aws-cloudwatch-put-metric-alarm

cloudwatch:PutMetricAlarm creates or overwrites an alarm definition, enabling alarm suppression via threshold manipulation, action redirection, or metric/expression rewriting - a high-impact evasion primitive.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'alarm': None}

where

node_type(?alarm) == LoggingService ?alarm.provider_type == 'AWS::CloudWatch::Alarm' ?principal has EFFECTIVE cloudwatch:PutMetricAlarm on ?alarm ARN

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?alarm`
permissions	`cloudwatch:PutMetricAlarm`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	ACTIVE when cloudwatch:PutMetricAlarm is confirmed EFFECTIVE on the alarm ARN AND the target alarm name/description suggests a security or compliance alarm (e.g., contains "RootSignIn", "IAMPolicy", "Unauthorized", "CIS", "Compliance", "SecurityGroup", "FailedLogin"). The attacker can rewrite the alarm definition to suppress detection by raising the threshold, removing actions, or corrupting the metric/expression. CONDITIONAL(service_state) when the target is a non-security alarm (e.g., application performance, cost tracking, capacity planning) — alarm rewrite has low evasion value in this case. CONDITIONAL(condition_expression) if the alarm name/purpose is ambiguous or unknown. BLOCKED by an explicit deny on cloudwatch:PutMetricAlarm. This edge is defense evasion — NOT escalation.

Narrative

{principal.name} can create or overwrite CloudWatch alarms (cloudwatch:PutMetricAlarm). If applied to a security-critical alarm (such as one monitoring root sign-in, IAM policy changes, or network ACL modifications), the attacker can suppress detection by raising the threshold to MAX_INT, removing alarm actions, or rewriting the metric/expression. This is a detection-evasion primitive - it does not grant access to any resource.

Raw rule rules/derived/aws/cloudwatch.yaml

id: aws-cloudwatch-put-metric-alarm
emits: CanModifyConfiguration
description: "cloudwatch:PutMetricAlarm creates or overwrites an alarm definition, enabling alarm suppression\
  \ via threshold manipulation, action redirection, or metric/expression rewriting \u2014 a high-impact\
  \ evasion primitive."
match:
- - principal: null
  - HasPermission
  - alarm: null
where:
- node_type(?alarm) == LoggingService
- ?alarm.provider_type == 'AWS::CloudWatch::Alarm'
- ?principal has EFFECTIVE cloudwatch:PutMetricAlarm on ?alarm ARN
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?alarm
  permissions:
  - cloudwatch:PutMetricAlarm
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when cloudwatch:PutMetricAlarm is confirmed EFFECTIVE on the alarm ARN AND the\
    \ target alarm name/description suggests a security or compliance alarm (e.g., contains \"RootSignIn\"\
    , \"IAMPolicy\", \"Unauthorized\", \"CIS\", \"Compliance\", \"SecurityGroup\", \"FailedLogin\"). The\
    \ attacker can rewrite the alarm definition to suppress detection by raising the threshold, removing\
    \ actions, or corrupting the metric/expression. CONDITIONAL(service_state) when the target is a non-security\
    \ alarm (e.g., application performance, cost tracking, capacity planning) \u2014 alarm rewrite has\
    \ low evasion value in this case. CONDITIONAL(condition_expression) if the alarm name/purpose is ambiguous\
    \ or unknown. BLOCKED by an explicit deny on cloudwatch:PutMetricAlarm. This edge is defense evasion\
    \ \u2014 NOT escalation."
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal HasPermission ?alarm (cloudwatch:PutMetricAlarm effective permission)
  false_positive_note: "cloudwatch:PutMetricAlarm is a broad capability \u2014 it can create new alarms\
    \ or overwrite existing ones. Creating a new non-security alarm has low evasion value; overwriting\
    \ a CIS-mandated or security-critical alarm is high-value. Distinguish by alarm name/description and\
    \ emit ACTIVE only when the target is a known security alarm (check AlarmName against CIS Benchmark\
    \ alarms, SOC playbook alarms, or keywords like \"RootSignIn\", \"Unauthorized\", \"Failed\"). Do\
    \ not emit CanExecuteAs or CanEnterAccount as consequences. This does NOT chain to escalation edges.\
    \ Narrative MUST say \"can suppress or rewrite an alarm\" not \"grants access to resources.\""
  narrative: "{principal.name} can create or overwrite CloudWatch alarms (cloudwatch:PutMetricAlarm).\
    \ If applied to a security-critical alarm (such as one monitoring root sign-in, IAM policy changes,\
    \ or network ACL modifications), the attacker can suppress detection by raising the threshold to MAX_INT,\
    \ removing alarm actions, or rewriting the metric/expression. This is a detection-evasion primitive\
    \ \u2014 it does not grant access to any resource."