aws-cloudwatch-delete-log-group
logs:DeleteLogGroup permanently deletes a log group and all its stored events - evidence destruction that eliminates forensic audit records.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?log_group) ==
LoggingService
?log_group.provider_type == 'AWS::Logs::LogGroup'
?principal has EFFECTIVE logs:DeleteLogGroup on ?log_group ARN
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | ?principal |
| target | ?log_group |
| permissions | logs:DeleteLogGroup |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE when logs:DeleteLogGroup is confirmed EFFECTIVE on the log group ARN (identity-based policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict deletion. BLOCKED by an explicit deny on logs:DeleteLogGroup. CanDelete is not traversable by default (walkable: false per schema/edges.yaml). Emitted for impact / evidence-destruction assessment. NOT escalation. |
Narrative
{principal.name} can delete {log_group.name} (logs:DeleteLogGroup), permanently removing the log group and all stored log events. This destroys forensic evidence of all activity previously logged to this group and eliminates the associated metric filters and subscription filter - a complete cover-tracks primitive. It does not grant access to any resource.
Raw rule rules/derived/aws/cloudwatch.yaml
id: aws-cloudwatch-delete-log-group
emits: CanDelete
description: "logs:DeleteLogGroup permanently deletes a log group and all its stored events \u2014 evidence\
\ destruction that eliminates forensic audit records."
match:
- - principal: null
- HasPermission
- log_group: null
where:
- node_type(?log_group) == LoggingService
- ?log_group.provider_type == 'AWS::Logs::LogGroup'
- ?principal has EFFECTIVE logs:DeleteLogGroup on ?log_group ARN
emit:
source_type: Identity
target_type: LoggingService
source: ?principal
target: ?log_group
permissions:
- logs:DeleteLogGroup
conditions:
- iam_permission
- scp_or_org_policy
state_logic: 'ACTIVE when logs:DeleteLogGroup is confirmed EFFECTIVE on the log group ARN (identity-based
policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict
deletion. BLOCKED by an explicit deny on logs:DeleteLogGroup. CanDelete is not traversable by default
(walkable: false per schema/edges.yaml). Emitted for impact / evidence-destruction assessment. NOT
escalation.'
confidence: min(contributing_confidences)
derived_from:
- ?principal HasPermission ?log_group (logs:DeleteLogGroup effective permission)
false_positive_note: "logs:DeleteLogGroup requires the permission on the specific log group ARN (or\
\ wildcard). Many CloudWatch log groups are named after the service that created them (e.g., /aws/lambda/<function-name>,\
\ /aws/ecs/<cluster>/<service>) \u2014 confirm the log group ARN matches the permission scope. Retention-locked\
\ log groups (RetentionInDays with a compliance hold) may be resistant to deletion via service-level\
\ protection; downgrade to CONDITIONAL(service_state) if a retention lock is confirmed. Note: logs:DeleteLogStream\
\ is a narrower action (deletes one stream within a group); the group and its other streams survive.\
\ Do NOT emit CanExecuteAs or CanEnterAccount as consequences. CanDelete is excluded from default\
\ path-finding (walkable: false)."
narrative: "{principal.name} can delete {log_group.name} (logs:DeleteLogGroup), permanently removing\
\ the log group and all stored log events. This destroys forensic evidence of all activity previously\
\ logged to this group and eliminates the associated metric filters and subscription filter \u2014\
\ a complete cover-tracks primitive. It does not grant access to any resource."