aws-detective-weaken-org-config

Modifying organization-wide Detective configuration (UpdateOrganizationConfiguration, EnableOrganizationAdminAccount) weakens the org's investigative posture. Emits CanModifyConfiguration on the Organization scope.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Organization`
source	`?principal`
target	`?org_scope`
permissions	`detective:UpdateOrganizationConfiguration` `detective:EnableOrganizationAdminAccount`
conditions	`iam_permission` `scp_or_org_policy` `permission_boundary`
state logic	ACTIVE when the IAM effective-permission evaluator confirms at least one of detective:UpdateOrganizationConfiguration or detective:EnableOrganizationAdminAccount on the org scope with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when permission is policy-present but scope is unresolved. BLOCKED when an SCP or permission boundary denies both actions.

source type

Identity

target type

Organization

source

?principal

target

?org_scope

permissions

detective:UpdateOrganizationConfiguration detective:EnableOrganizationAdminAccount

conditions

iam_permission scp_or_org_policy permission_boundary

state logic

ACTIVE when the IAM effective-permission evaluator confirms at least one of detective:UpdateOrganizationConfiguration or detective:EnableOrganizationAdminAccount on the org scope with no SCP or permission-boundary denial. CONDITIONAL(iam_permission) when permission is policy-present but scope is unresolved. BLOCKED when an SCP or permission boundary denies both actions.

Narrative

{principal.name} can weaken the organization's Detective posture by enabling organization-wide auto-detection configuration changes or designating a delegated administrator. This reduces or redirects investigative coverage across all org member accounts. Defense-evasion / cover-tracks primitive.

Raw rule rules/derived/aws/detective.yaml

id: aws-detective-weaken-org-config
emits: CanModifyConfiguration
description: Modifying organization-wide Detective configuration (UpdateOrganizationConfiguration, EnableOrganizationAdminAccount)
  weakens the org's investigative posture. Emits CanModifyConfiguration on the Organization scope.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - org_scope: null
where:
- node_type(?org_scope) == Organization OR scope_is(?org_scope, organization-level)
- "(effective_permission(?principal, ?org_scope, detective:UpdateOrganizationConfiguration) OR\n effective_permission(?principal,\
  \ ?org_scope, detective:EnableOrganizationAdminAccount))"
emit:
  source_type: Identity
  target_type: Organization
  source: ?principal
  target: ?org_scope
  permissions:
  - detective:UpdateOrganizationConfiguration
  - detective:EnableOrganizationAdminAccount
  conditions:
  - iam_permission
  - scp_or_org_policy
  - permission_boundary
  state_logic: ACTIVE when the IAM effective-permission evaluator confirms at least one of detective:UpdateOrganizationConfiguration
    or detective:EnableOrganizationAdminAccount on the org scope with no SCP or permission-boundary denial.
    CONDITIONAL(iam_permission) when permission is policy-present but scope is unresolved. BLOCKED when
    an SCP or permission boundary denies both actions.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?org_scope
  false_positive_note: These are ORG-LEVEL actions affecting all org accounts. Do NOT chain to CanExecuteAs
    or CanEnterAccount; they alter investigative posture, not access control. detective:EnableOrganizationAdminAccount
    requires organizations:RegisterDelegatedAdministrator as a CONDITIONAL prerequisite if using the Organizations
    adapter.
  narrative: '{principal.name} can weaken the organization''s Detective posture by enabling organization-wide
    auto-detection configuration changes or designating a delegated administrator. This reduces or redirects
    investigative coverage across all org member accounts. Defense-evasion / cover-tracks primitive.'