aws-inspector-update-config

Principal with inspector2:UpdateConfiguration can modify scan settings (e.g., Lambda deep scan, ECR scanning toggle), affecting detection depth but not service enablement.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?inspector_service`
permissions	`inspector2:UpdateConfiguration`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds effective inspector2:UpdateConfiguration and no SCP denies it. BLOCKED if SCP or permission boundary denies inspector2:UpdateConfiguration.

source type

Identity

target type

SecurityService

source

?principal

target

?inspector_service

permissions

inspector2:UpdateConfiguration

conditions

iam_permission

state logic

ACTIVE when ?principal holds effective inspector2:UpdateConfiguration and no SCP denies it. BLOCKED if SCP or permission boundary denies inspector2:UpdateConfiguration.

Narrative

{principal.name} can call inspector2:UpdateConfiguration on {inspector_service.name} to toggle scan features (e.g., disable Lambda deep inspection or ECR scanning). This reduces scan depth but does not disable the service - scanning continues for enabled resource types.

Raw rule rules/derived/aws/inspector.yaml

id: aws-inspector-update-config
emits: CanModifyConfiguration
description: Principal with inspector2:UpdateConfiguration can modify scan settings (e.g., Lambda deep
  scan, ECR scanning toggle), affecting detection depth but not service enablement.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - inspector_service: null
where:
- node_type(?inspector_service) == SecurityService
- ?inspector_service.provider_type == 'AWS::InspectorV2::Service'
- effective_permission(?principal, 'inspector2:UpdateConfiguration', ?inspector_service)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?inspector_service
  permissions:
  - inspector2:UpdateConfiguration
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective inspector2:UpdateConfiguration and no SCP denies
    it. BLOCKED if SCP or permission boundary denies inspector2:UpdateConfiguration.
  confidence: 0.65
  derived_from:
  - HasPermission(?principal, ?inspector_service) [inspector2:UpdateConfiguration]
  evasion_only: true
  false_positive_note: 'inspector2:UpdateConfiguration affects scan depth (toggling Lambda deep inspection,
    ECR scanning toggle, etc.) but does NOT disable the service. This is a weaker evasion path than disable:
    scanning continues, but may skip deeper package analysis. Do NOT chain to CanExecuteAs or privilege
    escalation. Confidence is 0.65 (weaker impact than Disable) because the attacker only reduces scan
    depth, not detection capability entirely.'
  narrative: "{principal.name} can call inspector2:UpdateConfiguration on {inspector_service.name} to\
    \ toggle scan features (e.g., disable Lambda deep inspection or ECR scanning). This reduces scan depth\
    \ but does not disable the service \u2014 scanning continues for enabled resource types."