aws-cloudtrail-stop-logging

Principal with cloudtrail:StopLogging can pause event recording on a trail, suppressing the audit record of all subsequent API activity until logging is resumed - a defense-evasion / cover-tracks primitive.

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'trail': None}

where

node_type(?trail) == LoggingService ?trail.provider_type == 'AWS::CloudTrail::Trail' effective_action(?principal, ?trail) includes 'cloudtrail:StopLogging'

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?trail`
permissions	`cloudtrail:StopLogging`
conditions	`iam_permission` `scp_or_org_policy` `region_or_boundary`
state logic	ACTIVE when the principal holds cloudtrail:StopLogging with no effective deny (SCP or permission boundary) on the trail ARN scope AND the caller is in the same region as the trail's HomeRegion (for org trails) or any region (for regional trails); BLOCKED when an SCP or permission boundary explicitly denies cloudtrail:StopLogging or cloudtrail:*. Organization trails (IsOrganizationTrail=true) are only manageable from the management account in the trail's home region — if the principal is in a member account or different region, set state BLOCKED (API returns AccessDenied). Regional trails can be stopped from any region by the management account (or any account-local principal with the permission).

Narrative

{principal.name} can call cloudtrail:StopLogging on {trail.name}, pausing event recording for this trail. While stopped, all API calls in the trail's scope go unrecorded, allowing subsequent attacker activity to avoid the CloudTrail audit log. This is a cover-tracks primitive and does not grant resource access.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-stop-logging
emits: CanModify
description: "Principal with cloudtrail:StopLogging can pause event recording on a trail, suppressing\
  \ the audit record of all subsequent API activity until logging is resumed \u2014 a defense-evasion\
  \ / cover-tracks primitive."
match:
- - principal: null
  - HasPermission
  - trail: null
where:
- node_type(?trail) == LoggingService
- ?trail.provider_type == 'AWS::CloudTrail::Trail'
- effective_action(?principal, ?trail) includes 'cloudtrail:StopLogging'
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?trail
  permissions:
  - cloudtrail:StopLogging
  conditions:
  - iam_permission
  - scp_or_org_policy
  - region_or_boundary
  state_logic: "ACTIVE when the principal holds cloudtrail:StopLogging with no effective deny (SCP or\
    \ permission boundary) on the trail ARN scope AND the caller is in the same region as the trail's\
    \ HomeRegion (for org trails) or any region (for regional trails); BLOCKED when an SCP or permission\
    \ boundary explicitly denies cloudtrail:StopLogging or cloudtrail:*. Organization trails (IsOrganizationTrail=true)\
    \ are only manageable from the management account in the trail's home region \u2014 if the principal\
    \ is in a member account or different region, set state BLOCKED (API returns AccessDenied). Regional\
    \ trails can be stopped from any region by the management account (or any account-local principal\
    \ with the permission)."
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, cloudtrail:StopLogging, ?trail)
  false_positive_note: "This is DEFENSE EVASION only \u2014 stopping a trail suppresses detection but\
    \ does NOT grant access to any resource or identity. Do NOT chain this edge to CanExecuteAs, CanEscalateTo,\
    \ or CanEnterAccount. Organization trails are manageable only from the management account's home region;\
    \ a member-account principal cannot stop an org trail even with cloudtrail:StopLogging \u2014 emit\
    \ BLOCKED or suppress for member-account callers. Check for SCPs implementing detective-control guardrails\
    \ (common pattern: deny cloudtrail:StopLogging on all accounts except the security tooling account)\
    \ \u2014 these produce a BLOCKED edge. Note: CanModify (resource_control/CONTROL) correctly describes\
    \ the operational tamper capability without EXECUTION category semantics."
  narrative: '{principal.name} can call cloudtrail:StopLogging on {trail.name}, pausing event recording
    for this trail. While stopped, all API calls in the trail''s scope go unrecorded, allowing subsequent
    attacker activity to avoid the CloudTrail audit log. This is a cover-tracks primitive and does not
    grant resource access.'