aws-route53-ns-delegation-hijack

route53:ChangeResourceRecordSets enables adding NS records for a subdomain, delegating full authority for that subtree to an attacker-controlled nameserver (broader than a single A-record redirect).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'zone': None}

where

node_type(?zone) == DNS ?zone.provider_type == 'AWS::Route53::HostedZone' ?zone.properties.type == 'Public' effective_action_on(?principal, ?zone) contains 'route53:ChangeResourceRecordSets' ?zone.properties.has_ns_delegation_records == true OR analyst_flag == 'ns-delegation-risk'

emit

source type	`Identity`
target type	`DNS`
source	`?principal`
target	`?zone`
permissions	`route53:ChangeResourceRecordSets`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when route53:ChangeResourceRecordSets is confirmed effective on the zone AND the zone contains existing NS delegation records (confirming the record type is operational and would not trigger obvious anomaly detection). If no NS delegation records currently exist, downgrade to CONDITIONAL — adding the first NS delegation may trigger monitoring alerts, but the IAM capability remains. BLOCKED if SCP or permission boundary denies the action.

Narrative

{principal.name} can add NS records for any subdomain of {zone.name} (route53:ChangeResourceRecordSets), delegating full authoritative control for that subdomain tree to an attacker-controlled nameserver. Every record type (A, MX, TXT, SRV, etc.) under the delegated subtree becomes attacker-controlled - higher impact than a single-record redirect.

Raw rule rules/derived/aws/route53.yaml

id: aws-route53-ns-delegation-hijack
emits: CanModifyConfiguration
description: route53:ChangeResourceRecordSets enables adding NS records for a subdomain, delegating full
  authority for that subtree to an attacker-controlled nameserver (broader than a single A-record redirect).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type == 'AWS::Route53::HostedZone'
- ?zone.properties.type == 'Public'
- effective_action_on(?principal, ?zone) contains 'route53:ChangeResourceRecordSets'
- ?zone.properties.has_ns_delegation_records == true OR analyst_flag == 'ns-delegation-risk'
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53:ChangeResourceRecordSets
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when route53:ChangeResourceRecordSets is confirmed effective on the zone AND the\
    \ zone contains existing NS delegation records (confirming the record type is operational and would\
    \ not trigger obvious anomaly detection). If no NS delegation records currently exist, downgrade to\
    \ CONDITIONAL \u2014 adding the first NS delegation may trigger monitoring alerts, but the IAM capability\
    \ remains. BLOCKED if SCP or permission boundary denies the action."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?zone (route53:ChangeResourceRecordSets + NS-delegation context)
  false_positive_note: This rule overlaps with aws-route53-change-records-hijack (same permission). Emit
    BOTH when the zone has existing NS delegations (higher impact, different analyst framing). Do not
    emit this rule for private hosted zones (NS delegation within a private zone is unusual and the same
    CONDITIONAL(network_reachability) concern from rule 2 applies). The IAM permission is identical to
    rule 1; this rule adds the context that the attacker can delegate an ENTIRE subtree, not just redirect
    a single record.
  narrative: "{principal.name} can add NS records for any subdomain of {zone.name} (route53:ChangeResourceRecordSets),\
    \ delegating full authoritative control for that subdomain tree to an attacker-controlled nameserver.\
    \ Every record type (A, MX, TXT, SRV, etc.) under the delegated subtree becomes attacker-controlled\
    \ \u2014 higher impact than a single-record redirect."