aws-directconnect-dxgw-cross-account-trust

id: aws-directconnect-dxgw-cross-account-trust
emits: CrossAccountTrust
description: A Direct Connect Gateway-to-TransitGateway association spanning account boundaries establishes
  network-layer trust (on-prem has routed path into remote account's VPCs).
applies_to:
- aws
match:
- - dxgw: null
where:
- node_type(?dxgw) == TransitGateway
- ?dxgw.provider_type == 'AWS::DirectConnect::DirectConnectGateway'
- exists(?dxgw.properties.directConnectGatewayAssociations[?associationState == 'associated' AND associatedGateway.ownerAccount
  != ?dxgw.account])
emit:
  source_type: Account
  target_type: Account
  source: <AWS Account owning ?dxgw (?dxgw.account)>
  target: extract_account_from_cross_assoc(?dxgw)
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability): the cross-account trust exists when the DXGW has at
    least one association in state ''associated'' with a TGW in a different account.'
  confidence: 0.9
  derived_from:
  - DescribeDirectConnectGatewayAssociations[].associationState == 'associated' AND associatedGateway.ownerAccount
    != directConnectGatewayOwnerAccount
  false_positive_note: '(1) This edge models network-layer trust, not IAM trust. The target is the AWS
    Account (boundary), not an Identity. The threat model is network-level lateral movement, not IAM escalation.
    (2) Even with this trust edge, the attacker-controlled on-prem endpoint must still exploit a vulnerable
    service in the target account''s VPCs to pivot. (3) Multiple cross-account associations: if a DXGW
    has multiple associated TGWs in different accounts, a separate CrossAccountTrust edge is emitted for
    each target account.'
  narrative: The Direct Connect Gateway {dxgw.name} (in account {dxgw.account}) has an accepted association
    to a Transit Gateway in a different AWS account, establishing a routed path from the on-premises network
    into that account's VPCs. This is a network-layer cross-account trust relationship.