aws-fms-tamper-notification-channel

A principal with fms:PutNotificationChannel can replace the SNS topic that receives FMS compliance notifications, redirecting or suppressing alerts about policy violations. This silences detective coverage without removing enforcement.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?fms_service`
permissions	`fms:PutNotificationChannel`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when principal holds effective fms:PutNotificationChannel AND principal.account matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:PutNotificationChannel. CONDITIONAL(service_state) if admin account is unknown.

source type

Identity

target type

SecurityService

source

?principal

target

?fms_service

permissions

fms:PutNotificationChannel

conditions

iam_permission service_state

state logic

ACTIVE when principal holds effective fms:PutNotificationChannel AND principal.account matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:PutNotificationChannel. CONDITIONAL(service_state) if admin account is unknown.

Narrative

{principal.name} can replace the SNS notification channel for Firewall Manager compliance alerts (fms:PutNotificationChannel). This silences notifications of FMS policy violations across all in-scope accounts, enabling evasion from detective tooling while preventive controls remain active in member accounts.

Raw rule rules/derived/aws/firewallmanager.yaml

id: aws-fms-tamper-notification-channel
emits: CanModifyConfiguration
description: A principal with fms:PutNotificationChannel can replace the SNS topic that receives FMS compliance
  notifications, redirecting or suppressing alerts about policy violations. This silences detective coverage
  without removing enforcement.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - fms_service: null
where:
- node_type(?fms_service) == SecurityService
- ?fms_service.provider_type == 'AWS::FMS::NotificationChannel'
- effective_permission(?principal, ?fms_service) contains 'fms:PutNotificationChannel'
- ?principal.account == ?fms_service.admin_account_id
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?fms_service
  permissions:
  - fms:PutNotificationChannel
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when principal holds effective fms:PutNotificationChannel AND principal.account
    matches the FMS admin account. BLOCKED when an SCP or permission boundary denies fms:PutNotificationChannel.
    CONDITIONAL(service_state) if admin account is unknown.
  confidence: 0.8
  derived_from:
  - HasPermission(?principal, ?fms_service) [fms:PutNotificationChannel]
  false_positive_note: "This is a SECONDARY EVASION primitive \u2014 it silences detective alerts but\
    \ does NOT remove preventive enforcement. Compliance violations remain and can be discovered via fms:ListComplianceStatus;\
    \ the attacker simply suppresses the SNS notification that would alert operators. This is weaker than\
    \ policy tampering and does NOT grant resource access or IAM permissions. Do NOT chain to CanEnterAccount,\
    \ CanExecuteAs, or CanEscalateTo. Lowered confidence (0.80) reflects secondary nature (alerts suppressed\
    \ but enforcement persists)."
  narrative: '{principal.name} can replace the SNS notification channel for Firewall Manager compliance
    alerts (fms:PutNotificationChannel). This silences notifications of FMS policy violations across all
    in-scope accounts, enabling evasion from detective tooling while preventive controls remain active
    in member accounts.'