aws-waf-disable-logging

Disable WAF logging by deleting or disabling logging configuration, removing event coverage and aiding evasion.

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?webacl`
permissions	`wafv2:PutLoggingConfiguration` `wafv2:DeleteLoggingConfiguration`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when wafv2:PutLoggingConfiguration or wafv2:DeleteLoggingConfiguration is confirmed effective. For initial setup (first-time PutLoggingConfiguration), the principal must also hold iam:CreateServiceLinkedRole for the logging service-linked role — if confirmed, ACTIVE; otherwise CONDITIONAL(iam_permission). BLOCKED if an SCP or permission boundary denies the action.

source type

Identity

target type

SecurityService

source

?principal

target

?webacl

permissions

wafv2:PutLoggingConfiguration wafv2:DeleteLoggingConfiguration

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when wafv2:PutLoggingConfiguration or wafv2:DeleteLoggingConfiguration is confirmed effective. For initial setup (first-time PutLoggingConfiguration), the principal must also hold iam:CreateServiceLinkedRole for the logging service-linked role — if confirmed, ACTIVE; otherwise CONDITIONAL(iam_permission). BLOCKED if an SCP or permission boundary denies the action.

Narrative

{principal.name} can disable WAF logging (wafv2:PutLoggingConfiguration / wafv2:DeleteLoggingConfiguration), stopping delivery of HTTP request logs that would otherwise be captured by the logging destination (Kinesis Firehose or CloudWatch Logs). This removes audit coverage, aiding evasion of detection systems that analyze WAF logs. This is a cover-tracks action, not an access grant.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-disable-logging
emits: CanModify
description: Disable WAF logging by deleting or disabling logging configuration, removing event coverage
  and aiding evasion.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - webacl: null
where:
- node_type(?webacl) == SecurityService
- ?webacl.provider_type == 'AWS::WAFv2::WebACL'
- effective_action_on(?principal, ?webacl) intersects ['wafv2:PutLoggingConfiguration', 'wafv2:DeleteLoggingConfiguration']
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?webacl
  permissions:
  - wafv2:PutLoggingConfiguration
  - wafv2:DeleteLoggingConfiguration
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when wafv2:PutLoggingConfiguration or wafv2:DeleteLoggingConfiguration is confirmed\
    \ effective. For initial setup (first-time PutLoggingConfiguration), the principal must also hold\
    \ iam:CreateServiceLinkedRole for the logging service-linked role \u2014 if confirmed, ACTIVE; otherwise\
    \ CONDITIONAL(iam_permission). BLOCKED if an SCP or permission boundary denies the action."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?webacl (wafv2:PutLoggingConfiguration | wafv2:DeleteLoggingConfiguration)
  false_positive_note: "Disabling logging is a cover-tracks action: it does NOT grant access to protected\
    \ resources or data. Do NOT chain to CanEnterAccount / CanExecuteAs / CanEscalateTo. First-time logging\
    \ configuration may fail if the principal lacks iam:CreateServiceLinkedRole (for the logging SLR)\
    \ \u2014 emit CONDITIONAL(iam_permission) in that case. This edge targets the Web ACL (source of logging\
    \ config) rather than the log destination (S3/Firehose/CWL), which are modeled separately."
  narrative: '{principal.name} can disable WAF logging (wafv2:PutLoggingConfiguration / wafv2:DeleteLoggingConfiguration),
    stopping delivery of HTTP request logs that would otherwise be captured by the logging destination
    (Kinesis Firehose or CloudWatch Logs). This removes audit coverage, aiding evasion of detection systems
    that analyze WAF logs. This is a cover-tracks action, not an access grant.'