rage.fail

aws-ds-can-delete-trust

explicit aws emits CanModifyTrust

match (effective permission)

{ "action": "ds:DeleteTrust", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`TrustPolicy`
source	`<principal>`
target	`<TrustPolicy node of the directory>`
permissions	`ds:DeleteTrust`

Narrative

{principal.name} can delete an Active Directory trust relationship for directory {directory.name} (ds:DeleteTrust), removing cross-domain authentication paths or disrupting guardrail trusts.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-delete-trust
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: ds:DeleteTrust
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: TrustPolicy
  source: <principal>
  target: <TrustPolicy node of the directory>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:DeleteTrust
  evidence_field: effective ds:DeleteTrust on directory ARN
  narrative: '{principal.name} can delete an Active Directory trust relationship for directory {directory.name}
    (ds:DeleteTrust), removing cross-domain authentication paths or disrupting guardrail trusts.'
  note: Trust deletion is a destructive capability that impacts availability (breaks cross-domain auth)
    but also acts as a guardrail-removal path (if a trust is used to gate access, deleting it can unblock
    further attacks). CanModifyTrust encompasses both creation (trust-addition) and deletion (trust-removal).
    Only applicable to Managed AD. Prefer to emit separately from create-trust if blast-radius analysis
    treats creation and deletion differently.