aws-route53-change-records-private-zone

route53:ChangeResourceRecordSets on a private hosted zone enables internal DNS hijacking within associated VPCs - traffic redirection for VPC-resident workloads only.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`DNS`
source	`?principal`
target	`?zone`
permissions	`route53:ChangeResourceRecordSets`
conditions	`iam_permission` `scp_or_org_policy` `network_reachability`
state logic	CONDITIONAL(network_reachability) — private zone manipulation affects only VPC-resident resolvers within associated VPCs. The edge is ACTIVE for the IAM control-plane permission but CONDITIONAL for actual exploitation because the attacker must have (or gain) a foothold inside an associated VPC to observe the redirected traffic. BLOCKED if an SCP or permission boundary denies route53:ChangeResourceRecordSets on this zone.

source type

Identity

target type

DNS

source

?principal

target

?zone

permissions

route53:ChangeResourceRecordSets

conditions

iam_permission scp_or_org_policy network_reachability

state logic

CONDITIONAL(network_reachability) — private zone manipulation affects only VPC-resident resolvers within associated VPCs. The edge is ACTIVE for the IAM control-plane permission but CONDITIONAL for actual exploitation because the attacker must have (or gain) a foothold inside an associated VPC to observe the redirected traffic. BLOCKED if an SCP or permission boundary denies route53:ChangeResourceRecordSets on this zone.

Narrative

{principal.name} can modify DNS records in the private hosted zone {zone.name} (route53:ChangeResourceRecordSets), redirecting internal name resolution for all VPCs associated with this zone. Exploitation requires network reachability within an associated VPC to capture redirected traffic (e.g. MITM of DB connections or internal API calls that trust DNS names).

Raw rule rules/derived/aws/route53.yaml

id: aws-route53-change-records-private-zone
emits: CanModifyConfiguration
description: "route53:ChangeResourceRecordSets on a private hosted zone enables internal DNS hijacking\
  \ within associated VPCs \u2014 traffic redirection for VPC-resident workloads only."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type == 'AWS::Route53::HostedZone'
- ?zone.properties.type == 'Private'
- effective_action_on(?principal, ?zone) contains 'route53:ChangeResourceRecordSets'
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53:ChangeResourceRecordSets
  conditions:
  - iam_permission
  - scp_or_org_policy
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) \u2014 private zone manipulation affects only VPC-resident\
    \ resolvers within associated VPCs. The edge is ACTIVE for the IAM control-plane permission but CONDITIONAL\
    \ for actual exploitation because the attacker must have (or gain) a foothold inside an associated\
    \ VPC to observe the redirected traffic. BLOCKED if an SCP or permission boundary denies route53:ChangeResourceRecordSets\
    \ on this zone."
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?zone (route53:ChangeResourceRecordSets, Private)
  false_positive_note: "Private zone hijacking is CONDITIONAL on the attacker having network reachability\
    \ inside an associated VPC \u2014 public-internet attackers cannot observe or benefit from private\
    \ zone changes. Do not emit ACTIVE. Honor zone VPC associations: a zone associated only with VPC-A\
    \ does not affect resolution in VPC-B even if the same account owns both. An SCP denying the action\
    \ yields BLOCKED."
  narrative: '{principal.name} can modify DNS records in the private hosted zone {zone.name} (route53:ChangeResourceRecordSets),
    redirecting internal name resolution for all VPCs associated with this zone. Exploitation requires
    network reachability within an associated VPC to capture redirected traffic (e.g. MITM of DB connections
    or internal API calls that trust DNS names).'