aws-ssm-params-tamper

Overwrite a parameter's value (ssm:PutParameter Overwrite) to poison consumers.

derived aws emits CanWrite

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?param`
permissions	`ssm:PutParameter`
conditions	`iam_permission`
state logic	overwriting an EXISTING parameter requires ssm:PutParameter WITH Overwrite=true on the parameter scope -> ACTIVE only if that Overwrite-permitting grant holds, else CONDITIONAL(iam_permission); creating a NEW parameter at an unused name needs ssm:PutParameter WITHOUT Overwrite -> ACTIVE for the create-side poisoning of a not-yet-existent name a consumer will resolve. Onward execution impact is a separate, cross-service derivation (POTENTIAL until a concrete consumer reference is observed).

source type

Identity

target type

*

source

?principal

target

?param

permissions

ssm:PutParameter

conditions

iam_permission

state logic

overwriting an EXISTING parameter requires ssm:PutParameter WITH Overwrite=true on the parameter scope -> ACTIVE only if that Overwrite-permitting grant holds, else CONDITIONAL(iam_permission); creating a NEW parameter at an unused name needs ssm:PutParameter WITHOUT Overwrite -> ACTIVE for the create-side poisoning of a not-yet-existent name a consumer will resolve. Onward execution impact is a separate, cross-service derivation (POTENTIAL until a concrete consumer reference is observed).

Narrative

{principal.name} can overwrite the parameter {param.name} (ssm:PutParameter, Overwrite=true), poisoning any service that resolves it.

Raw rule rules/derived/aws/ssm-params.yaml

id: aws-ssm-params-tamper
emits: CanWrite
description: Overwrite a parameter's value (ssm:PutParameter Overwrite) to poison consumers.
match:
- - principal: null
  - CanWrite
  - param: null
where:
- node_class(?param) in [Secret, Data]
- ?param.origin_service == aws:ssm-params
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?param
  permissions:
  - ssm:PutParameter
  conditions:
  - iam_permission
  state_logic: overwriting an EXISTING parameter requires ssm:PutParameter WITH Overwrite=true on the
    parameter scope -> ACTIVE only if that Overwrite-permitting grant holds, else CONDITIONAL(iam_permission);
    creating a NEW parameter at an unused name needs ssm:PutParameter WITHOUT Overwrite -> ACTIVE for
    the create-side poisoning of a not-yet-existent name a consumer will resolve. Onward execution impact
    is a separate, cross-service derivation (POTENTIAL until a concrete consumer reference is observed).
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <CanWrite(ssm:PutParameter) explicit edge_id>
  false_positive_note: "Requires ssm:PutParameter with Overwrite on the parameter scope (creating a NEW\
    \ parameter needs no Overwrite; changing an existing one does). Tamper is only an escalation when\
    \ a downstream service actually resolves the parameter (AMI ID, image tag, endpoint, ECS/CodeBuild\
    \ secret/env reference) \u2014 that execution step is owned by the consuming service's rules and is\
    \ POTENTIAL until the reference is proven. Not walked as escalation on its own. SCP denying ssm:PutParameter\
    \ -> BLOCKED."
  narrative: '{principal.name} can overwrite the parameter {param.name} (ssm:PutParameter, Overwrite=true),
    poisoning any service that resolves it.'