aws-waf-weaken-web-acl
Update or disassociate a Web ACL to weaken or remove HTTP-layer filtering from protected resources (defense evasion, not access grant).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?webacl) ==
SecurityService
?webacl.provider_type == 'AWS::WAFv2::WebACL'
effective_action_on(?principal, ?webacl) intersects ['wafv2:UpdateWebACL', 'wafv2:DisassociateWebACL']
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?webacl |
| permissions | wafv2:UpdateWebACL wafv2:DisassociateWebACL |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE when effective-permission evaluator confirms at least one of wafv2:UpdateWebACL or wafv2:DisassociateWebACL on the Web ACL ARN (or scope wildcard). BLOCKED if an SCP or permission boundary denies the matching action(s) on the ACL's ARN. No additional precondition required — WAFv2 control-plane actions require only IAM (no resource-based policy, no network gate). |
Narrative
{principal.name} can modify or disassociate the Web ACL {webacl.name} (wafv2:UpdateWebACL / wafv2:DisassociateWebACL), weakening or removing HTTP-layer filtering (SQLi, XSS, bot, rate-limit rules) from protected resources. This reduces detection coverage and may allow previously-blocked traffic - it is a cover-tracks / weaken-defenses action, not an access grant.
Raw rule rules/derived/aws/waf.yaml
id: aws-waf-weaken-web-acl
emits: CanModify
description: Update or disassociate a Web ACL to weaken or remove HTTP-layer filtering from protected
resources (defense evasion, not access grant).
applies_to:
- aws
match:
- - principal: null
- HasPermission
- webacl: null
where:
- node_type(?webacl) == SecurityService
- ?webacl.provider_type == 'AWS::WAFv2::WebACL'
- effective_action_on(?principal, ?webacl) intersects ['wafv2:UpdateWebACL', 'wafv2:DisassociateWebACL']
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?webacl
permissions:
- wafv2:UpdateWebACL
- wafv2:DisassociateWebACL
conditions:
- iam_permission
- scp_or_org_policy
state_logic: "ACTIVE when effective-permission evaluator confirms at least one of wafv2:UpdateWebACL\
\ or wafv2:DisassociateWebACL on the Web ACL ARN (or scope wildcard). BLOCKED if an SCP or permission\
\ boundary denies the matching action(s) on the ACL's ARN. No additional precondition required \u2014\
\ WAFv2 control-plane actions require only IAM (no resource-based policy, no network gate)."
confidence: 0.95
derived_from:
- ?principal HasPermission ?webacl (wafv2:UpdateWebACL | wafv2:DisassociateWebACL)
false_positive_note: "This edge is a DEFENSE-EVASION primitive \u2014 it does NOT grant access to the\
\ application or data protected by the Web ACL. Removing or weakening a WAF lowers the bar for external\
\ exploitation (allows previously-blocked HTTP payloads) but is not itself an access grant. Do NOT\
\ chain this edge to CanEnterAccount / CanExecuteAs / CanEscalateTo. Detective controls are not BLOCKED-state\
\ nodes: removing the WAF disables a filter, not a guardrail that the reference engine models as BLOCKED.\
\ wafv2:DeleteWebACL additionally requires the ACL to have no active associations \u2014 emit CanDelete\
\ separately (rule aws-waf-delete-web-acl). Scope to the correct AWS region (CLOUDFRONT scope is us-east-1\
\ only)."
narrative: "{principal.name} can modify or disassociate the Web ACL {webacl.name} (wafv2:UpdateWebACL\
\ / wafv2:DisassociateWebACL), weakening or removing HTTP-layer filtering (SQLi, XSS, bot, rate-limit\
\ rules) from protected resources. This reduces detection coverage and may allow previously-blocked\
\ traffic \u2014 it is a cover-tracks / weaken-defenses action, not an access grant."