aws-networkfirewall-swap-policy

Swap the policy associated with a firewall to a permissive alternative, weakening or eliminating VPC traffic filtering (defense evasion).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'firewall': None}

where

node_type(?firewall) == Firewall ?firewall.provider_type == 'AWS::NetworkFirewall::Firewall' effective_action_on(?principal, ?firewall) intersects ['network-firewall:AssociateFirewallPolicy']

emit

source type	`Identity`
target type	`Firewall`
source	`?principal`
target	`?firewall`
permissions	`network-firewall:AssociateFirewallPolicy`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	ACTIVE when the effective-permission evaluator confirms network-firewall:AssociateFirewallPolicy on the Firewall ARN AND the Firewall does NOT have UpdateFirewallPolicyChangeProtection set to true (or the principal can toggle it via network-firewall:UpdateFirewallPolicyChangeProtection). CONDITIONAL(service_state) if UpdateFirewallPolicyChangeProtection is true on the target Firewall AND the principal does NOT also hold network-firewall:UpdateFirewallPolicyChangeProtection — the association will fail with 403 Forbidden by the API in that state. BLOCKED if an SCP or permission boundary denies the matching action(s).

Narrative

{principal.name} can swap the policy associated with the firewall {firewall.name} (network-firewall:AssociateFirewallPolicy), replacing it with a permissive policy without disrupting the firewall's operational presence. An attacker can apply a policy with default action PASS or remove blocking rule groups, silently opening network paths through the VPC firewall. This is a weaken-controls / defense-evasion action, not an access grant.

Raw rule rules/derived/aws/networkfirewall.yaml

id: aws-networkfirewall-swap-policy
emits: CanModifyConfiguration
description: Swap the policy associated with a firewall to a permissive alternative, weakening or eliminating
  VPC traffic filtering (defense evasion).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - firewall: null
where:
- node_type(?firewall) == Firewall
- ?firewall.provider_type == 'AWS::NetworkFirewall::Firewall'
- effective_action_on(?principal, ?firewall) intersects ['network-firewall:AssociateFirewallPolicy']
emit:
  source_type: Identity
  target_type: Firewall
  source: ?principal
  target: ?firewall
  permissions:
  - network-firewall:AssociateFirewallPolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when the effective-permission evaluator confirms network-firewall:AssociateFirewallPolicy\
    \ on the Firewall ARN AND the Firewall does NOT have UpdateFirewallPolicyChangeProtection set to true\
    \ (or the principal can toggle it via network-firewall:UpdateFirewallPolicyChangeProtection). CONDITIONAL(service_state)\
    \ if UpdateFirewallPolicyChangeProtection is true on the target Firewall AND the principal does NOT\
    \ also hold network-firewall:UpdateFirewallPolicyChangeProtection \u2014 the association will fail\
    \ with 403 Forbidden by the API in that state. BLOCKED if an SCP or permission boundary denies the\
    \ matching action(s)."
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?firewall) [network-firewall:AssociateFirewallPolicy]
  false_positive_note: "This is a DEFENSE-EVASION primitive only. Swapping a firewall policy changes which\
    \ traffic the Network Firewall allows or blocks; it does NOT grant access to any resource behind the\
    \ firewall, nor does it yield IAM credentials or execution sessions. Do NOT chain this edge to CanEnterAccount,\
    \ CanExecuteAs, CanNetworkReach, or CanEscalateTo.\nEnd-to-end network reachability (policy weakened\
    \ + VPC route routes through the firewall endpoint + target SG permits traffic) is the FUTURE network-chains\
    \ linchpin. Emit CanModifyConfiguration (this FACT) now; the composition is deferred.\nScope guards:\
    \ - network-firewall:AssociateFirewallPolicy targets a Firewall ARN and requires\n  the caller to\
    \ also reference a replacement policy ARN; the replacement policy\n  must exist and be accessible.\n\
    - UpdateFirewallPolicyChangeProtection=true blocks AssociateFirewallPolicy\n  (403 from the API).\
    \ If the principal holds only AssociateFirewallPolicy and\n  the flag is set (and the principal cannot\
    \ clear it), downgrade to\n  CONDITIONAL(service_state)."
  narrative: '{principal.name} can swap the policy associated with the firewall {firewall.name} (network-firewall:AssociateFirewallPolicy),
    replacing it with a permissive policy without disrupting the firewall''s operational presence. An
    attacker can apply a policy with default action PASS or remove blocking rule groups, silently opening
    network paths through the VPC firewall. This is a weaken-controls / defense-evasion action, not an
    access grant.'