aws-config-aggregator-read-inventory

config:ListAggregateDiscoveredResources or config:BatchGetAggregateResourceConfig on a Config Aggregator exposes cross-account resource inventory and configurations - recon primitive.

derived aws emits CanRead

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'aggregator': None}

where

effective_action in ['config:ListAggregateDiscoveredResources', 'config:BatchGetAggregateResourceConfig', 'config:GetAggregateConfigRuleComplianceSummary'] node_type(?aggregator) == ConfigurationService ?aggregator.provider_type == 'AWS::Config::ConfigurationAggregator'

emit

source type	`Identity`
target type	`ConfigurationService`
source	`?principal`
target	`?aggregator`
permissions	`config:ListAggregateDiscoveredResources` `config:BatchGetAggregateResourceConfig` `config:GetAggregateConfigRuleComplianceSummary`
conditions	`iam_permission`
state logic	ACTIVE when any of the listed actions is EFFECTIVE on the aggregator ARN or '*'. BLOCKED when an SCP denies all listed actions. The aggregator must be populated (source accounts authorized) for the read to return data; CONDITIONAL(service_state) when the aggregator exists but has no authorized source accounts.

Narrative

{principal.name} can read cross-account resource inventory from Config Aggregator {aggregator.name} (config:ListAggregateDiscoveredResources / config:BatchGetAggregateResourceConfig), exposing configuration metadata for resources across all aggregated accounts - enabling large-scale reconnaissance without direct access to those accounts.

Raw rule rules/derived/aws/config.yaml

id: aws-config-aggregator-read-inventory
emits: CanRead
description: "config:ListAggregateDiscoveredResources or config:BatchGetAggregateResourceConfig on a Config\
  \ Aggregator exposes cross-account resource inventory and configurations \u2014 recon primitive."
match:
- - principal: null
  - HasPermission
  - aggregator: null
where:
- effective_action in ['config:ListAggregateDiscoveredResources', 'config:BatchGetAggregateResourceConfig',
  'config:GetAggregateConfigRuleComplianceSummary']
- node_type(?aggregator) == ConfigurationService
- ?aggregator.provider_type == 'AWS::Config::ConfigurationAggregator'
emit:
  source_type: Identity
  target_type: ConfigurationService
  source: ?principal
  target: ?aggregator
  permissions:
  - config:ListAggregateDiscoveredResources
  - config:BatchGetAggregateResourceConfig
  - config:GetAggregateConfigRuleComplianceSummary
  conditions:
  - iam_permission
  state_logic: ACTIVE when any of the listed actions is EFFECTIVE on the aggregator ARN or '*'. BLOCKED
    when an SCP denies all listed actions. The aggregator must be populated (source accounts authorized)
    for the read to return data; CONDITIONAL(service_state) when the aggregator exists but has no authorized
    source accounts.
  confidence: 0.8
  derived_from:
  - effective config:ListAggregateDiscoveredResources or similar on ?aggregator
  false_positive_note: "This derives from the explicit permission edge aws-config-aggregator-read-inventory.\
    \ Recon only \u2014 reading aggregator data does not grant access to the resources it describes; it\
    \ only reveals their configuration state. Downgrade significance when the aggregator covers only the\
    \ attacker's own account (no cross-account value). High value when the aggregator covers the entire\
    \ AWS Organization \u2014 it exposes resource types, IDs, configurations, and compliance status across\
    \ all member accounts without requiring access to those accounts. This is a 1-rule conservative treatment\
    \ per Phase 12 LOW-relevance guidance for recon services. Do NOT chain this to CanEnter* or CanExecuteAs."
  narrative: "{principal.name} can read cross-account resource inventory from Config Aggregator {aggregator.name}\
    \ (config:ListAggregateDiscoveredResources / config:BatchGetAggregateResourceConfig), exposing configuration\
    \ metadata for resources across all aggregated accounts \u2014 enabling large-scale reconnaissance\
    \ without direct access to those accounts."