aws-shield-delete-protection

Remove Shield Advanced DDoS protection from a resource (defense evasion, reduces DDoS coverage).

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?protection`
permissions	`shield:DeleteProtection`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when shield:DeleteProtection is confirmed effective. BLOCKED if an SCP or permission boundary denies the action. Shield Advanced subscriptions are account-scoped; deletion removes protection from the target resource globally.

source type

Identity

target type

SecurityService

source

?principal

target

?protection

permissions

shield:DeleteProtection

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when shield:DeleteProtection is confirmed effective. BLOCKED if an SCP or permission boundary denies the action. Shield Advanced subscriptions are account-scoped; deletion removes protection from the target resource globally.

Narrative

{principal.name} can remove Shield Advanced DDoS protection from {protection.name} (shield:DeleteProtection), reducing DDoS coverage on the resource. This lowers resilience to volumetric attacks but does not grant access to protected data. This is a cover-tracks / weaken-defenses action, not an access grant.

Raw rule rules/derived/aws/waf.yaml

id: aws-shield-delete-protection
emits: CanModify
description: Remove Shield Advanced DDoS protection from a resource (defense evasion, reduces DDoS coverage).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - protection: null
where:
- node_type(?protection) == SecurityService
- ?protection.provider_type == 'AWS::Shield::Protection'
- effective_action_on(?principal, ?protection) contains 'shield:DeleteProtection'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?protection
  permissions:
  - shield:DeleteProtection
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when shield:DeleteProtection is confirmed effective. BLOCKED if an SCP or permission
    boundary denies the action. Shield Advanced subscriptions are account-scoped; deletion removes protection
    from the target resource globally.
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?protection (shield:DeleteProtection)
  false_positive_note: "Shield Advanced requires an active subscription; if the account is not subscribed,\
    \ DeleteProtection will fail. Verify subscription state via shield:DescribeSubscription before emitting\
    \ ACTIVE. This is defense evasion, NOT privilege escalation \u2014 do NOT chain to CanEnterAccount\
    \ / CanExecuteAs / CanEscalateTo."
  narrative: '{principal.name} can remove Shield Advanced DDoS protection from {protection.name} (shield:DeleteProtection),
    reducing DDoS coverage on the resource. This lowers resilience to volumetric attacks but does not
    grant access to protected data. This is a cover-tracks / weaken-defenses action, not an access grant.'