aws-cloudwatch-delete-alarm

cloudwatch:DeleteAlarms permanently removes one or more CloudWatch alarms, eliminating the detective control entirely - a higher-impact, more-detectable evasion than DisableAlarmActions.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?alarm`
permissions	`cloudwatch:DeleteAlarms`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when cloudwatch:DeleteAlarms is confirmed EFFECTIVE on the alarm ARN (identity-based policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on cloudwatch:DeleteAlarms. CanDelete is not traversable in default path-finding (walkable: false per schema/edges.yaml). Emitted for impact assessment — defense evasion, evidence destruction. NOT escalation.

source type

Identity

target type

LoggingService

source

?principal

target

?alarm

permissions

cloudwatch:DeleteAlarms

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when cloudwatch:DeleteAlarms is confirmed EFFECTIVE on the alarm ARN (identity-based policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on cloudwatch:DeleteAlarms. CanDelete is not traversable in default path-finding (walkable: false per schema/edges.yaml). Emitted for impact assessment — defense evasion, evidence destruction. NOT escalation.

Narrative

{principal.name} can delete {alarm.name} (cloudwatch:DeleteAlarms), permanently removing the CloudWatch alarm and its associated actions. This eliminates the detective control entirely - harder to recover from than DisableAlarmActions, but more detectable in CloudTrail. This is an evidence-destruction / defense-evasion primitive - it does not grant access to any resource.

Raw rule rules/derived/aws/cloudwatch.yaml

id: aws-cloudwatch-delete-alarm
emits: CanDelete
description: "cloudwatch:DeleteAlarms permanently removes one or more CloudWatch alarms, eliminating the\
  \ detective control entirely \u2014 a higher-impact, more-detectable evasion than DisableAlarmActions."
match:
- - principal: null
  - HasPermission
  - alarm: null
where:
- node_type(?alarm) == LoggingService
- ?alarm.provider_type == 'AWS::CloudWatch::Alarm'
- ?principal has EFFECTIVE cloudwatch:DeleteAlarms on ?alarm ARN
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?alarm
  permissions:
  - cloudwatch:DeleteAlarms
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when cloudwatch:DeleteAlarms is confirmed EFFECTIVE on the alarm ARN (identity-based\
    \ policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict\
    \ the action. BLOCKED by an explicit deny on cloudwatch:DeleteAlarms. CanDelete is not traversable\
    \ in default path-finding (walkable: false per schema/edges.yaml). Emitted for impact assessment \u2014\
    \ defense evasion, evidence destruction. NOT escalation."
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal HasPermission ?alarm (cloudwatch:DeleteAlarms effective permission)
  false_positive_note: "cloudwatch:DeleteAlarms is destructive and logged in CloudTrail; it is more detectable\
    \ than DisableAlarmActions (rule 1). Both rules may fire for the same principal \u2014 they model\
    \ distinct capabilities. Do NOT emit CanExecuteAs or CanEnterAccount as consequences of alarm deletion.\
    \ CanDelete edges are excluded from default path-finding by the schema (walkable: false); they surface\
    \ only in impact-assessment and evidence-destruction queries."
  narrative: "{principal.name} can delete {alarm.name} (cloudwatch:DeleteAlarms), permanently removing\
    \ the CloudWatch alarm and its associated actions. This eliminates the detective control entirely\
    \ \u2014 harder to recover from than DisableAlarmActions, but more detectable in CloudTrail. This\
    \ is an evidence-destruction / defense-evasion primitive \u2014 it does not grant access to any resource."