aws-detective-remove-member

Forcibly removing a member account from a Detective behavior graph (detective:DeleteMembers) is a defense-evasion primitive (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService node.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?graph`
permissions	`detective:DeleteMembers`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary`
state logic	ACTIVE when the IAM effective-permission evaluator confirms detective:DeleteMembers on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope is unresolved. BLOCKED when an SCP or permission boundary denies detective:DeleteMembers.

source type

Identity

target type

SecurityService

source

?principal

target

?graph

permissions

detective:DeleteMembers

conditions

iam_permission scp_or_org_policy permission_boundary

state logic

ACTIVE when the IAM effective-permission evaluator confirms detective:DeleteMembers on the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when the permission is policy-present but resource-scope is unresolved. BLOCKED when an SCP or permission boundary denies detective:DeleteMembers.

Narrative

{principal.name} can remove member accounts from the Amazon Detective behavior graph {graph.name} (detective:DeleteMembers), preventing data aggregation from those accounts. This is a defense-evasion primitive - it reduces detection coverage but does not grant access to any resource. Only the graph administrator can forcibly remove members.

Raw rule rules/derived/aws/detective.yaml

id: aws-detective-remove-member
emits: CanModifyConfiguration
description: Forcibly removing a member account from a Detective behavior graph (detective:DeleteMembers)
  is a defense-evasion primitive (ADMINISTRATOR ONLY). Emits CanModifyConfiguration on the SecurityService
  node.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - graph: null
where:
- node_type(?graph) == SecurityService
- ?graph.provider_type == 'AWS::Detective::Graph'
- effective_permission(?principal, ?graph, detective:DeleteMembers)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?graph
  permissions:
  - detective:DeleteMembers
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  state_logic: ACTIVE when the IAM effective-permission evaluator confirms detective:DeleteMembers on
    the graph ARN with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when the permission
    is policy-present but resource-scope is unresolved. BLOCKED when an SCP or permission boundary denies
    detective:DeleteMembers.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?graph
  false_positive_note: "This is ADMINISTRATOR ONLY \u2014 the graph admin can forcibly remove members.\
    \ Do NOT confuse with detective:DisassociateMembership, which is called by the member account itself\
    \ to remove itself from the graph (separate rule). This capability reduces investigative coverage\
    \ for the removed account but does not grant access to any resource."
  narrative: "{principal.name} can remove member accounts from the Amazon Detective behavior graph {graph.name}\
    \ (detective:DeleteMembers), preventing data aggregation from those accounts. This is a defense-evasion\
    \ primitive \u2014 it reduces detection coverage but does not grant access to any resource. Only the\
    \ graph administrator can forcibly remove members."