aws-cloudwatch-disable-alarm-actions

cloudwatch:DisableAlarmActions silences alarm response automation (SNS/Lambda/SSM actions) without deleting the alarm - a stealthy detection-evasion primitive.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?alarm`
permissions	`cloudwatch:DisableAlarmActions`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when cloudwatch:DisableAlarmActions is confirmed EFFECTIVE on the alarm ARN (identity-based policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on cloudwatch:DisableAlarmActions. This edge is a defense-evasion primitive: it does NOT grant access to any compute, data, or identity resource. It reduces detection capability only.

source type

Identity

target type

LoggingService

source

?principal

target

?alarm

permissions

cloudwatch:DisableAlarmActions

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when cloudwatch:DisableAlarmActions is confirmed EFFECTIVE on the alarm ARN (identity-based policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict the action. BLOCKED by an explicit deny on cloudwatch:DisableAlarmActions. This edge is a defense-evasion primitive: it does NOT grant access to any compute, data, or identity resource. It reduces detection capability only.

Narrative

{principal.name} can disable alarm actions on {alarm.name} (cloudwatch:DisableAlarmActions), silencing the automated incident response (SNS notifications, Lambda invocations, or SSM Automation) that the alarm would normally trigger. The alarm continues to evaluate the underlying metric but fires no response. This reduces detection coverage - it does not grant access to any resource.

Raw rule rules/derived/aws/cloudwatch.yaml

id: aws-cloudwatch-disable-alarm-actions
emits: CanModifyConfiguration
description: "cloudwatch:DisableAlarmActions silences alarm response automation (SNS/Lambda/SSM actions)\
  \ without deleting the alarm \u2014 a stealthy detection-evasion primitive."
match:
- - principal: null
  - HasPermission
  - alarm: null
where:
- node_type(?alarm) == LoggingService
- ?alarm.provider_type == 'AWS::CloudWatch::Alarm'
- ?principal has EFFECTIVE cloudwatch:DisableAlarmActions on ?alarm ARN
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?alarm
  permissions:
  - cloudwatch:DisableAlarmActions
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'ACTIVE when cloudwatch:DisableAlarmActions is confirmed EFFECTIVE on the alarm ARN (identity-based
    policy + no explicit deny + no SCP deny). CONDITIONAL(scp_or_org_policy) when an SCP may restrict
    the action. BLOCKED by an explicit deny on cloudwatch:DisableAlarmActions. This edge is a defense-evasion
    primitive: it does NOT grant access to any compute, data, or identity resource. It reduces detection
    capability only.'
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal HasPermission ?alarm (cloudwatch:DisableAlarmActions effective permission)
  false_positive_note: "cloudwatch:DisableAlarmActions is a CONFIGURATION change, not a destructive action\
    \ \u2014 the alarm node is not removed, and CloudWatch continues to evaluate the metric. The attack\
    \ value is purely evasion: suppressing automated incident response (SNS page, Lambda remediation,\
    \ SSM Automation runbook). This does NOT chain to CanExecuteAs, CanEnterAccount, or any escalation\
    \ edge. Narrative MUST say \"reduces detection\" not \"grants access.\" A complementary cloudwatch:EnableAlarmActions\
    \ permission restores the actions \u2014 the evasion is reversible and may be re-enabled by monitoring\
    \ infrastructure. Do not emit this edge for read-only principals (cloudwatch:DescribeAlarms does not\
    \ imply DisableAlarmActions)."
  narrative: "{principal.name} can disable alarm actions on {alarm.name} (cloudwatch:DisableAlarmActions),\
    \ silencing the automated incident response (SNS notifications, Lambda invocations, or SSM Automation)\
    \ that the alarm would normally trigger. The alarm continues to evaluate the underlying metric but\
    \ fires no response. This reduces detection coverage \u2014 it does not grant access to any resource."