aws-elb-modify-rule-auth-bypass

id: aws-elb-modify-rule-auth-bypass
emits: CanModifyConfiguration
description: Modify an ALB listener rule whose actions include authenticate-oidc or authenticate-cognito
  to bypass per-path authentication enforced by that rule.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - lb: null
where:
- node_type(?lb) == LoadBalancer
- ?lb.provider_type == 'AWS::ElasticLoadBalancingV2::LoadBalancer'
- ?lb.properties.type == 'application'
- at least one ListenerRule on a listener of ?lb has Actions[*].Type containing 'authenticate-oidc' or
  'authenticate-cognito'
- effective_action_on(?principal, ?lb) contains 'elasticloadbalancing:ModifyRule'
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: ?principal
  target: ?lb
  permissions:
  - elasticloadbalancing:ModifyRule
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when elasticloadbalancing:ModifyRule is confirmed effective on the LoadBalancer
    ARN (or wildcard scope) AND the LoadBalancer has at least one listener rule with authenticate-oidc
    or authenticate-cognito action. The ModifyRule permission may be scoped at the rule ARN or the LB
    ARN; we match on the LB to simplify resolution. Listener rules use priority ordering; modifying a
    rule with an auth action allows an attacker to redirect or bypass auth for all requests matching that
    rule's conditions. BLOCKED if SCP or permission boundary denies elasticloadbalancing:ModifyRule.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?lb (elasticloadbalancing:ModifyRule)
  false_positive_note: Similar false-positive conditions as aws-elb-modify-listener-auth-bypass. Additionally,
    listener rules can be overridden by higher-priority rules; an attacker removing auth on a low-priority
    rule may not achieve bypass if a higher-priority rule also authenticates. Confirm the rule's priority
    and the absence of higher-priority blocking rules. The confidence prior (0.85) is lower than ModifyListener
    (0.90) because the rule-level bypass is more granular and may not cover all request paths to the backend.
  narrative: '{principal.name} can call elasticloadbalancing:ModifyRule on listener rules within {lb.name},
    removing the authenticate-oidc/authenticate-cognito action for requests matching targeted rule conditions.
    This bypasses per-path application authentication, making the matched backend path accessible without
    OIDC or Cognito credentials.'