aws-kinesis-modify-resource-policy

kinesis:PutResourcePolicy on a stream grants the ability to rewrite the stream's resource policy, enabling privilege escalation via grant injection or cross-account access expansion.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Policy`
source	`?principal`
target	`<ResourcePolicy node for the stream's resource policy (or the stream itself if policy target is implicit)>`
permissions	`kinesis:PutResourcePolicy`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when kinesis:PutResourcePolicy is confirmed EFFECTIVE on the stream ARN (identity-based policy + no resource-policy deny + no SCP deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict the policy mutation. BLOCKED by an explicit deny on kinesis:PutResourcePolicy.

source type

Identity

target type

Policy

source

?principal

target

<ResourcePolicy node for the stream's resource policy (or the stream itself if policy target is implicit)>

permissions

kinesis:PutResourcePolicy

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when kinesis:PutResourcePolicy is confirmed EFFECTIVE on the stream ARN (identity-based policy + no resource-policy deny + no SCP deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict the policy mutation. BLOCKED by an explicit deny on kinesis:PutResourcePolicy.

Narrative

{principal.name} has kinesis:PutResourcePolicy on {stream.name} and can rewrite its resource policy. By injecting new grants, the principal can escalate privileges (e.g., grant themselves kinesis:PutRecord or a foreign account cross-account access), feeding downstream escalation chains.

Raw rule rules/derived/aws/kinesis.yaml

id: aws-kinesis-modify-resource-policy
emits: CanModifyPolicy
description: kinesis:PutResourcePolicy on a stream grants the ability to rewrite the stream's resource
  policy, enabling privilege escalation via grant injection or cross-account access expansion.
match:
- - principal: null
  - HasPermission
  - stream: null
where:
- node_type(?stream) == GenericMessaging
- ?stream.provider_type == 'AWS::Kinesis::Stream'
- ?principal has EFFECTIVE kinesis:PutResourcePolicy on ?stream ARN
emit:
  source_type: Identity
  target_type: Policy
  source: ?principal
  target: <ResourcePolicy node for the stream's resource policy (or the stream itself if policy target
    is implicit)>
  permissions:
  - kinesis:PutResourcePolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when kinesis:PutResourcePolicy is confirmed EFFECTIVE on the stream ARN (identity-based
    policy + no resource-policy deny + no SCP deny). CONDITIONAL (scp_or_org_policy) when an SCP may restrict
    the policy mutation. BLOCKED by an explicit deny on kinesis:PutResourcePolicy.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal HasPermission ?stream (kinesis:PutResourcePolicy effective permission)
  false_positive_note: "Confirm that kinesis:PutResourcePolicy is EFFECTIVE on the stream ARN; like all\
    \ API permissions, it is subject to resource policy, permission boundaries, and SCPs. This edge asserts\
    \ the ability to REWRITE the stream's resource policy \u2014 the concrete escalation consequences\
    \ (granting themselves PutRecord, granting a foreign account PutRecord/GetRecords, etc.) are rolled\
    \ up by downstream rules (messaging-chains rules 1-2 + can-control, credential-chains, data-plane)."
  narrative: '{principal.name} has kinesis:PutResourcePolicy on {stream.name} and can rewrite its resource
    policy. By injecting new grants, the principal can escalate privileges (e.g., grant themselves kinesis:PutRecord
    or a foreign account cross-account access), feeding downstream escalation chains.'