aws-elb-modify-listener-auth-bypass

id: aws-elb-modify-listener-auth-bypass
emits: CanModifyConfiguration
description: Modify an ALB listener whose default action includes authenticate-oidc or authenticate-cognito
  to remove or replace the authentication action, bypassing application-layer identity enforcement before
  traffic reaches the backend.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - lb: null
where:
- node_type(?lb) == LoadBalancer
- ?lb.provider_type == 'AWS::ElasticLoadBalancingV2::LoadBalancer'
- ?lb.properties.type == 'application'
- at least one Listener on ?lb has DefaultActions[*].Type containing 'authenticate-oidc' or 'authenticate-cognito'
- effective_action_on(?principal, ?lb) contains 'elasticloadbalancing:ModifyListener'
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: ?principal
  target: ?lb
  permissions:
  - elasticloadbalancing:ModifyListener
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when elasticloadbalancing:ModifyListener is confirmed effective on the LoadBalancer
    ARN (or wildcard scope) AND the LoadBalancer has at least one listener with authenticate-oidc or authenticate-cognito
    action. The ModifyListener permission may be scoped at the listener ARN or the LB ARN; we match on
    the LB to avoid per-listener ARN resolution complexity. Changing any listener's default action from
    auth to 'forward' removes authentication enforcement for requests matching that listener. BLOCKED
    if SCP or permission boundary denies elasticloadbalancing:ModifyListener.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?lb (elasticloadbalancing:ModifyListener)
  false_positive_note: "Only HIGH-VALUE when at least one listener action is authenticate-oidc or authenticate-cognito\
    \ \u2014 if all listeners already use 'forward', this edge is a no-op. Verify the Listener.DefaultActions\
    \ array contains the auth action type before emitting. This edge bypasses application authentication,\
    \ NOT IAM authorization; the downstream backend may enforce its own auth independently. Consider the\
    \ backend type: if the backend is itself an IAM-gated service (Lambda with IAM auth), the auth bypass\
    \ may still be blocked at the backend. If the backend is a plain HTTP app with no further auth (common\
    \ for OIDC-protected internal apps), this is a full authentication bypass. Target_type set to LoadBalancer\
    \ as the CanModifyConfiguration target; the linter allows Identity -> * for this edge."
  narrative: '{principal.name} can call elasticloadbalancing:ModifyListener on {lb.name}, changing any
    listener''s default action from ''authenticate-oidc''/''authenticate-cognito'' to ''forward''. This
    removes application-layer authentication enforcement, making the backend accessible to any caller
    who can reach the load balancer without needing OIDC or Cognito credentials.'