aws-eb-putpermission-canmodifypolicy

events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting cross-account trust or public access.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`?principal`
target	`<bus resource policy node>`
permissions	`events:PutPermission`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when events:PutPermission is effective on the bus ARN and not denied by SCP or permission boundary. BLOCKED when an SCP or explicit deny prevents the action. The consequence (CrossAccountTrust injection) is produced by can-control's enter-account-via-assume rule and is CONDITIONAL(condition_expression) when the attacker injects a scoped condition (aws:SourceAccount, aws:PrincipalOrgID).

source type

Identity

target type

ResourcePolicy

source

?principal

target

<bus resource policy node>

permissions

events:PutPermission

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when events:PutPermission is effective on the bus ARN and not denied by SCP or permission boundary. BLOCKED when an SCP or explicit deny prevents the action. The consequence (CrossAccountTrust injection) is produced by can-control's enter-account-via-assume rule and is CONDITIONAL(condition_expression) when the attacker injects a scoped condition (aws:SourceAccount, aws:PrincipalOrgID).

Narrative

{principal.name} can rewrite the resource policy of EventBridge bus {bus.name} (events:PutPermission), allowing injection of cross-account publish trust, principal:* grants, or self-escalation via new policy statements.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-putpermission-canmodifypolicy
emits: CanModifyPolicy
description: events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting
  cross-account trust or public access.
match:
- - principal: null
  - HasPermission
  - bus: null
where:
- node_type(?bus) == EventBus
- effective_action(?principal, ?bus) includes 'events:PutPermission'
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <bus resource policy node>
  permissions:
  - events:PutPermission
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when events:PutPermission is effective on the bus ARN and not denied by SCP or permission
    boundary. BLOCKED when an SCP or explicit deny prevents the action. The consequence (CrossAccountTrust
    injection) is produced by can-control's enter-account-via-assume rule and is CONDITIONAL(condition_expression)
    when the attacker injects a scoped condition (aws:SourceAccount, aws:PrincipalOrgID).
  confidence: 0.95
  derived_from:
  - 'effective IAM evaluation: events:PutPermission on ?bus'
  false_positive_note: "events:RemovePermission alone (without PutPermission) cannot create new policies\
    \ \u2014 it only removes existing statements. Only emit CanModifyPolicy when events:PutPermission\
    \ is confirmed. Verify that the principal can actually re-write the policy statement (full PutPermission\
    \ semantics, not a partial grant that is scoped to specific actions within the policy)."
  narrative: '{principal.name} can rewrite the resource policy of EventBridge bus {bus.name} (events:PutPermission),
    allowing injection of cross-account publish trust, principal:* grants, or self-escalation via new
    policy statements.'