rage.fail

aws-ec2-open-security-group

derived aws emits CanNetworkReach

match (effective permission)

{ "action": "ec2:AuthorizeSecurityGroupIngress", "resource_type": "AWS::EC2::SecurityGroup" }

emit

source	`<principal>`
target	`<instances using the SG>`
permissions	`ec2:AuthorizeSecurityGroupIngress` `ec2:ModifySecurityGroupRules?`
conditions	`network_reachability`

Narrative

{principal.name} can add an ingress rule to {sg.name} (ec2:AuthorizeSecurityGroupIngress), opening network reach to instances using it.

Raw rule rules/derived/aws/ec2.yaml

id: aws-ec2-open-security-group
emits: CanNetworkReach
match_effective_permission:
  action: ec2:AuthorizeSecurityGroupIngress
  resource_type: AWS::EC2::SecurityGroup
optional_permission: ec2:ModifySecurityGroupRules
emit:
  source: <principal>
  target: <instances using the SG>
  permissions:
  - ec2:AuthorizeSecurityGroupIngress
  - ec2:ModifySecurityGroupRules?
  conditions:
  - network_reachability
  note: Realizes/creates CanReachPort to management ports (22/3389), gating CanExecuteCommand and lateral
    movement; if opened to 0.0.0.0/0 also feeds ExposedToInternet.
  false_positive_note: Only meaningful when the SG is attached to a target instance and the newly-allowed
    source includes the attacker (or 0.0.0.0/0). Route/NACL must also permit the path.
  narrative: '{principal.name} can add an ingress rule to {sg.name} (ec2:AuthorizeSecurityGroupIngress),
    opening network reach to instances using it.'