aws-ct-execution-role-guardrail-bypass

Documentation-only: Control Tower SCPs that exempt AWSControlTowerExecution mean a session obtained via that role is not subject to those preventive guardrails. No distinct edge is emitted; annotates rule 1's CanEnterAccount.

derived aws emits

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source	`?principal`
target	`?account`
permissions	`sts:AssumeRole`
conditions	`scp_or_org_policy`
state logic	POTENTIAL, documentation-only. Does NOT re-emit CanEnterAccount (rule 1 owns that edge) and does NOT create a CanModifyPolicy (nothing is modified — the SCP already exempts the role). It records that BLOCKED-by-SCP edges inside ?account may not actually apply to a session acting as AWSControlTowerExecution when the SCP's condition exempts that role's ARN. This exempted-principal escape is NOT yet consumed by hierarchy-chains.yaml guardrail-removal-upgrades-blocked (which only fires on CanModifyPolicy / CanModifyConfiguration), so the upgrade is not materialized in the graph — it is surfaced as an analyst annotation only.

source

?principal

target

?account

permissions

sts:AssumeRole

conditions

scp_or_org_policy

state logic

POTENTIAL, documentation-only. Does NOT re-emit CanEnterAccount (rule 1 owns that edge) and does NOT create a CanModifyPolicy (nothing is modified — the SCP already exempts the role). It records that BLOCKED-by-SCP edges inside ?account may not actually apply to a session acting as AWSControlTowerExecution when the SCP's condition exempts that role's ARN. This exempted-principal escape is NOT yet consumed by hierarchy-chains.yaml guardrail-removal-upgrades-blocked (which only fires on CanModifyPolicy / CanModifyConfiguration), so the upgrade is not materialized in the graph — it is surfaced as an analyst annotation only.

Narrative

{principal.name}, acting as AWSControlTowerExecution in {account.name}, operates outside the preventive SCP guardrails that exempt that role (documentation-only; no graph edge emitted).

Raw rule rules/derived/aws/controltower.yaml

id: aws-ct-execution-role-guardrail-bypass
emits: null
kind: annotation
description: 'Documentation-only: Control Tower SCPs that exempt AWSControlTowerExecution mean a session
  obtained via that role is not subject to those preventive guardrails. No distinct edge is emitted; annotates
  rule 1''s CanEnterAccount.'
match:
- - principal: null
  - CanEnterAccount
  - account: null
where:
- the CanEnterAccount was obtained via AWSControlTowerExecution (rule aws-ct-execution-role-enter-account)
- at least one CT preventive control SCP attached to ?account's OU contains a condition exempting the
  AWSControlTowerExecution role (aws:PrincipalArn)
emit:
  source: ?principal
  target: ?account
  permissions:
  - sts:AssumeRole
  conditions:
  - scp_or_org_policy
  state_logic: "POTENTIAL, documentation-only. Does NOT re-emit CanEnterAccount (rule 1 owns that edge)\
    \ and does NOT create a CanModifyPolicy (nothing is modified \u2014 the SCP already exempts the role).\
    \ It records that BLOCKED-by-SCP edges inside ?account may not actually apply to a session acting\
    \ as AWSControlTowerExecution when the SCP's condition exempts that role's ARN. This exempted-principal\
    \ escape is NOT yet consumed by hierarchy-chains.yaml guardrail-removal-upgrades-blocked (which only\
    \ fires on CanModifyPolicy / CanModifyConfiguration), so the upgrade is not materialized in the graph\
    \ \u2014 it is surfaced as an analyst annotation only."
  confidence: min(contributing_confidences)
  derived_from:
  - aws-ct-execution-role-enter-account (CanEnterAccount via AWSControlTowerExecution)
  - <exempting ServiceControlPolicy condition (aws:PrincipalArn == AWSControlTowerExecution)>
  false_positive_note: "The exemption is PER-SCP: only annotate for a specific SCP whose condition genuinely\
    \ exempts AWSControlTowerExecution (aws:PrincipalArn condition). Do NOT blanket-assume every guardrail\
    \ is bypassed. Mandatory controls that protect CT resources may still deny even this role \u2014 respect\
    \ their conditions. Detective (Config-rule) controls are irrelevant here. This rule emits NO edge:\
    \ do not treat it as producing CanEnterAccount (that would duplicate rule 1) or CanModifyPolicy (nothing\
    \ is modified)."
  narrative: '{principal.name}, acting as AWSControlTowerExecution in {account.name}, operates outside
    the preventive SCP guardrails that exempt that role (documentation-only; no graph edge emitted).'