aws-route53-registrar-transfer-domain

route53domains:TransferDomainToAnotherAwsAccount transfers domain registration ownership to another AWS account - complete loss of domain registration control, enabling the attacker to modify registrar settings and potentially lock out the legitimate owner.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'zone': None}

where

node_type(?zone) == DNS ?zone.provider_type in ['AWS::Route53::HostedZone', 'AWS::Route53::Domain'] effective_action_on(?principal, ?zone) contains 'route53domains:TransferDomainToAnotherAwsAccount'

emit

source type	`Identity`
target type	`DNS`
source	`?principal`
target	`?zone`
permissions	`route53domains:TransferDomainToAnotherAwsAccount`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective-permission evaluator confirms route53domains:TransferDomainToAnotherAwsAccount on the domain registration (resource "" since Route 53 Domains does not support resource-level IAM for this action). BLOCKED if an SCP denying route53domains:TransferDomainToAnotherAwsAccount is in force (SCPs for route53domains must target us-east-1 or — not a regional SCP). Unlike NS swap, this is a permanent ownership change; the legitimate account loses all control over the domain registration.

Narrative

{principal.name} can transfer the domain registration for {zone.name} to another AWS account (route53domains:TransferDomainToAnotherAwsAccount). This represents complete loss of domain ownership and control - the attacker gains administrative authority over the domain registration, including the ability to modify registrar settings, change nameservers, and lock out the legitimate owner.

Raw rule rules/derived/aws/route53.yaml

id: aws-route53-registrar-transfer-domain
emits: CanModifyConfiguration
description: "route53domains:TransferDomainToAnotherAwsAccount transfers domain registration ownership\
  \ to another AWS account \u2014 complete loss of domain registration control, enabling the attacker\
  \ to modify registrar settings and potentially lock out the legitimate owner."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type in ['AWS::Route53::HostedZone', 'AWS::Route53::Domain']
- effective_action_on(?principal, ?zone) contains 'route53domains:TransferDomainToAnotherAwsAccount'
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53domains:TransferDomainToAnotherAwsAccount
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms route53domains:TransferDomainToAnotherAwsAccount\
    \ on the domain registration (resource \"*\" since Route 53 Domains does not support resource-level\
    \ IAM for this action). BLOCKED if an SCP denying route53domains:TransferDomainToAnotherAwsAccount\
    \ is in force (SCPs for route53domains must target us-east-1 or * \u2014 not a regional SCP). Unlike\
    \ NS swap, this is a permanent ownership change; the legitimate account loses all control over the\
    \ domain registration."
  confidence: 0.95
  derived_from:
  - ?principal HasPermission ?zone (route53domains:TransferDomainToAnotherAwsAccount)
  false_positive_note: "route53domains:TransferDomainToAnotherAwsAccount is ENTIRELY SEPARATE from route53:ChangeResourceRecordSets\
    \ and route53domains:UpdateDomainNameservers. A principal must have this specific action to perform\
    \ domain transfer. Route 53 Domains does not support resource-level IAM restrictions on this action\
    \ (resource must be \"*\"). An SCP targeting route53domains in us-east-1 blocks this action. This\
    \ is a full ownership loss \u2014 higher impact than NS swap because the attacker controls the registration\
    \ itself, not just the DNS resolution."
  narrative: "{principal.name} can transfer the domain registration for {zone.name} to another AWS account\
    \ (route53domains:TransferDomainToAnotherAwsAccount). This represents complete loss of domain ownership\
    \ and control \u2014 the attacker gains administrative authority over the domain registration, including\
    \ the ability to modify registrar settings, change nameservers, and lock out the legitimate owner."