aws-route53-change-records-hijack

id: aws-route53-change-records-hijack
emits: CanModifyConfiguration
description: "route53:ChangeResourceRecordSets on a public hosted zone enables DNS record mutation \u2014\
  \ traffic redirection, MX/SPF override, and subdomain NS delegation (DNS hijacking primitive)."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type == 'AWS::Route53::HostedZone'
- ?zone.properties.type == 'Public'
- effective_action_on(?principal, ?zone) contains 'route53:ChangeResourceRecordSets'
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53:ChangeResourceRecordSets
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when effective-permission evaluator confirms route53:ChangeResourceRecordSets on
    the zone ARN (or a wildcard resource in the policy). BLOCKED if an SCP or permission boundary denies
    route53:ChangeResourceRecordSets on this zone's ARN. Do NOT emit for private hosted zones with this
    rule; use aws-route53-change-records-private-zone for private-zone coverage where the CONDITIONAL(network_reachability)
    condition applies.
  confidence: 0.95
  derived_from:
  - ?principal HasPermission ?zone (route53:ChangeResourceRecordSets)
  false_positive_note: "Honor the resource ARN scope: a policy granting route53:ChangeResourceRecordSets\
    \ on a single zone ARN does NOT permit changes to other zones. A wildcard resource covers all zones.\
    \ An SCP or permission boundary denying this action yields BLOCKED. This edge is a traffic-redirection\
    \ primitive, NOT a direct access grant; the subsequent credential capture or exploitation is out-of-band\
    \ and modeled at the receiving service (e.g. an HTTPS server the attacker stands up on the hijacked\
    \ IP). Do NOT chain this single edge directly to CanEnterAccount or CanEscalateTo \u2014 that multi-step\
    \ path includes out-of-band steps not represented in the graph. Cite can-control.yaml for the Controls\
    \ roll-up (not applicable here directly)."
  narrative: "{principal.name} can modify any DNS record in the public hosted zone {zone.name} (route53:ChangeResourceRecordSets).\
    \ An attacker can redirect A/AAAA records to attacker infrastructure, override MX for email interception,\
    \ insert attacker CNAMEs, or modify TXT records to break SPF/DKIM \u2014 DNS hijacking for any name\
    \ delegated to this zone."