aws-route53-registrar-ns-swap

id: aws-route53-registrar-ns-swap
emits: CanModifyConfiguration
description: "route53domains:UpdateDomainNameservers replaces the authoritative NS servers at the domain\
  \ registry \u2014 full domain takeover, redirecting ALL DNS resolution for the domain to attacker-controlled\
  \ infrastructure."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type in ['AWS::Route53::HostedZone', 'AWS::Route53::Domain']
- effective_action_on(?principal, ?zone) intersects ['route53domains:UpdateDomainNameservers', 'route53domains:*']
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53domains:UpdateDomainNameservers
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms route53domains:UpdateDomainNameservers\
    \ on the domain registration (resource \"*\" since Route 53 Domains does not support resource-level\
    \ IAM for most actions). BLOCKED if an SCP denying route53domains:UpdateDomainNameservers is in force\
    \ (SCPs for route53domains must target us-east-1 or * \u2014 not a regional SCP). This action is irreversible\
    \ in the short term (registry TTL 24-48 h after change)."
  confidence: 0.95
  derived_from:
  - ?principal HasPermission ?zone (route53domains:UpdateDomainNameservers)
  false_positive_note: "Route 53 Domains permissions (route53domains:*) are ENTIRELY SEPARATE from Route\
    \ 53 hosted zone permissions (route53:*). A principal with route53:* but NOT route53domains:UpdateDomainNameservers\
    \ cannot perform this action. Verify that the principal's effective permissions include the route53domains\
    \ namespace. Route 53 Domains does not support resource-level IAM restrictions on most actions (resource\
    \ must be \"*\") \u2014 if the policy restricts the resource ARN, the action may fail (IAM evaluates\
    \ both identity policy and the service's supported resources). An SCP targeting route53domains in\
    \ us-east-1 blocks this action. This is the highest-impact Route 53 escalation path \u2014 flag it\
    \ accordingly in UI."
  narrative: "{principal.name} can replace the authoritative nameservers for domain {zone.name} at the\
    \ domain registry (route53domains:UpdateDomainNameservers). This redirects ALL DNS resolution for\
    \ the entire domain to attacker-controlled infrastructure \u2014 the existing Route 53 hosted zone\
    \ becomes irrelevant once registry NS records change. Registry TTL is typically 24-48 hours after\
    \ the change propagates."