aws-waf-tamper-ip-set

Modify an IP Set to add attacker-controlled IPs to allow lists or remove blocking IPs (defense evasion with blast radius tied to referencing Web ACLs).

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`GenericManagement`
source	`?principal`
target	`?ipset`
permissions	`wafv2:UpdateIPSet`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when wafv2:UpdateIPSet is confirmed effective. Blast radius materializes only if the IP Set is referenced by at least one Web ACL in an active association — if referenced by zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an SCP or permission boundary denies wafv2:UpdateIPSet.

source type

Identity

target type

GenericManagement

source

?principal

target

?ipset

permissions

wafv2:UpdateIPSet

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when wafv2:UpdateIPSet is confirmed effective. Blast radius materializes only if the IP Set is referenced by at least one Web ACL in an active association — if referenced by zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an SCP or permission boundary denies wafv2:UpdateIPSet.

Narrative

{principal.name} can modify the IP Set {ipset.name} (wafv2:UpdateIPSet). Adding attacker-controlled IPs to allow lists or removing defensive IPs from block lists would weaken HTTP-layer filtering for all Web ACLs that reference this set. This reduces detection coverage and may allow previously-blocked traffic - it is a cover-tracks / weaken-defenses action, not an access grant.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-tamper-ip-set
emits: CanModify
description: Modify an IP Set to add attacker-controlled IPs to allow lists or remove blocking IPs (defense
  evasion with blast radius tied to referencing Web ACLs).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - ipset: null
where:
- node_type(?ipset) == GenericManagement
- ?ipset.provider_type == 'AWS::WAFv2::IPSet'
- effective_action_on(?principal, ?ipset) contains 'wafv2:UpdateIPSet'
emit:
  source_type: Identity
  target_type: GenericManagement
  source: ?principal
  target: ?ipset
  permissions:
  - wafv2:UpdateIPSet
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when wafv2:UpdateIPSet is confirmed effective. Blast radius materializes only if\
    \ the IP Set is referenced by at least one Web ACL in an active association \u2014 if referenced by\
    \ zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an SCP or permission\
    \ boundary denies wafv2:UpdateIPSet."
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?ipset (wafv2:UpdateIPSet)
  false_positive_note: "IP Sets are referenced by Web ACL rules as match conditions. Adding an attacker\
    \ IP to an allow list or removing a malicious pattern from a block list changes HTTP filtering for\
    \ all consuming ACLs. This edge is defense evasion, NOT privilege escalation \u2014 do NOT chain to\
    \ CanEnterAccount / CanExecuteAs / CanEscalateTo. Blast radius is zero if the IP Set has no referencing\
    \ Web ACLs."
  narrative: "{principal.name} can modify the IP Set {ipset.name} (wafv2:UpdateIPSet). Adding attacker-controlled\
    \ IPs to allow lists or removing defensive IPs from block lists would weaken HTTP-layer filtering\
    \ for all Web ACLs that reference this set. This reduces detection coverage and may allow previously-blocked\
    \ traffic \u2014 it is a cover-tracks / weaken-defenses action, not an access grant."