aws-elb-create-internet-facing

A principal with CreateLoadBalancer + CreateListener + CreateTargetGroup + RegisterTargets + EC2 read/write perms can create a new internet-facing ALB or NLB, exposing any registered backend to the public internet. Emit CanCreate(Identity -> LoadBalancer) as a POTENTIAL escalation premise; ExposedToInternet fires on the resulting LB.

derived aws emits CanCreate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scope': None}

where

effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateLoadBalancer' effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateListener' effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateTargetGroup' effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:RegisterTargets' ?scope is at the account or VPC resource scope (not a specific existing LB ARN)

emit

source type	`Identity`
target type	`LoadBalancer`
source	`?principal`
target	`<future internet-facing LoadBalancer in the account/VPC scope>`
permissions	`elasticloadbalancing:CreateLoadBalancer` `elasticloadbalancing:CreateListener` `elasticloadbalancing:CreateTargetGroup` `elasticloadbalancing:RegisterTargets`
conditions	`iam_permission` `scp_or_org_policy`
state logic	POTENTIAL when the principal has the four ELB permissions at a broad scope — the attacker must choose an internet-facing subnet and the VPC must have an IGW attached. CONDITIONAL when there is confirmed evidence of at least one public subnet + IGW in the account. Additional optional permissions amplify the attack: ec2:DescribeSubnets (to enumerate public subnets), ec2:DescribeSecurityGroups (to find or reference existing SGs), ec2:CreateSecurityGroup (to create a new permissive SG), ec2:AuthorizeSecurityGroupIngress (to add rules to an SG for inbound from the internet). With only the base four ELB permissions, the ALB inherits a default SG that may restrict inbound — the amplifier permissions enable more permissive configs. BLOCKED if an SCP denies elasticloadbalancing:CreateLoadBalancer or constrains Scheme to 'internal' only.

Narrative

{principal.name} has elasticloadbalancing:CreateLoadBalancer, CreateListener, CreateTargetGroup, and RegisterTargets at broad scope and can create a new internet-facing ALB or NLB in a public subnet. Once created, that LB would expose any registered EC2/IP/Lambda target to the public internet.

Raw rule rules/derived/aws/elb.yaml

id: aws-elb-create-internet-facing
emits: CanCreate
description: A principal with CreateLoadBalancer + CreateListener + CreateTargetGroup + RegisterTargets
  + EC2 read/write perms can create a new internet-facing ALB or NLB, exposing any registered backend
  to the public internet. Emit CanCreate(Identity -> LoadBalancer) as a POTENTIAL escalation premise;
  ExposedToInternet fires on the resulting LB.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - scope: null
where:
- effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateLoadBalancer'
- effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateListener'
- effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:CreateTargetGroup'
- effective_action_on(?principal, ?scope) contains 'elasticloadbalancing:RegisterTargets'
- ?scope is at the account or VPC resource scope (not a specific existing LB ARN)
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: ?principal
  target: <future internet-facing LoadBalancer in the account/VPC scope>
  permissions:
  - elasticloadbalancing:CreateLoadBalancer
  - elasticloadbalancing:CreateListener
  - elasticloadbalancing:CreateTargetGroup
  - elasticloadbalancing:RegisterTargets
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "POTENTIAL when the principal has the four ELB permissions at a broad scope \u2014 the\
    \ attacker must choose an internet-facing subnet and the VPC must have an IGW attached. CONDITIONAL\
    \ when there is confirmed evidence of at least one public subnet + IGW in the account. Additional\
    \ optional permissions amplify the attack: ec2:DescribeSubnets (to enumerate public subnets), ec2:DescribeSecurityGroups\
    \ (to find or reference existing SGs), ec2:CreateSecurityGroup (to create a new permissive SG), ec2:AuthorizeSecurityGroupIngress\
    \ (to add rules to an SG for inbound from the internet). With only the base four ELB permissions,\
    \ the ALB inherits a default SG that may restrict inbound \u2014 the amplifier permissions enable\
    \ more permissive configs. BLOCKED if an SCP denies elasticloadbalancing:CreateLoadBalancer or constrains\
    \ Scheme to 'internal' only."
  confidence: 0.7
  derived_from:
  - ?principal HasPermission ?scope (elasticloadbalancing:CreateLoadBalancer, CreateListener, CreateTargetGroup,
    RegisterTargets)
  false_positive_note: 'POTENTIAL-state edge by default. The attacker needs a public subnet with an IGW;
    not all VPCs have this. An SCP constraining LB scheme to ''internal'' blocks the internet-facing variant.
    Confidence (0.70) reflects that VPC topology and SCP constraints must be confirmed. The base four
    permissions are necessary and sufficient to emit this edge; additional EC2 perms (DescribeSubnets,
    CreateSecurityGroup, etc.) are optional amplifiers and not listed as requirements. The exposure chain
    is: CanCreate(this rule) -> [LB created] -> ExposedToInternet(aws-elb-internet-facing-explicit) ->
    CanNetworkReach(aws-elb-routes-to-target-group); path-finding resolves the chain.'
  narrative: '{principal.name} has elasticloadbalancing:CreateLoadBalancer, CreateListener, CreateTargetGroup,
    and RegisterTargets at broad scope and can create a new internet-facing ALB or NLB in a public subnet.
    Once created, that LB would expose any registered EC2/IP/Lambda target to the public internet.'