aws-opensearch-fgac-disable-escalation

A principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant all IAM-permitted principals cluster-admin data access.

derived aws emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<any IAM principal with es:ESHttp* on the domain>`
permissions	`es:UpdateDomainConfig`
conditions	`iam_permission` `service_state`
state logic	POTENTIAL when the principal has CanModifyConfiguration (es:UpdateDomainConfig) on a FGAC-enabled domain. The principal can invoke UpdateDomainConfig to set advancedSecurityOptions.enabled = false, removing all per-index authorization. After this configuration change, any principal with effective es:ESHttpGet / es:ESHttpPost / es:ESHttpPut on the domain ARN becomes a cluster admin (can read all indices without role mapping restrictions). Model as POTENTIAL because the attacker must first execute the UpdateDomainConfig call; this is not an implicit escalation but a deliberate action-sequence escalation.

source type

Identity

target type

Identity

source

<principal>

target

<any IAM principal with es:ESHttp* on the domain>

permissions

es:UpdateDomainConfig

conditions

iam_permission service_state

state logic

POTENTIAL when the principal has CanModifyConfiguration (es:UpdateDomainConfig) on a FGAC-enabled domain. The principal can invoke UpdateDomainConfig to set advancedSecurityOptions.enabled = false, removing all per-index authorization. After this configuration change, any principal with effective es:ESHttpGet / es:ESHttpPost / es:ESHttpPut on the domain ARN becomes a cluster admin (can read all indices without role mapping restrictions). Model as POTENTIAL because the attacker must first execute the UpdateDomainConfig call; this is not an implicit escalation but a deliberate action-sequence escalation.

Narrative

{principal.name} can disable fine-grained access control (FGAC) on OpenSearch domain {domain.name} via es:UpdateDomainConfig. Disabling FGAC removes all per-index and per-document authorization, promoting any IAM principal with es:ESHttp* on the domain to cluster-admin-level data access (read and write all indices).

Raw rule rules/derived/aws/opensearch.yaml

id: aws-opensearch-fgac-disable-escalation
emits: CanEscalateTo
description: A principal with es:UpdateDomainConfig on a FGAC-enabled domain can disable FGAC and grant
  all IAM-permitted principals cluster-admin data access.
match:
- - principal: null
  - CanModifyConfiguration
  - domain: null
where:
- node_type(?domain) == SearchService
- ?domain.AdvancedSecurityOptions.Enabled == true
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <any IAM principal with es:ESHttp* on the domain>
  permissions:
  - es:UpdateDomainConfig
  conditions:
  - iam_permission
  - service_state
  state_logic: POTENTIAL when the principal has CanModifyConfiguration (es:UpdateDomainConfig) on a FGAC-enabled
    domain. The principal can invoke UpdateDomainConfig to set advancedSecurityOptions.enabled = false,
    removing all per-index authorization. After this configuration change, any principal with effective
    es:ESHttpGet / es:ESHttpPost / es:ESHttpPut on the domain ARN becomes a cluster admin (can read all
    indices without role mapping restrictions). Model as POTENTIAL because the attacker must first execute
    the UpdateDomainConfig call; this is not an implicit escalation but a deliberate action-sequence escalation.
  false_positive_note: 'Only emit when FGAC is currently enabled (AdvancedSecurityOptions.Enabled == true).
    If FGAC is already disabled, the escalation is moot. Do not emit CanEscalateTo if UpdateDomainConfig
    is blocked. The "target" of CanEscalateTo should represent the downstream beneficiaries (other IAM
    principals with es:ESHttp* who are promoted to cluster admin), not the attacker themselves (though
    they benefit too via CanReadData/CanWriteData). Alternatively, cite can-control.yaml for the downstream
    derivation: CanModifyConfiguration(X, domain.FGAC.Enabled) + CanReadData(Y, domain) => CanEscalateTo(X,
    Y).'
  narrative: '{principal.name} can disable fine-grained access control (FGAC) on OpenSearch domain {domain.name}
    via es:UpdateDomainConfig. Disabling FGAC removes all per-index and per-document authorization, promoting
    any IAM principal with es:ESHttp* on the domain to cluster-admin-level data access (read and write
    all indices).'