aws-ct-disable-control-modifies-scp

Disabling or updating a Control Tower preventive control modifies the SCP guardrail backing it, removing its deny.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'enabled_control': None} HasPolicy {'scp': None}

where

node_type(?scp) == ServiceControlPolicy # preventive control (detective/Config-rule controls gate nothing) ?principal holds EFFECTIVE controltower:DisableControl OR controltower:UpdateEnabledControl on ?enabled_control (or organizations:DetachPolicy/UpdatePolicy on ?scp) ?enabled_control is NOT a mandatory control (mandatory controls cannot be disabled) ?principal acts from the management account or a Control Tower delegated-admin account

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?scp`
permissions	`controltower:DisableControl` `controltower:UpdateEnabledControl` `organizations:DetachPolicy?` `organizations:UpdatePolicy?`
conditions	`iam_permission`
state logic	ACTIVE when the principal unconditionally holds controltower:DisableControl / UpdateEnabledControl on a NON-mandatory control (or the underlying organizations:DetachPolicy/UpdatePolicy on the SCP) from the mgmt/delegated- admin account. BLOCKED/POTENTIAL when the control is mandatory (cannot be disabled) or the principal lacks org-scope reach. This CanModifyPolicy over the SCP is the guardrail-removal capability CONSUMED by hierarchy-chains.yaml guardrail-removal-upgrades-blocked — which performs the BLOCKED->ACTIVE upgrade of every edge blocked_by == ?scp. DEFER that upgrade; do NOT enumerate the unblocked edges here.

Narrative

{principal.name} can disable/modify Control Tower control {enabled_control.name} (controltower:DisableControl/UpdateEnabledControl), removing the SCP guardrail {scp.name} that backs it and unblocking everything that SCP denied.

Raw rule rules/derived/aws/controltower.yaml

id: aws-ct-disable-control-modifies-scp
emits: CanModifyPolicy
description: Disabling or updating a Control Tower preventive control modifies the SCP guardrail backing
  it, removing its deny.
match:
- - enabled_control: null
  - HasPolicy
  - scp: null
where:
- 'node_type(?scp) == ServiceControlPolicy   # preventive control (detective/Config-rule controls gate
  nothing)'
- ?principal holds EFFECTIVE controltower:DisableControl OR controltower:UpdateEnabledControl on ?enabled_control
  (or organizations:DetachPolicy/UpdatePolicy on ?scp)
- ?enabled_control is NOT a mandatory control (mandatory controls cannot be disabled)
- ?principal acts from the management account or a Control Tower delegated-admin account
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?scp
  permissions:
  - controltower:DisableControl
  - controltower:UpdateEnabledControl
  - organizations:DetachPolicy?
  - organizations:UpdatePolicy?
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal unconditionally holds controltower:DisableControl / UpdateEnabledControl\
    \ on a NON-mandatory control (or the underlying organizations:DetachPolicy/UpdatePolicy on the SCP)\
    \ from the mgmt/delegated- admin account. BLOCKED/POTENTIAL when the control is mandatory (cannot\
    \ be disabled) or the principal lacks org-scope reach. This CanModifyPolicy over the SCP is the guardrail-removal\
    \ capability CONSUMED by hierarchy-chains.yaml guardrail-removal-upgrades-blocked \u2014 which performs\
    \ the BLOCKED->ACTIVE upgrade of every edge blocked_by == ?scp. DEFER that upgrade; do NOT enumerate\
    \ the unblocked edges here."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <HasPolicy edge (EnabledControl -> backing SCP)>
  - <effective controltower:DisableControl / UpdateEnabledControl>
  false_positive_note: "Only PREVENTIVE controls have an SCP backing \u2014 do not fire for detective\
    \ (Config-rule) controls; disabling those removes monitoring, not a deny, and upgrades no edge. Mandatory\
    \ controls cannot be disabled (they protect CT resources) \u2014 emit BLOCKED/POTENTIAL, never ACTIVE,\
    \ for them. The editor must act from the management or delegated-admin account: a member-account principal\
    \ with only local IAM cannot weaken the SCP. Overlaps the Organizations SCP model \u2014 dedupe on\
    \ (CanModifyPolicy, principal, scp); this rule adds the CT control->SCP mapping. Cite hierarchy-chains.yaml\
    \ for the actual upgrade."
  narrative: '{principal.name} can disable/modify Control Tower control {enabled_control.name} (controltower:DisableControl/UpdateEnabledControl),
    removing the SCP guardrail {scp.name} that backs it and unblocking everything that SCP denied.'