aws-macie-disable-evasion

Disabling Macie (macie2:DisableMacie) permanently disables the service, deletes all configurations and findings, and removes sensitive-data classification from the account - a weaken-defenses / cover-tracks / destructive primitive.

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?macie_session`
permissions	`macie2:DisableMacie`
state logic	if effective_permission includes macie2:DisableMacie and no SCP/boundary denies it: ACTIVE else BLOCKED

source type

Identity

target type

SecurityService

source

?principal

target

?macie_session

permissions

macie2:DisableMacie

state logic

if effective_permission includes macie2:DisableMacie and no SCP/boundary denies it: ACTIVE else BLOCKED

Narrative

{principal.name} can permanently disable Amazon Macie (macie2:DisableMacie), eliminating sensitive-data classification and finding generation in {macie_session.account}. This removes a detective control and reduces the likelihood that S3 exfiltration or credential exposure will be detected - a cover-tracks / weaken-defenses primitive.

Raw rule rules/derived/aws/macie.yaml

id: aws-macie-disable-evasion
emits: CanDelete
description: "Disabling Macie (macie2:DisableMacie) permanently disables the service, deletes all configurations\
  \ and findings, and removes sensitive-data classification from the account \u2014 a weaken-defenses\
  \ / cover-tracks / destructive primitive."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - macie_session: null
where:
- node_type(?macie_session) == SecurityService
- ?macie_session.provider_type == 'AWS::Macie::Session'
- effective_permission(?principal, ?macie_session) contains 'macie2:DisableMacie'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?macie_session
  permissions:
  - macie2:DisableMacie
  state_logic: 'if effective_permission includes macie2:DisableMacie and no SCP/boundary denies it: ACTIVE
    else BLOCKED'
  confidence: '0.95'
  derived_from:
  - ?principal HasPermission ?macie_session
  false_positive_note: This is a DESTRUCTIVE EVASION primitive only. Disabling Macie permanently removes
    detective coverage and deletes findings; it does NOT grant access to S3, IAM, or any other resource.
    Do NOT chain this edge to CanExecuteAs, CanEnterAccount, or any escalation edge. Downgrade to BLOCKED
    if an SCP denies macie2:DisableMacie at the org level.
  narrative: "{principal.name} can permanently disable Amazon Macie (macie2:DisableMacie), eliminating\
    \ sensitive-data classification and finding generation in {macie_session.account}. This removes a\
    \ detective control and reduces the likelihood that S3 exfiltration or credential exposure will be\
    \ detected \u2014 a cover-tracks / weaken-defenses primitive."