aws-waf-corrupt-rule-group

Modify a customer-managed Rule Group to corrupt all Web ACLs that reference it (defense evasion with potentially multi-ACL blast radius).

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?rulegroup`
permissions	`wafv2:UpdateRuleGroup`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective-permission evaluator confirms wafv2:UpdateRuleGroup on the Rule Group ARN. BLOCKED if an SCP or permission boundary explicitly denies the action. Blast radius increases with the number of Web ACLs referencing this rule group — note this in evidence but do not spawn additional edges for each consuming ACL (path-finding handles fan-out via structural referencing edges at query time).

source type

Identity

target type

SecurityService

source

?principal

target

?rulegroup

permissions

wafv2:UpdateRuleGroup

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when effective-permission evaluator confirms wafv2:UpdateRuleGroup on the Rule Group ARN. BLOCKED if an SCP or permission boundary explicitly denies the action. Blast radius increases with the number of Web ACLs referencing this rule group — note this in evidence but do not spawn additional edges for each consuming ACL (path-finding handles fan-out via structural referencing edges at query time).

Narrative

{principal.name} can update the Rule Group {rulegroup.name} (wafv2:UpdateRuleGroup). Every Web ACL that references this rule group would lose the updated rules, potentially allowing previously-blocked HTTP traffic across multiple protected resources.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-corrupt-rule-group
emits: CanModify
description: Modify a customer-managed Rule Group to corrupt all Web ACLs that reference it (defense evasion
  with potentially multi-ACL blast radius).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - rulegroup: null
where:
- node_type(?rulegroup) == SecurityService
- ?rulegroup.provider_type == 'AWS::WAFv2::RuleGroup'
- effective_action_on(?principal, ?rulegroup) contains 'wafv2:UpdateRuleGroup'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?rulegroup
  permissions:
  - wafv2:UpdateRuleGroup
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms wafv2:UpdateRuleGroup on the Rule\
    \ Group ARN. BLOCKED if an SCP or permission boundary explicitly denies the action. Blast radius increases\
    \ with the number of Web ACLs referencing this rule group \u2014 note this in evidence but do not\
    \ spawn additional edges for each consuming ACL (path-finding handles fan-out via structural referencing\
    \ edges at query time)."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?rulegroup (wafv2:UpdateRuleGroup)
  false_positive_note: "Customer-managed Rule Groups only. AWS-managed rule groups (vendor-managed, e.g.\
    \ AWSManagedRulesCommonRuleSet) cannot be updated by customer IAM actions \u2014 do not emit for those.\
    \ If the rule group is referenced by zero Web ACLs (orphaned), the blast radius is nil; downgrade\
    \ to POTENTIAL or annotate low impact. This edge is defense evasion, NOT privilege escalation \u2014\
    \ do NOT chain to CanEnterAccount / CanExecuteAs / CanEscalateTo."
  narrative: '{principal.name} can update the Rule Group {rulegroup.name} (wafv2:UpdateRuleGroup). Every
    Web ACL that references this rule group would lose the updated rules, potentially allowing previously-blocked
    HTTP traffic across multiple protected resources.'