aws-directconnect-modify-config

id: aws-directconnect-modify-config
emits: CanModifyConfiguration
description: IAM principal with Direct Connect write actions can create or modify virtual interfaces and
  DXGW associations, altering which networks have a routed path into AWS VPCs (network topology manipulation).
  Covers constructive/expansive actions only (Create, Update, Accept); Delete actions are modeled separately
  as CanDelete.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - dxresource: null
where:
- node_type(?principal) in [Identity]
- node_type(?dxresource) in [Route, TransitGateway]
- ?dxresource.provider_type in ['AWS::DirectConnect::VirtualInterface', 'AWS::DirectConnect::DirectConnectGateway']
- effective_action_on(?principal, ?dxresource) intersects ['directconnect:UpdateVirtualInterfaceAttributes',
  'directconnect:AcceptDirectConnectGatewayAssociationProposal', 'directconnect:CreateDirectConnectGatewayAssociation']
- 'service_state: at_least_one_connection_available'
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?dxresource
  permissions:
  - directconnect:UpdateVirtualInterfaceAttributes
  - directconnect:AcceptDirectConnectGatewayAssociationProposal
  - directconnect:CreateDirectConnectGatewayAssociation
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: "ACTIVE when the effective-permission evaluator confirms at least one of the listed directconnect\
    \ write actions (Create/Update/Accept, excluding Delete) on the VIF or DXGW ARN (or a wildcard resource\
    \ scope) AND at least one Connection or LAG in state 'available' or 'down' exists that the principal\
    \ can reference (from DescribeConnections). BLOCKED if an SCP or permission boundary explicitly denies\
    \ the matching action(s). No resource-based policy or network gate applies to the Direct Connect control\
    \ plane \u2014 IAM is the sole authorization layer."
  confidence: 0.85
  derived_from:
  - '?principal HasPermission ?dxresource (directconnect write actions: Create/Update/Accept)'
  - 'DescribeConnections service_state: connection in available or down state'
  false_positive_note: "(1) Direct Connect control-plane actions are IAM-only \u2014 no resource-based\
    \ policy, VPC endpoint policy, or network gate applies. IAM effective permissions are the sole condition\
    \ to evaluate. (2) This edge is a NETWORK-TOPOLOGY manipulation primitive, not an IAM privilege escalation.\
    \ Do NOT chain directly to CanEnterAccount or CanExecuteAs without intermediate network-reachability\
    \ + exploitation edges. (3) AcceptDirectConnectGatewayAssociationProposal is the higher-risk action:\
    \ it allows the principal to accept an inbound proposal from a remote account's DXGW, which would\
    \ route an external on-prem network into this account's TGW. Analysts should flag this action with\
    \ elevated concern when the DXGW owner account is external. (4) CreateVirtualInterface requires a\
    \ provisioned physical connection (Connection or LAG) in state 'available' or 'down' as the resource\
    \ target. Without at least one such connection, the action is latent. Service state is evaluated by\
    \ DescribeConnections to confirm availability in the account."
  narrative: '{principal.name} can create, modify, or accept Direct Connect configuration (create/update
    VIFs or accept DXGW associations). For VIFs, this allows creating a new private or transit interface
    to route an attacker-controlled on-prem segment into this account''s VPCs. For DXGWs, this allows
    accepting cross-account association proposals, routing a remote on-prem network into this account''s
    Transit Gateway. Both capabilities alter network topology and enable lateral movement from on-premises
    into AWS.'