aws-macie-pause-evasion

Pausing Macie (macie2:UpdateMacieSession with status=PAUSED) temporarily stops sensitive-data classification and finding generation from the account without deleting configurations or findings - a weaken-defenses / cover-tracks primitive.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?macie_session`
permissions	`macie2:UpdateMacieSession`
state logic	if effective_permission includes macie2:UpdateMacieSession and no SCP/boundary denies it and ?macie_session.status == ENABLED: CONDITIONAL else BLOCKED

source type

Identity

target type

SecurityService

source

?principal

target

?macie_session

permissions

macie2:UpdateMacieSession

state logic

if effective_permission includes macie2:UpdateMacieSession and no SCP/boundary denies it and ?macie_session.status == ENABLED: CONDITIONAL else BLOCKED

Narrative

{principal.name} can pause Amazon Macie (macie2:UpdateMacieSession), suspending sensitive-data classification and finding generation in {macie_session.account} without permanently deleting configurations. This removes a detective control and reduces the likelihood that S3 exfiltration or credential exposure will be detected - a cover-tracks / weaken-defenses primitive.

Raw rule rules/derived/aws/macie.yaml

id: aws-macie-pause-evasion
emits: CanModifyConfiguration
description: "Pausing Macie (macie2:UpdateMacieSession with status=PAUSED) temporarily stops sensitive-data\
  \ classification and finding generation from the account without deleting configurations or findings\
  \ \u2014 a weaken-defenses / cover-tracks primitive."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - macie_session: null
where:
- node_type(?macie_session) == SecurityService
- ?macie_session.provider_type == 'AWS::Macie::Session'
- effective_permission(?principal, ?macie_session) contains 'macie2:UpdateMacieSession'
- ?macie_session.status == 'ENABLED'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?macie_session
  permissions:
  - macie2:UpdateMacieSession
  state_logic: 'if effective_permission includes macie2:UpdateMacieSession and no SCP/boundary denies
    it and ?macie_session.status == ENABLED: CONDITIONAL else BLOCKED'
  confidence: '0.90'
  derived_from:
  - ?principal HasPermission ?macie_session
  false_positive_note: This is a CONDITIONAL EVASION primitive. macie2:UpdateMacieSession can change the
    status to PAUSED (stopping finding generation) or change the sampling rate (partial finding suppression).
    Only status=PAUSED or macie2:DisableMacie fully stops finding generation. If the principal can only
    change the sampling rate (not pause), this is CONDITIONAL, not ACTIVE. Do NOT chain this edge to CanExecuteAs,
    CanEnterAccount, or any escalation edge. Downgrade to BLOCKED if an SCP denies macie2:UpdateMacieSession
    at the org level.
  narrative: "{principal.name} can pause Amazon Macie (macie2:UpdateMacieSession), suspending sensitive-data\
    \ classification and finding generation in {macie_session.account} without permanently deleting configurations.\
    \ This removes a detective control and reduces the likelihood that S3 exfiltration or credential exposure\
    \ will be detected \u2014 a cover-tracks / weaken-defenses primitive."