aws-directconnect-delete-vif

IAM principal with directconnect:DeleteVirtualInterface can disrupt existing Direct Connect routing (availability impact, not escalation).

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Network`
source	`?principal`
target	`?dxresource`
permissions	`directconnect:DeleteVirtualInterface`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the effective-permission evaluator confirms directconnect:DeleteVirtualInterface on the VIF ARN. BLOCKED if an SCP or permission boundary explicitly denies the action.

source type

Identity

target type

Network

source

?principal

target

?dxresource

permissions

directconnect:DeleteVirtualInterface

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when the effective-permission evaluator confirms directconnect:DeleteVirtualInterface on the VIF ARN. BLOCKED if an SCP or permission boundary explicitly denies the action.

Narrative

{principal.name} can delete Direct Connect virtual interfaces targeting {dxresource.name}, disrupting existing on-premises network connectivity into AWS.

Raw rule rules/derived/aws/directconnect.yaml

id: aws-directconnect-delete-vif
emits: CanDelete
description: IAM principal with directconnect:DeleteVirtualInterface can disrupt existing Direct Connect
  routing (availability impact, not escalation).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - dxresource: null
where:
- node_type(?principal) in [Identity]
- node_type(?dxresource) in [Route]
- ?dxresource.provider_type == 'AWS::DirectConnect::VirtualInterface'
- effective_action_on(?principal, ?dxresource) intersects ['directconnect:DeleteVirtualInterface']
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?dxresource
  permissions:
  - directconnect:DeleteVirtualInterface
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the effective-permission evaluator confirms directconnect:DeleteVirtualInterface
    on the VIF ARN. BLOCKED if an SCP or permission boundary explicitly denies the action.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?dxresource (directconnect:DeleteVirtualInterface)
  false_positive_note: (1) This is a destructive action (disruption/availability impact), not escalation
    or lateral movement. CanDelete is non-walkable in path queries by default. Include only if the threat
    model explicitly includes denial-of-service or persistence through disruption-and-recreation.
  narrative: '{principal.name} can delete Direct Connect virtual interfaces targeting {dxresource.name},
    disrupting existing on-premises network connectivity into AWS.'