aws-appmesh-modify-route-config

id: aws-appmesh-modify-route-config
emits: CanModifyConfiguration
description: A principal with App Mesh route/service write actions can modify the Envoy xDS configuration
  delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled
  virtual node (traffic hijack within the mesh).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - meshresource: null
where:
- node_type(?meshresource) in [VirtualNetwork, GenericNetwork, APIGateway, Route]
- ?meshresource.provider_type in ['AWS::AppMesh::Mesh', 'AWS::AppMesh::VirtualRouter', 'AWS::AppMesh::Route',
  'AWS::AppMesh::VirtualService', 'AWS::AppMesh::VirtualGateway', 'AWS::AppMesh::GatewayRoute', 'AWS::AppMesh::VirtualNode']
- "effective_action_on(?principal, ?meshresource) intersects [\n  'appmesh:UpdateRoute',\n  'appmesh:UpdateVirtualService',\n\
  \  'appmesh:UpdateGatewayRoute',\n  'appmesh:UpdateVirtualNode',\n  'appmesh:CreateRoute'\n]"
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?meshresource
  permissions:
  - appmesh:UpdateRoute
  - appmesh:UpdateVirtualService
  - appmesh:UpdateGatewayRoute
  - appmesh:UpdateVirtualNode
  - appmesh:CreateRoute
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when effective_action_on(?principal, ?meshresource) includes at least one of the
    listed appmesh write actions and no SCP or permission boundary explicitly denies them at the effective
    scope. BLOCKED when an SCP denies the matched action(s) on the mesh or mesh resource ARN. No resource-based
    policy applies to App Mesh (the service has no resource-based policy support); IAM is the sole authorization
    layer.
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <HasPermission edge_id>
  false_positive_note: "(1) NO IAM ESCALATION: App Mesh routing changes do not grant IAM credentials or\
    \ assume roles. Do NOT chain CanModifyConfiguration (App Mesh) directly to CanExecuteAs or CanEnterAccount\
    \ without additional evidence that the redirected traffic contains exploitable credentials or that\
    \ the backing compute node is under attacker control. (2) mTLS gate: if the mesh enforces strict mutual\
    \ TLS on all virtual nodes (TLSValidationContext.trust with strict mode), a hijacked virtual node\
    \ cannot impersonate a legitimate service certificate \u2014 the sidecar rejects the connection. Annotate\
    \ this edge with lower confidence (0.6 floor) and note the mTLS control when strict mTLS is confirmed.\
    \ The edge is still emitted because appmesh:UpdateVirtualNode could change the TLS config itself.\
    \ (3) Shared-mesh scope: in a RAM-shared mesh, only principals explicitly granted appmesh:Update*\
    \ in their IAM policies (not just RAM share recipients) can modify routing. RAM sharing alone does\
    \ not grant write access \u2014 honor the effective-permission evaluator output. (4) appmesh:CreateRoute\
    \ requires the virtual router ARN as the resource scope; a wildcard (*) resource grant includes it,\
    \ but a narrowly scoped grant to specific route ARNs may not cover route creation. Check resource\
    \ scope in the effective-permission evaluation. (5) appmesh:UpdateMesh (not listed) changes only the\
    \ mesh-level egress filter (ALLOW_ALL vs DROP_ALL). This is a configuration change but its direct\
    \ security impact is egress filtering, not traffic redirection \u2014 it is NOT included in this rule's\
    \ permission set to avoid over-claiming."
  narrative: '{principal.name} can modify App Mesh routing configuration on {meshresource.name} (appmesh
    write actions including UpdateRoute / UpdateVirtualService / UpdateGatewayRoute / UpdateVirtualNode).
    This allows the principal to redirect in-mesh service-to-service traffic or inbound gateway traffic
    to an alternate or attacker-controlled virtual node backend. If mutual TLS is not enforced in the
    mesh, intercepted plaintext traffic may expose credentials, session tokens, or other sensitive data
    carried in HTTP headers or request bodies.'