aws-waf-recon-logging

Discover WAF logging configuration (destination Firehose/S3/CloudWatch Logs), aiding recon into the logging pipeline.

derived aws emits CanRead

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?webacl`
permissions	`wafv2:GetLoggingConfiguration`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when wafv2:GetLoggingConfiguration is confirmed effective. BLOCKED if an SCP or permission boundary denies the action.

source type

Identity

target type

SecurityService

source

?principal

target

?webacl

permissions

wafv2:GetLoggingConfiguration

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when wafv2:GetLoggingConfiguration is confirmed effective. BLOCKED if an SCP or permission boundary denies the action.

Narrative

{principal.name} can query the WAF logging configuration (wafv2:GetLoggingConfiguration), revealing the Firehose/S3/CloudWatch Logs destination where HTTP request logs are delivered. This is recon into the logging pipeline and may guide follow-up attacks against the log destination itself.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-recon-logging
emits: CanRead
description: Discover WAF logging configuration (destination Firehose/S3/CloudWatch Logs), aiding recon
  into the logging pipeline.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - webacl: null
where:
- node_type(?webacl) == SecurityService
- ?webacl.provider_type == 'AWS::WAFv2::WebACL'
- effective_action_on(?principal, ?webacl) contains 'wafv2:GetLoggingConfiguration'
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?webacl
  permissions:
  - wafv2:GetLoggingConfiguration
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when wafv2:GetLoggingConfiguration is confirmed effective. BLOCKED if an SCP or
    permission boundary denies the action.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?webacl (wafv2:GetLoggingConfiguration)
  false_positive_note: "This is recon only \u2014 discovering the log destination does not grant access\
    \ to the logs themselves. Do NOT emit this as CanReadData; the destination's own data-plane permissions\
    \ control log access. This edge is walkable for recon chains, not escalation."
  narrative: '{principal.name} can query the WAF logging configuration (wafv2:GetLoggingConfiguration),
    revealing the Firehose/S3/CloudWatch Logs destination where HTTP request logs are delivered. This
    is recon into the logging pipeline and may guide follow-up attacks against the log destination itself.'