aws-waf-delete-rule-group
Permanently delete a customer-managed Rule Group, breaking all Web ACLs that reference it (requires prior removal of all associations).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?rulegroup) ==
SecurityService
?rulegroup.provider_type == 'AWS::WAFv2::RuleGroup'
effective_action_on(?principal, ?rulegroup) contains 'wafv2:DeleteRuleGroup'
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?rulegroup |
| permissions | wafv2:DeleteRuleGroup |
| conditions | iam_permission scp_or_org_policy service_state |
| state logic | ACTIVE when wafv2:DeleteRuleGroup is confirmed effective. CONDITIONAL(service_state) if the Rule Group is currently referenced by one or more Web ACLs — deletion will fail until all Web ACLs have removed their references (if the principal also holds wafv2:UpdateWebACL, removing the reference is feasible and the edge may be ACTIVE; otherwise CONDITIONAL). BLOCKED if an SCP or permission boundary denies wafv2:DeleteRuleGroup. |
Narrative
{principal.name} can delete the Rule Group {rulegroup.name} (wafv2:DeleteRuleGroup), permanently removing the rules it provides. If the rule group is currently referenced by Web ACLs, removal from each ACL is required first; if {principal.name} also holds wafv2:UpdateWebACL, the full removal sequence is feasible. This is a destructive cover-tracks action, not an access grant.
Raw rule rules/derived/aws/waf.yaml
id: aws-waf-delete-rule-group
emits: CanDelete
description: Permanently delete a customer-managed Rule Group, breaking all Web ACLs that reference it
(requires prior removal of all associations).
applies_to:
- aws
match:
- - principal: null
- HasPermission
- rulegroup: null
where:
- node_type(?rulegroup) == SecurityService
- ?rulegroup.provider_type == 'AWS::WAFv2::RuleGroup'
- effective_action_on(?principal, ?rulegroup) contains 'wafv2:DeleteRuleGroup'
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?rulegroup
permissions:
- wafv2:DeleteRuleGroup
conditions:
- iam_permission
- scp_or_org_policy
- service_state
state_logic: "ACTIVE when wafv2:DeleteRuleGroup is confirmed effective. CONDITIONAL(service_state) if\
\ the Rule Group is currently referenced by one or more Web ACLs \u2014 deletion will fail until all\
\ Web ACLs have removed their references (if the principal also holds wafv2:UpdateWebACL, removing\
\ the reference is feasible and the edge may be ACTIVE; otherwise CONDITIONAL). BLOCKED if an SCP\
\ or permission boundary denies wafv2:DeleteRuleGroup."
confidence: 0.9
derived_from:
- ?principal HasPermission ?rulegroup (wafv2:DeleteRuleGroup)
false_positive_note: "AWS enforces that a Rule Group with active Web ACL references cannot be deleted\
\ \u2014 the API returns a WAFAssociatedItemException. If the rule group is referenced and the principal\
\ does NOT also hold wafv2:UpdateWebACL, this action will fail in practice; emit CONDITIONAL(service_state)\
\ rather than ACTIVE. This is a destructive impact edge (not escalation) and is excluded from default\
\ attack path traversal by CanDelete's schema setting (walkable: false). Surface it for blast-radius/impact\
\ analysis, not for path-finding to a higher-privilege identity."
narrative: '{principal.name} can delete the Rule Group {rulegroup.name} (wafv2:DeleteRuleGroup), permanently
removing the rules it provides. If the rule group is currently referenced by Web ACLs, removal from
each ACL is required first; if {principal.name} also holds wafv2:UpdateWebACL, the full removal sequence
is feasible. This is a destructive cover-tracks action, not an access grant.'