aws-inspector-disable-org-scanning

Delegated-administrator account principal with inspector2:Disable can disable scanning for any/all organization member accounts simultaneously, stopping CVE detection across the entire AWS Organization from a single API call.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'inspector_service': None}

where

node_type(?inspector_service) == SecurityService ?inspector_service.provider_type == 'AWS::InspectorV2::Service' ?inspector_service.scope == 'organization' effective_permission(?principal, 'inspector2:Disable', ?inspector_service) principal_account_is_delegated_admin(?principal, ?inspector_service)

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?inspector_service`
permissions	`inspector2:Disable`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when ?principal holds effective inspector2:Disable AND the principal's account is confirmed as the delegated-admin account (GetDelegatedAdminAccount confirms relationship). CONDITIONAL(service_state) if delegated-admin relationship cannot be confirmed. BLOCKED if SCP denies inspector2:Disable or if delegated-admin assignment is revoked.

Narrative

{principal.name} in the Inspector delegated-administrator account can call inspector2:Disable with member_account_ids to disable scanning for any or all organization member accounts, stopping CVE and network-exposure detection across the entire AWS Organization simultaneously. This is the highest-impact Inspector evasion primitive - one API call removes detection coverage from dozens of accounts. It is a defense-evasion / cover-tracks capability only.

Raw rule rules/derived/aws/inspector.yaml

id: aws-inspector-disable-org-scanning
emits: CanModifyConfiguration
description: Delegated-administrator account principal with inspector2:Disable can disable scanning for
  any/all organization member accounts simultaneously, stopping CVE detection across the entire AWS Organization
  from a single API call.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - inspector_service: null
where:
- node_type(?inspector_service) == SecurityService
- ?inspector_service.provider_type == 'AWS::InspectorV2::Service'
- ?inspector_service.scope == 'organization'
- effective_permission(?principal, 'inspector2:Disable', ?inspector_service)
- principal_account_is_delegated_admin(?principal, ?inspector_service)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?inspector_service
  permissions:
  - inspector2:Disable
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when ?principal holds effective inspector2:Disable AND the principal's account is
    confirmed as the delegated-admin account (GetDelegatedAdminAccount confirms relationship). CONDITIONAL(service_state)
    if delegated-admin relationship cannot be confirmed. BLOCKED if SCP denies inspector2:Disable or if
    delegated-admin assignment is revoked.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?inspector_service) [inspector2:Disable]
  - service_state(delegated_admin_relationship_active)
  evasion_only: true
  false_positive_note: "This path requires the principal's account to be the active delegated-admin for\
    \ Inspector. It is the highest-impact Inspector evasion primitive: disabling scanning in member accounts\
    \ from the admin account via a single inspector2:Disable call with member_account_ids parameter. This\
    \ is organizational scope evasion only, NOT CanEnterAccount or privilege escalation. The affected\
    \ member accounts do not gain access to the attacker \u2014 their scanning is merely disabled at the\
    \ administrator's direction."
  narrative: "{principal.name} in the Inspector delegated-administrator account can call inspector2:Disable\
    \ with member_account_ids to disable scanning for any or all organization member accounts, stopping\
    \ CVE and network-exposure detection across the entire AWS Organization simultaneously. This is the\
    \ highest-impact Inspector evasion primitive \u2014 one API call removes detection coverage from dozens\
    \ of accounts. It is a defense-evasion / cover-tracks capability only."