aws-networkfirewall-disable-logging

Disable or modify the firewall's logging configuration, removing evidence of network traffic inspection, rule violations, and IPS alerts (cover tracks).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Firewall`
source	`?principal`
target	`?firewall`
permissions	`network-firewall:UpdateLoggingConfiguration`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the effective-permission evaluator confirms network-firewall:UpdateLoggingConfiguration on the Firewall ARN. BLOCKED if an SCP or permission boundary denies the action on the firewall ARN.

source type

Identity

target type

Firewall

source

?principal

target

?firewall

permissions

network-firewall:UpdateLoggingConfiguration

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when the effective-permission evaluator confirms network-firewall:UpdateLoggingConfiguration on the Firewall ARN. BLOCKED if an SCP or permission boundary denies the action on the firewall ARN.

Narrative

{principal.name} can modify the logging configuration for the firewall {firewall.name} (network-firewall:UpdateLoggingConfiguration), disabling delivery of flow logs and alert logs to CloudWatch Logs, S3, or Kinesis Firehose. An attacker can silently erase evidence of network traffic inspection, IPS rule violations, and firewall-rule-change audit trails, covering their tracks in a defense-evasion attack. This is a cover-tracks action, not a rule-weakening action.

Raw rule rules/derived/aws/networkfirewall.yaml

id: aws-networkfirewall-disable-logging
emits: CanModifyConfiguration
description: Disable or modify the firewall's logging configuration, removing evidence of network traffic
  inspection, rule violations, and IPS alerts (cover tracks).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - firewall: null
where:
- node_type(?firewall) == Firewall
- ?firewall.provider_type == 'AWS::NetworkFirewall::Firewall'
- effective_action_on(?principal, ?firewall) intersects ['network-firewall:UpdateLoggingConfiguration']
emit:
  source_type: Identity
  target_type: Firewall
  source: ?principal
  target: ?firewall
  permissions:
  - network-firewall:UpdateLoggingConfiguration
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the effective-permission evaluator confirms network-firewall:UpdateLoggingConfiguration
    on the Firewall ARN. BLOCKED if an SCP or permission boundary denies the action on the firewall ARN.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?firewall) [network-firewall:UpdateLoggingConfiguration]
  false_positive_note: "This is a COVER-TRACKS / DEFENSE-EVASION primitive. Disabling firewall logging\
    \ removes flow logs and alert logs but does NOT alter firewall filtering rules or grant access to\
    \ resources behind the firewall. The attacker must already have network access to a target; this action\
    \ only removes the evidence trail. Confidence 0.85 (effect is operational evasion, not rule-set weakening).\n\
    Do NOT chain this edge to CanEnterAccount, CanExecuteAs, CanNetworkReach, or CanEscalateTo.\nScope\
    \ guards: - network-firewall:UpdateLoggingConfiguration targets a Firewall ARN. - This action disables\
    \ flow log and alert log delivery to CloudWatch Logs,\n  S3, or Kinesis Firehose; VPC Flow Logs (ec2:*)\
    \ are separate and not affected\n  by Network Firewall logging configuration."
  narrative: '{principal.name} can modify the logging configuration for the firewall {firewall.name} (network-firewall:UpdateLoggingConfiguration),
    disabling delivery of flow logs and alert logs to CloudWatch Logs, S3, or Kinesis Firehose. An attacker
    can silently erase evidence of network traffic inspection, IPS rule violations, and firewall-rule-change
    audit trails, covering their tracks in a defense-evasion attack. This is a cover-tracks action, not
    a rule-weakening action.'