aws-cloudfront-routes-to-origin

id: aws-cloudfront-routes-to-origin
emits: CanNetworkReach
description: A CloudFront distribution can reach its configured origin (S3 bucket, ALB, API Gateway, or
  custom HTTP endpoint) over the network. This is a structural routing fact that feeds the network-chains
  linchpin.
applies_to:
- aws
match_record:
  resource_type: AWS::CloudFront::Distribution
  field: DistributionConfig.Origins.Items
where:
- origin.DomainName is non-empty
- Distribution.Status == 'Deployed' AND Distribution.DistributionConfig.Enabled == true
emit:
  source_type: Network
  target_type: '*'
  source: <CloudFront distribution node>
  target: <origin resource node resolved from origin.DomainName>
  state: CONDITIONAL
  permissions: []
  api_source: cloudfront:GetDistributionConfig
  evidence_field: DistributionConfig.Origins.Items[*].DomainName
  conditions:
  - network_reachability
  - service_state
  state_logic: "CONDITIONAL(network_reachability) when the distribution is Deployed and Enabled. The distribution's\
    \ ability to reach the origin depends on network routing and origin availability. Emit one edge per\
    \ origin item (S3, ALB, custom HTTP). Origin target resolution: match DomainName suffix to node type\
    \ \u2014\n  *.s3.amazonaws.com or *.s3.<region>.amazonaws.com -> Storage;\n  *.s3-website-*.amazonaws.com\
    \ -> Storage (website endpoint);\n  *.execute-api.<region>.amazonaws.com -> Network;\n  an ALB DNS\
    \ name -> Network;\n  any other DomainName -> Network (custom HTTP origin)."
  derived_from:
  - DistributionConfig.Origins.Items[*].DomainName observation (Deployed state)
  schema_note: 'CanNetworkReach.target is declared as [Compute, Data, Network, PrivateEndpoint, Storage]
    in edges.yaml. At rule definition time, we emit target_type: "*" because the collector resolves the
    actual origin type at runtime (S3 bucket -> Storage, ALB -> Network, API GW -> Network, custom HTTP
    -> Network). All possible origin types fit within the declared target set, so runtime emission conforms
    to the schema.'
  false_positive_note: "CanNetworkReach is a structural network fact, not an attack capability \u2014\
    \ it is used as input to the network-chains linchpin for end-to-end path composition. If the origin\
    \ is an S3 website endpoint (*.s3-website-*.amazonaws.com), it uses bucket-level public-access configuration,\
    \ NOT OAC/OAI \u2014 do not emit PrivateReachability for website-endpoint origins. If the distribution\
    \ has a custom origin protocol policy of HTTP-only, note that in evidence (data in transit is unencrypted\
    \ to the origin) but do not change the edge state. The CONDITIONAL(network_reachability) state reflects\
    \ that the distribution's reach to the origin depends on network routing and origin availability."
  narrative: CloudFront distribution {source.name} can reach origin {target.name} ({origin.DomainName})
    over the network. The distribution forwards HTTP(S) requests to this origin and retrieves content
    to serve to viewers. An attacker who can modify the distribution config or the origin can intercept
    or replace content for all distribution visitors.