aws-waf-delete-web-acl

Permanently delete a Web ACL, removing WAF protection from all previously associated resources (requires prior disassociation).

derived aws emits CanDelete

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?webacl`
permissions	`wafv2:DeleteWebACL`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	ACTIVE when wafv2:DeleteWebACL is confirmed effective. CONDITIONAL(service_state) if the Web ACL currently has active resource associations — deletion will fail until wafv2:DisassociateWebACL has been called for each association (if the principal also holds DisassociateWebACL, the full destroy sequence is feasible and the edge may be ACTIVE; otherwise CONDITIONAL). BLOCKED if an SCP or permission boundary denies wafv2:DeleteWebACL.

source type

Identity

target type

SecurityService

source

?principal

target

?webacl

permissions

wafv2:DeleteWebACL

conditions

iam_permission scp_or_org_policy service_state

state logic

ACTIVE when wafv2:DeleteWebACL is confirmed effective. CONDITIONAL(service_state) if the Web ACL currently has active resource associations — deletion will fail until wafv2:DisassociateWebACL has been called for each association (if the principal also holds DisassociateWebACL, the full destroy sequence is feasible and the edge may be ACTIVE; otherwise CONDITIONAL). BLOCKED if an SCP or permission boundary denies wafv2:DeleteWebACL.

Narrative

{principal.name} can delete the Web ACL {webacl.name} (wafv2:DeleteWebACL), permanently removing its HTTP filtering rules. If the ACL is currently associated with resources, disassociation is required first; if {principal.name} also holds wafv2:DisassociateWebACL, the full destroy sequence is feasible. This is a destructive cover-tracks action, not an access grant.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-delete-web-acl
emits: CanDelete
description: Permanently delete a Web ACL, removing WAF protection from all previously associated resources
  (requires prior disassociation).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - webacl: null
where:
- node_type(?webacl) == SecurityService
- ?webacl.provider_type == 'AWS::WAFv2::WebACL'
- effective_action_on(?principal, ?webacl) contains 'wafv2:DeleteWebACL'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?webacl
  permissions:
  - wafv2:DeleteWebACL
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when wafv2:DeleteWebACL is confirmed effective. CONDITIONAL(service_state) if the\
    \ Web ACL currently has active resource associations \u2014 deletion will fail until wafv2:DisassociateWebACL\
    \ has been called for each association (if the principal also holds DisassociateWebACL, the full destroy\
    \ sequence is feasible and the edge may be ACTIVE; otherwise CONDITIONAL). BLOCKED if an SCP or permission\
    \ boundary denies wafv2:DeleteWebACL."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?webacl (wafv2:DeleteWebACL)
  false_positive_note: "AWS enforces that a Web ACL with active associations cannot be deleted \u2014\
    \ the API returns a WAFAssociatedItemException. If the ACL has associations and the principal does\
    \ NOT also hold wafv2:DisassociateWebACL, this action will fail in practice; emit CONDITIONAL(service_state)\
    \ rather than ACTIVE. This is a destructive impact edge (not escalation) and is excluded from default\
    \ attack path traversal by CanDelete's schema setting (walkable: false). Surface it for blast-radius/impact\
    \ analysis, not for path-finding to a higher-privilege identity."
  narrative: '{principal.name} can delete the Web ACL {webacl.name} (wafv2:DeleteWebACL), permanently
    removing its HTTP filtering rules. If the ACL is currently associated with resources, disassociation
    is required first; if {principal.name} also holds wafv2:DisassociateWebACL, the full destroy sequence
    is feasible. This is a destructive cover-tracks action, not an access grant.'