aws-inspector-disable-scanning

id: aws-inspector-disable-scanning
emits: CanModifyConfiguration
description: "Principal with inspector2:Disable can stop vulnerability scanning in the account (or designated\
  \ member accounts from delegated-admin), removing continuous CVE and network-exposure detection \u2014\
  \ a defense-evasion primitive."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - inspector_service: null
where:
- node_type(?inspector_service) == SecurityService
- ?inspector_service.provider_type == 'AWS::InspectorV2::Service'
- ?inspector_service.scope == 'account' OR ?inspector_service.scope == 'account-member'
- effective_permission(?principal, 'inspector2:Disable', ?inspector_service)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?inspector_service
  permissions:
  - inspector2:Disable
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective inspector2:Disable and no SCP denies it. BLOCKED
    if an SCP or permission boundary denies inspector2:Disable at the effective scope.
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?inspector_service) [inspector2:Disable]
  evasion_only: true
  false_positive_note: "This is a pure defense-evasion primitive \u2014 it reduces detection coverage,\
    \ it does NOT grant access to any resource or enable privilege escalation. Do NOT chain this edge\
    \ to CanEnterAccount, CanExecuteAs, or any escalation objective. An SCP denying inspector2:Disable\
    \ at the organizational level should set state BLOCKED. The delegated-administrator scope (disabling\
    \ scanning in member accounts) is an Inspector-management capability, not account entry; do NOT emit\
    \ CanEnterAccount for that case."
  narrative: "{principal.name} can call inspector2:Disable on {inspector_service.name}, stopping all vulnerability\
    \ scanning (EC2, Lambda, ECR) for this AWS account. This removes continuous CVE and network-exposure\
    \ detection, reducing the likelihood that attacker activity is flagged \u2014 a defense-evasion /\
    \ cover-tracks capability. It grants no resource access or privilege escalation."