and stops new event collection without deleting stored events. cloudtrail:UpdateEventDataStore
    can also change benign parameters (retention period, tags). Only emit this edge when the effective
    policy permits IngestionEnabled modification. Do NOT chain to escalation edges.
  narrative: "{principal.name} can call cloudtrail:UpdateEventDataStore on {datastore.name} to disable\
    \ ingestion (IngestionEnabled: false), halting new audit-event collection. Stored events remain accessible,\
    \ but future API activity goes unrecorded \u2014 a reversible detection-suppression primitive."