aws-networkfirewall-weaken-rule-group

id: aws-networkfirewall-weaken-rule-group
emits: CanModifyConfiguration
description: Modify or delete a customer-managed Network Firewall rule group to remove or corrupt 5-tuple/Suricata
  DROP/REJECT rules, opening traffic paths across all firewall policies that reference the group (defense
  evasion; blast radius scales with rule group reuse and RAM sharing).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - rulegroup: null
where:
- node_type(?rulegroup) == Firewall
- ?rulegroup.provider_type in ['AWS::NetworkFirewall::RuleGroup']
- "effective_action_on(?principal, ?rulegroup) intersects ['network-firewall:UpdateRuleGroup',\n 'network-firewall:DeleteRuleGroup']"
- ?rulegroup.managed_by != 'AWS'
emit:
  source_type: Identity
  target_type: Firewall
  source: ?principal
  target: ?rulegroup
  permissions:
  - network-firewall:UpdateRuleGroup
  - network-firewall:DeleteRuleGroup
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when network-firewall:UpdateRuleGroup is confirmed effective on the rule group\
    \ ARN. CONDITIONAL(service_state) for network-firewall:DeleteRuleGroup if the group is currently referenced\
    \ by one or more active firewall policies AND the principal does NOT also hold network-firewall:UpdateFirewallPolicy\
    \ to remove the references first \u2014 deletion will fail with ConflictException in that state. BLOCKED\
    \ if an SCP or permission boundary denies the action(s) on the rule group ARN."
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?rulegroup) [network-firewall:UpdateRuleGroup OR network-firewall:DeleteRuleGroup]
  false_positive_note: "Customer-managed rule groups ONLY. AWS-managed rule groups (e.g., those provided\
    \ by AWS Managed Threat Intelligence feeds via the Network Firewall console) cannot be updated or\
    \ deleted via customer IAM actions \u2014 do not emit for those. Guard: check ?rulegroup.managed_by\
    \ != 'AWS'.\nThis is a DEFENSE-EVASION primitive only. Removing DROP rules from a rule group or deleting\
    \ the group opens traffic paths that were previously blocked; it does NOT grant access to the resources\
    \ receiving that traffic, nor does it yield IAM credentials or execution sessions. Do NOT chain to\
    \ CanEnterAccount, CanExecuteAs, CanNetworkReach, or CanEscalateTo.\nBlast radius: a rule group referenced\
    \ by N policies in M accounts (via RAM) is a higher-priority finding. Note reuse count in evidence\
    \ metadata; do not spawn separate edges per consuming policy (path-finding handles fan-out).\nDeleteRuleGroup\
    \ vs. UpdateRuleGroup: deletion is the louder, more disruptive action (and fails if the group is still\
    \ referenced by policies); UpdateRuleGroup is the stealthier tactic (group stays present, rules are\
    \ quietly neutered). Both map to the same CanModifyConfiguration edge type at the same confidence.\n\
    RAM-shared rule groups: if the rule group was shared from another account via RAM and the principal\
    \ holds network-firewall:UpdateRuleGroup on the shared ARN (confirmed by the resource policy), the\
    \ blast radius spans the originating account and all RAM consumers. Note this in evidence but emit\
    \ a single edge to the rule group node."
  narrative: "{principal.name} can modify or delete the rule group {rulegroup.name} (network-firewall:UpdateRuleGroup\
    \ / network-firewall:DeleteRuleGroup). Every firewall policy that references this rule group \u2014\
    \ potentially across multiple firewalls and accounts (if RAM-shared) \u2014 would lose or have corrupted\
    \ the 5-tuple or Suricata rules it provides, silently opening previously-blocked traffic paths through\
    \ the associated VPC firewalls. This is a weaken-controls / defense-evasion action, not an access\
    \ grant."