aws-gd-delete-detector

Delete the GuardDuty detector, permanently eliminating threat detection in the account/region.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?detector`
permissions	`guardduty:DeleteDetector`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds the effective guardduty:DeleteDetector permission (subject to SCPs and permission boundaries). BLOCKED if an SCP or deny policy explicitly denies guardduty:DeleteDetector.

source type

Identity

target type

SecurityService

source

?principal

target

?detector

permissions

guardduty:DeleteDetector

conditions

iam_permission

state logic

ACTIVE when ?principal holds the effective guardduty:DeleteDetector permission (subject to SCPs and permission boundaries). BLOCKED if an SCP or deny policy explicitly denies guardduty:DeleteDetector.

Narrative

{principal.name} can permanently delete the GuardDuty detector {detector.name} (guardduty:DeleteDetector), eliminating all threat detection in this account/region. Subsequent attacker activity will not generate GuardDuty findings, reducing detection probability.

Raw rule rules/derived/aws/guardduty.yaml

id: aws-gd-delete-detector
emits: CanDelete
description: Delete the GuardDuty detector, permanently eliminating threat detection in the account/region.
match:
- - principal: null
  - HasPermission
  - detector: null
where:
- node_type(?detector) == SecurityService
- ?detector.provider_type == 'AWS::GuardDuty::Detector'
- ?principal has EFFECTIVE guardduty:DeleteDetector on ?detector
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?detector
  permissions:
  - guardduty:DeleteDetector
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds the effective guardduty:DeleteDetector permission (subject
    to SCPs and permission boundaries). BLOCKED if an SCP or deny policy explicitly denies guardduty:DeleteDetector.
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, guardduty:DeleteDetector, ?detector)
  false_positive_note: This is purely a destructive / cover-tracks primitive. Deleting the detector does
    NOT grant the principal any additional permissions, access to data, or the ability to execute code.
    Do not chain to CanExecuteAs, CanEnterAccount, or any escalation edge. The security impact is loss
    of detective coverage in this account/region, not a privilege gain. An SCP denying guardduty:DeleteDetector
    makes this BLOCKED and is a meaningful preventive control.
  narrative: '{principal.name} can permanently delete the GuardDuty detector {detector.name} (guardduty:DeleteDetector),
    eliminating all threat detection in this account/region. Subsequent attacker activity will not generate
    GuardDuty findings, reducing detection probability.'