aws-fms-modify-policy

id: aws-fms-modify-policy
emits: CanModifyConfiguration
description: "A principal with fms:PutPolicy can overwrite an existing Firewall Manager policy with an\
  \ empty or permissive rule set, or set RemediationEnabled=false, disabling org-wide enforcement of WAF/Shield/Security\
  \ Group/Network Firewall/ DNS Firewall controls across all in-scope member accounts \u2014 a high-blast-radius\
  \ defense-evasion / cover-tracks primitive. The policy object persists; enforcement is weakened but\
  \ not destroyed."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - fms_policy: null
where:
- node_type(?fms_policy) == SecurityService
- ?fms_policy.provider_type == 'AWS::FMS::Policy'
- effective_permission(?principal, ?fms_policy) contains 'fms:PutPolicy'
- ?principal.account == ?fms_policy.admin_account_id
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?fms_policy
  permissions:
  - fms:PutPolicy
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when principal holds effective fms:PutPolicy permission on the target policy ARN
    AND principal.account matches the policy's admin_account_id. BLOCKED when an SCP or permission boundary
    explicitly denies fms:PutPolicy. CONDITIONAL(service_state) if admin_account_id is not populated during
    collection.
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?fms_policy) [fms:PutPolicy]
  false_positive_note: "This is a DEFENSE EVASION primitive only. Overwriting a Firewall Manager policy\
    \ weakens org-wide preventive firewall/WAF/Shield/Network Firewall enforcement; it does NOT grant\
    \ a session, credentials, or IAM permissions in any member account. Do NOT chain this edge to CanEnterAccount,\
    \ CanExecuteAs, CanEscalateTo, or any escalation edge.\nScope guard: fms:PutPolicy is only effective\
    \ from the designated FMS administrator account \u2014 the same action from a non-admin account is\
    \ rejected by the FMS service. Confirm ?principal.account == ?fms_policy.admin_account_id before emitting\
    \ ACTIVE; downgrade to CONDITIONAL(service_state) if admin account designation is unknown at collection\
    \ time.\nWeaker variant: fms:PutPolicy with only RemediationEnabled=false stops auto-remediation but\
    \ leaves existing resource-level rules intact (member accounts can drift out of compliance but are\
    \ not actively reconfigured). If collection detects RemediationEnabled=false is toggled without rule\
    \ mutation, downgrade confidence to 0.80 in the edge evidence record."
  narrative: "{principal.name} can overwrite the Firewall Manager policy {fms_policy.name} (fms:PutPolicy),\
    \ which enforces {fms_policy.PolicyType} rules across all in-scope AWS accounts in the organization.\
    \ Replacing the policy with an empty or permissive rule set \u2014 or setting RemediationEnabled=false\
    \ \u2014 disables org-wide preventive firewall/WAF/Shield/Network Firewall/DNS Firewall enforcement\
    \ in every member account in scope. This is a high-blast-radius defense-evasion / cover-tracks primitive\
    \ that weakens preventive controls at organizational scale. It grants no resource access, credentials,\
    \ or execution sessions in any member account."