aws-fms-delete-notification-channel

A principal with fms:DeleteNotificationChannel can permanently remove the SNS topic that receives FMS compliance notifications, creating an irreversible silent-running state for FMS enforcement.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?fms_service`
permissions	`fms:DeleteNotificationChannel`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when principal holds effective fms:DeleteNotificationChannel AND principal.account matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:DeleteNotificationChannel. CONDITIONAL(service_state) if admin account is unknown.

source type

Identity

target type

SecurityService

source

?principal

target

?fms_service

permissions

fms:DeleteNotificationChannel

conditions

iam_permission service_state

state logic

ACTIVE when principal holds effective fms:DeleteNotificationChannel AND principal.account matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:DeleteNotificationChannel. CONDITIONAL(service_state) if admin account is unknown.

Narrative

{principal.name} can permanently delete the SNS notification channel for Firewall Manager (fms:DeleteNotificationChannel), creating an irreversible silent-running state. FMS compliance violations remain enforced but undetected by alerting operators across all in-scope accounts.

Raw rule rules/derived/aws/firewallmanager.yaml

id: aws-fms-delete-notification-channel
emits: CanDelete
description: A principal with fms:DeleteNotificationChannel can permanently remove the SNS topic that
  receives FMS compliance notifications, creating an irreversible silent-running state for FMS enforcement.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - fms_service: null
where:
- node_type(?fms_service) == SecurityService
- ?fms_service.provider_type == 'AWS::FMS::NotificationChannel'
- effective_permission(?principal, ?fms_service) contains 'fms:DeleteNotificationChannel'
- ?principal.account == ?fms_service.admin_account_id
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?fms_service
  permissions:
  - fms:DeleteNotificationChannel
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when principal holds effective fms:DeleteNotificationChannel AND principal.account
    matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:DeleteNotificationChannel.
    CONDITIONAL(service_state) if admin account is unknown.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?fms_service) [fms:DeleteNotificationChannel]
  false_positive_note: "This is a SECONDARY EVASION primitive \u2014 destructive variant of channel tampering.\
    \ Deletion is permanent and removes the SNS destination, but like PutNotificationChannel, it silences\
    \ alerts without removing preventive enforcement. Compliance violations remain discoverable; the attacker\
    \ simply suppresses notifications. This does NOT grant resource access or IAM permissions. Do NOT\
    \ chain to CanEnterAccount, CanExecuteAs, or CanEscalateTo. Confidence (0.85) is higher than Put-variant\
    \ (0.80) due to clear destructive intent, but lower than policy deletion due to weaker impact (enforcement\
    \ persists)."
  narrative: '{principal.name} can permanently delete the SNS notification channel for Firewall Manager
    (fms:DeleteNotificationChannel), creating an irreversible silent-running state. FMS compliance violations
    remain enforced but undetected by alerting operators across all in-scope accounts.'