aws-cloudtrail-update-trail-benign

id: aws-cloudtrail-update-trail-benign
emits: null
description: "Principal with cloudtrail:UpdateTrail but no PutEventSelectors can update trail metadata\
  \ (description, tags) without impactful defense-evasion capability. This rule is a SUPPRESS-IF-ONLY-UPDATETRAIL\
  \ gate \u2014 do not emit an edge when UpdateTrail is the only action AND the effective policy scope\
  \ does not include S3 bucket redirection or IncludeManagementEvents disable."
match:
- - principal: null
  - HasPermission
  - trail: null
where:
- node_type(?trail) == LoggingService
- ?trail.provider_type == 'AWS::CloudTrail::Trail'
- effective_action(?principal, ?trail) includes 'cloudtrail:UpdateTrail'
- NOT effective_action(?principal, ?trail) includes 'cloudtrail:PutEventSelectors'
emit: null
state_logic: NULL (no edge emitted). This gate suppresses UpdateTrail-only edges when the effective policy
  cannot reach impactful parameters. If UpdateTrail is granted alongside PutEventSelectors, the combined
  rule aws-cloudtrail-narrow-selectors fires instead. Analysts should manually review UpdateTrail-only
  grants with broad resource scopes or condition keys that allow S3BucketName / IsMultiRegionTrail changes.
confidence: 0
derived_from: []
false_positive_note: This is a SUPPRESS rule, not an emit rule. UpdateTrail has many benign uses (tag
  changes, description updates). Emitting CanModify for every UpdateTrail grant risks false positives.
  If analysts see UpdateTrail in an effective policy, they should manually check whether the policy constrains
  it to safe parameters. If S3BucketName or EnableLogFileValidation=false are reachable, a threat analyst
  should flag for manual edge creation with state ACTIVE.
narrative: null