rage.fail

aws-securityhub-effective-write

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "securityhub:BatchUpdateFindings", "securityhub:UpdateStandardsControl", "securityhub:BatchDisableStandards", "securityhub:DisableSecurityHub", "securityhub:CreateAutomationRule", "securityhub:UpdateAutomationRule", "securityhub:DeleteAutomationRule", "securityhub:DeleteInsight" ], "resource_type": "AWS::SecurityHub::Hub" }

emit

source type	`Identity`
target type	`SecurityService`
source	`<principal>`
target	`<Security Hub node in account+region>`
permissions	`<matched action>`

Narrative

{principal.name} holds an effective SecurityHub write action ({matched_action}) on the Security Hub service in {account}/{region}, enabling defense-evasion against Security Hub detective controls.

Raw rule rules/explicit/aws/securityhub.yaml

id: aws-securityhub-effective-write
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - securityhub:BatchUpdateFindings
  - securityhub:UpdateStandardsControl
  - securityhub:BatchDisableStandards
  - securityhub:DisableSecurityHub
  - securityhub:CreateAutomationRule
  - securityhub:UpdateAutomationRule
  - securityhub:DeleteAutomationRule
  - securityhub:DeleteInsight
  resource_type: AWS::SecurityHub::Hub
emit:
  source_type: Identity
  target_type: SecurityService
  source: <principal>
  target: <Security Hub node in account+region>
  permissions:
  - <matched action>
  narrative: '{principal.name} holds an effective SecurityHub write action ({matched_action}) on the Security
    Hub service in {account}/{region}, enabling defense-evasion against Security Hub detective controls.'