aws-detective-member-disassociate

A member account can remove itself from a Detective behavior graph (detective:DisassociateMembership). This is a self-removal action with reduced scope. Emits CONDITIONAL CanModifyConfiguration.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?graph`
permissions	`detective:DisassociateMembership`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary` `region_or_boundary`
state logic	ACTIVE when the IAM effective-permission evaluator confirms detective:DisassociateMembership on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(region_or_boundary) when the principal is confirmed to be a member account of the specified graph (requires additional membership verification). CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope is unresolved. BLOCKED when an SCP or permission boundary denies detective:DisassociateMembership.

source type

Identity

target type

SecurityService

source

?principal

target

?graph

permissions

detective:DisassociateMembership

conditions

iam_permission scp_or_org_policy permission_boundary region_or_boundary

state logic

ACTIVE when the IAM effective-permission evaluator confirms detective:DisassociateMembership on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(region_or_boundary) when the principal is confirmed to be a member account of the specified graph (requires additional membership verification). CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope is unresolved. BLOCKED when an SCP or permission boundary denies detective:DisassociateMembership.

Narrative

{principal.name} (member account) can remove itself from the Amazon Detective behavior graph {graph.name}, stopping its CloudTrail and VPC Flow Log data from being aggregated. This is a self-removal action (member-initiated), reducing investigative visibility of the member account only. Lower impact than administrator-side member removal.

Raw rule rules/derived/aws/detective.yaml

id: aws-detective-member-disassociate
emits: CanModifyConfiguration
description: A member account can remove itself from a Detective behavior graph (detective:DisassociateMembership).
  This is a self-removal action with reduced scope. Emits CONDITIONAL CanModifyConfiguration.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - graph: null
where:
- node_type(?graph) == SecurityService
- ?graph.provider_type == 'AWS::Detective::Graph'
- effective_permission(?principal, ?graph, detective:DisassociateMembership)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?graph
  permissions:
  - detective:DisassociateMembership
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  - region_or_boundary
  state_logic: ACTIVE when the IAM effective-permission evaluator confirms detective:DisassociateMembership
    on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(region_or_boundary) when the
    principal is confirmed to be a member account of the specified graph (requires additional membership
    verification). CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope
    is unresolved. BLOCKED when an SCP or permission boundary denies detective:DisassociateMembership.
  confidence: 0.75
  derived_from:
  - ?principal HasPermission ?graph
  false_positive_note: "This is MEMBER SELF-REMOVAL ONLY \u2014 the member account removes itself from\
    \ the graph. Only meaningful as an evasion primitive if the member account has activity worth hiding.\
    \ Do NOT chain to privilege-escalation edges. Requires the principal to actually be a member of the\
    \ graph (CONDITIONAL scope)."
  narrative: '{principal.name} (member account) can remove itself from the Amazon Detective behavior graph
    {graph.name}, stopping its CloudTrail and VPC Flow Log data from being aggregated. This is a self-removal
    action (member-initiated), reducing investigative visibility of the member account only. Lower impact
    than administrator-side member removal.'