aws-opensearch-delete-data-via-http-delete
Principal with es:ESHttpDelete on the domain can delete documents and indices (destructive impact, not escalation).
match (effective permission)
{
"action": "es:ESHttpDelete",
"resource_type": "AWS::OpenSearchService::Domain"
}
where
domain access policy does not explicitly deny the action for this principal
emit
| source type | Identity |
|---|---|
| target type | SearchService |
| source | <principal> |
| target | <OpenSearch domain (SearchService)> |
| permissions | es:ESHttpDelete |
| conditions | iam_permission resource_policy network_reachability |
| state logic | ACTIVE when the principal has effective es:ESHttpDelete on the domain ARN AND the domain access policy grants it AND network reach is confirmed. CONDITIONAL(network_reachability) for VPC domains. Inherits conditions from CanReadData. BLOCKED if either policy explicitly denies the action. |
Narrative
{principal.name} can delete documents and indices from OpenSearch domain {domain.name} (es:ESHttpDelete), causing data loss and potential denial of service to applications querying the indices.
Raw rule rules/derived/aws/opensearch.yaml
id: aws-opensearch-delete-data-via-http-delete
emits: CanDeleteData
description: Principal with es:ESHttpDelete on the domain can delete documents and indices (destructive
impact, not escalation).
match_effective_permission:
action: es:ESHttpDelete
resource_type: AWS::OpenSearchService::Domain
where:
- domain access policy does not explicitly deny the action for this principal
emit:
source_type: Identity
target_type: SearchService
source: <principal>
target: <OpenSearch domain (SearchService)>
permissions:
- es:ESHttpDelete
conditions:
- iam_permission
- resource_policy
- network_reachability
state_logic: ACTIVE when the principal has effective es:ESHttpDelete on the domain ARN AND the domain
access policy grants it AND network reach is confirmed. CONDITIONAL(network_reachability) for VPC
domains. Inherits conditions from CanReadData. BLOCKED if either policy explicitly denies the action.
false_positive_note: 'CanDeleteData is not a traversal edge (walkable: false) and is not part of escalation
paths; it represents destructive capability only. Include in impact reports but do not follow in privilege
escalation chains.'
narrative: '{principal.name} can delete documents and indices from OpenSearch domain {domain.name} (es:ESHttpDelete),
causing data loss and potential denial of service to applications querying the indices.'