aws-fms-delete-policy

A principal with fms:DeletePolicy can permanently delete an existing Firewall Manager policy, eliminating org-wide enforcement of WAF/Shield/Security Group/ Network Firewall/DNS Firewall controls across all in-scope member accounts. This is an irreversible destructive action with maximum blast radius.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'fms_policy': None}

where

node_type(?fms_policy) == SecurityService ?fms_policy.provider_type == 'AWS::FMS::Policy' effective_permission(?principal, ?fms_policy) contains 'fms:DeletePolicy' ?principal.account == ?fms_policy.admin_account_id

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?fms_policy`
permissions	`fms:DeletePolicy`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when principal holds effective fms:DeletePolicy permission on the target policy ARN AND principal.account matches the policy's admin_account_id. BLOCKED when an SCP or permission boundary explicitly denies fms:DeletePolicy. CONDITIONAL(service_state) if admin_account_id is not populated during collection.

Narrative

{principal.name} can permanently delete the Firewall Manager policy {fms_policy.name} (fms:DeletePolicy), eliminating org-wide {fms_policy.PolicyType} enforcement from all in-scope accounts ({policy_scope}). This is an irreversible destructive cover-tracks action that eliminates a preventive control at organizational scale. It does NOT grant resource access, credentials, or execution sessions in any member account.

Raw rule rules/derived/aws/firewallmanager.yaml

id: aws-fms-delete-policy
emits: CanDelete
description: A principal with fms:DeletePolicy can permanently delete an existing Firewall Manager policy,
  eliminating org-wide enforcement of WAF/Shield/Security Group/ Network Firewall/DNS Firewall controls
  across all in-scope member accounts. This is an irreversible destructive action with maximum blast radius.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - fms_policy: null
where:
- node_type(?fms_policy) == SecurityService
- ?fms_policy.provider_type == 'AWS::FMS::Policy'
- effective_permission(?principal, ?fms_policy) contains 'fms:DeletePolicy'
- ?principal.account == ?fms_policy.admin_account_id
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?fms_policy
  permissions:
  - fms:DeletePolicy
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when principal holds effective fms:DeletePolicy permission on the target policy
    ARN AND principal.account matches the policy's admin_account_id. BLOCKED when an SCP or permission
    boundary explicitly denies fms:DeletePolicy. CONDITIONAL(service_state) if admin_account_id is not
    populated during collection.
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, ?fms_policy) [fms:DeletePolicy]
  false_positive_note: "This is a DESTRUCTIVE COVER-TRACKS primitive only \u2014 permanent removal with\
    \ maximum organizational impact. Deleting a policy does NOT grant a session, credentials, or IAM permissions\
    \ in any member account. Do NOT chain this edge to CanEnterAccount, CanExecuteAs, CanEscalateTo, or\
    \ any escalation edge.\nScope guard: fms:DeletePolicy is only effective from the designated FMS administrator\
    \ account \u2014 the same action from a non-admin account is rejected by the FMS service. Confirm\
    \ ?principal.account == ?fms_policy.admin_account_id before emitting ACTIVE; downgrade to CONDITIONAL(service_state)\
    \ if admin account designation is unknown at collection time.\nHigher impact than fms:PutPolicy: Deletion\
    \ is permanent and stops all enforcement immediately, whereas PutPolicy allows an attacker to leave\
    \ the policy in place (and thus discoverable) while gutting its rules. DeletePolicy is the strongest\
    \ evasion action."
  narrative: '{principal.name} can permanently delete the Firewall Manager policy {fms_policy.name} (fms:DeletePolicy),
    eliminating org-wide {fms_policy.PolicyType} enforcement from all in-scope accounts ({policy_scope}).
    This is an irreversible destructive cover-tracks action that eliminates a preventive control at organizational
    scale. It does NOT grant resource access, credentials, or execution sessions in any member account.'