aws-ct-deregister-ou-escapes-guardrail

Deregistering an OU from Control Tower governance (or reparenting accounts) removes the inherited SCP guardrails from those accounts.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'ou': None} HasPolicy {'scp': None}

where

node_class(?ou) == AdministrativeBoundary and node_type(?ou) == Folder # a registered OU node_type(?scp) == ServiceControlPolicy # a preventive control SCP attached at the OU ?principal holds EFFECTIVE controltower:DeregisterOrganizationalUnit on ?ou (or organizations:MoveAccount to reparent accounts out of ?ou) ?principal acts from the management or delegated-admin account

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`<OU-governance / account-membership scope binding of ?ou>`
permissions	`controltower:DeregisterOrganizationalUnit` `organizations:MoveAccount?`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds controltower:DeregisterOrganizationalUnit (or organizations:MoveAccount for the reparent variant) at the right scope. This is the 'move the resource out of the guardrail's scope' ALTERNATIVE that hierarchy-chains.yaml guardrail-removal-upgrades-blocked accepts (its optional CanModifyConfiguration ?scope_binding clause) — pulling accounts out of ?ou lifts every edge blocked_by the SCPs inherited at ?ou. DEFER the upgrade.

Narrative

{principal.name} can deregister OU {ou.name} from Control Tower governance (or reparent its accounts), pulling them out of the SCP guardrails inherited there and unblocking the edges those SCPs denied.

Raw rule rules/derived/aws/controltower.yaml

id: aws-ct-deregister-ou-escapes-guardrail
emits: CanModifyConfiguration
description: Deregistering an OU from Control Tower governance (or reparenting accounts) removes the inherited
  SCP guardrails from those accounts.
match:
- - ou: null
  - HasPolicy
  - scp: null
where:
- 'node_class(?ou) == AdministrativeBoundary and node_type(?ou) == Folder   # a registered OU'
- 'node_type(?scp) == ServiceControlPolicy   # a preventive control SCP attached at the OU'
- ?principal holds EFFECTIVE controltower:DeregisterOrganizationalUnit on ?ou (or organizations:MoveAccount
  to reparent accounts out of ?ou)
- ?principal acts from the management or delegated-admin account
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: <OU-governance / account-membership scope binding of ?ou>
  permissions:
  - controltower:DeregisterOrganizationalUnit
  - organizations:MoveAccount?
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal holds controltower:DeregisterOrganizationalUnit (or organizations:MoveAccount\
    \ for the reparent variant) at the right scope. This is the 'move the resource out of the guardrail's\
    \ scope' ALTERNATIVE that hierarchy-chains.yaml guardrail-removal-upgrades-blocked accepts (its optional\
    \ CanModifyConfiguration ?scope_binding clause) \u2014 pulling accounts out of ?ou lifts every edge\
    \ blocked_by the SCPs inherited at ?ou. DEFER the upgrade."
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <HasPolicy edge (OU -> attached SCP)>
  - <effective controltower:DeregisterOrganizationalUnit / organizations:MoveAccount>
  false_positive_note: "Deregistering an OU stops CT enforcing baselines/controls on it but does NOT automatically\
    \ detach directly-attached SCPs \u2014 the realistic escape is reparenting the ACCOUNT to a different\
    \ OU whose SCP set is weaker (organizations:MoveAccount), which is an Organizations action (CITE the\
    \ org model, do not re-derive MoveAccount here). Only a mgmt/delegated-admin principal can do this.\
    \ Do not fire when the destination OU carries an equivalent-or-stronger guardrail (no escape achieved)."
  narrative: '{principal.name} can deregister OU {ou.name} from Control Tower governance (or reparent
    its accounts), pulling them out of the SCP guardrails inherited there and unblocking the edges those
    SCPs denied.'