rage.fail

aws-ds-can-update-trust

explicit aws emits CanModifyTrust

match (effective permission)

{ "action": "ds:UpdateTrust", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`TrustPolicy`
source	`<principal>`
target	`<TrustPolicy node of the directory>`
permissions	`ds:UpdateTrust`

Narrative

{principal.name} can modify an existing Active Directory trust relationship for directory {directory.name} (ds:UpdateTrust), altering trust direction, settings, or other trust properties to compromise cross-domain access.

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-update-trust
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: ds:UpdateTrust
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: TrustPolicy
  source: <principal>
  target: <TrustPolicy node of the directory>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:UpdateTrust
  evidence_field: effective ds:UpdateTrust on directory ARN
  narrative: '{principal.name} can modify an existing Active Directory trust relationship for directory
    {directory.name} (ds:UpdateTrust), altering trust direction, settings, or other trust properties to
    compromise cross-domain access.'
  note: 'Distinct from ds:CreateTrust (which creates new trusts); ds:UpdateTrust allows modification of
    existing trusts (e.g., toggling One-Way to Two-Way, altering transitivity settings). An attacker holding
    ONLY ds:UpdateTrust cannot create trusts but can reconfigure existing ones. Coverage gap fix: ds:UpdateTrust
    is a separate official IAM action in AWS Service Authorization Reference, and principals can hold
    it independently. Only applicable to AWS::DirectoryService::MicrosoftAD (Managed AD).'