aws-networkfirewall-weaken-policy-update

Modify the firewall policy directly (change default action to PASS, remove blocking rule groups), weakening or eliminating VPC traffic filtering (defense evasion).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'policy': None}

where

node_type(?policy) == Firewall ?policy.provider_type == 'AWS::NetworkFirewall::FirewallPolicy' effective_action_on(?principal, ?policy) intersects ['network-firewall:UpdateFirewallPolicy']

emit

source type	`Identity`
target type	`Firewall`
source	`?principal`
target	`?policy`
permissions	`network-firewall:UpdateFirewallPolicy`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	ACTIVE when the effective-permission evaluator confirms network-firewall:UpdateFirewallPolicy on the FirewallPolicy ARN and the target policy is not managed by AWS Firewall Manager with auto-remediation active. BLOCKED if an SCP or permission boundary denies the action on the policy ARN. CONDITIONAL(service_state) if the target policy is managed by AWS Firewall Manager and FMS auto-remediation is confirmed active.

Narrative

{principal.name} can modify the firewall policy {policy.name} (network-firewall:UpdateFirewallPolicy), changing rule group references or the default traffic action to allow previously-blocked traffic. An attacker can set the default action to aws:pass or remove DROP/REJECT rule group references, silently opening network paths through the VPC firewall without disrupting its operational presence. This is a weaken-controls / defense-evasion action, not an access grant.

Raw rule rules/derived/aws/networkfirewall.yaml

id: aws-networkfirewall-weaken-policy-update
emits: CanModifyConfiguration
description: Modify the firewall policy directly (change default action to PASS, remove blocking rule
  groups), weakening or eliminating VPC traffic filtering (defense evasion).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - policy: null
where:
- node_type(?policy) == Firewall
- ?policy.provider_type == 'AWS::NetworkFirewall::FirewallPolicy'
- effective_action_on(?principal, ?policy) intersects ['network-firewall:UpdateFirewallPolicy']
emit:
  source_type: Identity
  target_type: Firewall
  source: ?principal
  target: ?policy
  permissions:
  - network-firewall:UpdateFirewallPolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: ACTIVE when the effective-permission evaluator confirms network-firewall:UpdateFirewallPolicy
    on the FirewallPolicy ARN and the target policy is not managed by AWS Firewall Manager with auto-remediation
    active. BLOCKED if an SCP or permission boundary denies the action on the policy ARN. CONDITIONAL(service_state)
    if the target policy is managed by AWS Firewall Manager and FMS auto-remediation is confirmed active.
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?policy) [network-firewall:UpdateFirewallPolicy]
  false_positive_note: "This is a DEFENSE-EVASION primitive only. Modifying a firewall policy changes\
    \ which traffic the Network Firewall allows or blocks; it does NOT grant access to any resource behind\
    \ the firewall, nor does it yield IAM credentials or execution sessions. Do NOT chain this edge to\
    \ CanEnterAccount, CanExecuteAs, CanNetworkReach, or CanEscalateTo.\nEnd-to-end network reachability\
    \ (policy weakened + VPC route routes through the firewall endpoint + target SG permits traffic) is\
    \ the FUTURE network-chains linchpin. Emit CanModifyConfiguration (this FACT) now; the composition\
    \ is deferred.\nScope guards: - network-firewall:UpdateFirewallPolicy targets a FirewallPolicy ARN.\
    \ - UpdateFirewallPolicyChangeProtection (a Firewall node property) does NOT\n  block UpdateFirewallPolicy\
    \ \u2014 it modifies the policy object directly.\n- FMS-managed policies: AWS Firewall Manager auto-remediates\
    \ out-of-band\n  changes to FMS-controlled policies within seconds. In environments with\n  active\
    \ FMS management, the practical window for persistence is negligible;\n  downgrade to CONDITIONAL(service_state)\
    \ or BLOCKED when FMS auto-remediation\n  is confirmed active."
  narrative: '{principal.name} can modify the firewall policy {policy.name} (network-firewall:UpdateFirewallPolicy),
    changing rule group references or the default traffic action to allow previously-blocked traffic.
    An attacker can set the default action to aws:pass or remove DROP/REJECT rule group references, silently
    opening network paths through the VPC firewall without disrupting its operational presence. This is
    a weaken-controls / defense-evasion action, not an access grant.'