aws-elb-set-security-groups

Replace the security groups on an ALB or CLB with a permissive one to open inbound access from any source to the load balancer (network gate weakening).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'lb': None}

where

node_type(?lb) == LoadBalancer ?lb.provider_type in ['AWS::ElasticLoadBalancingV2::LoadBalancer', 'AWS::ElasticLoadBalancing::LoadBalancer'] ?lb.properties.type in ['application', 'classic'] OR ?lb.properties.SecurityGroups is non-empty effective_action_on(?principal, ?lb) contains 'elasticloadbalancing:SetSecurityGroups'

emit

source type	`Identity`
target type	`LoadBalancer`
source	`?principal`
target	`?lb`
permissions	`elasticloadbalancing:SetSecurityGroups`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective-permission evaluator confirms elasticloadbalancing:SetSecurityGroups on the LB ARN (or wildcard scope). The minimum required permission is SetSecurityGroups alone — the attacker can reference an existing permissive SG in the same VPC to replace the LB's current SGs. An attacker with additional permissions (ec2:AuthorizeSecurityGroupIngress or ec2:CreateSecurityGroup) can create or modify a permissive SG as well, amplifying the attack; however, these are optional amplifiers, not required preconditions. BLOCKED if SCP denies elasticloadbalancing:SetSecurityGroups.

Narrative

{principal.name} can call elasticloadbalancing:SetSecurityGroups on {lb.name}, replacing its security groups with a permissive one. This opens inbound access to the load balancer from any source (0.0.0.0/0), weakening the network control gate that restricts who can reach the backends behind it.

Raw rule rules/derived/aws/elb.yaml

id: aws-elb-set-security-groups
emits: CanModifyConfiguration
description: Replace the security groups on an ALB or CLB with a permissive one to open inbound access
  from any source to the load balancer (network gate weakening).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - lb: null
where:
- node_type(?lb) == LoadBalancer
- ?lb.provider_type in ['AWS::ElasticLoadBalancingV2::LoadBalancer', 'AWS::ElasticLoadBalancing::LoadBalancer']
- ?lb.properties.type in ['application', 'classic'] OR ?lb.properties.SecurityGroups is non-empty
- effective_action_on(?principal, ?lb) contains 'elasticloadbalancing:SetSecurityGroups'
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: ?principal
  target: ?lb
  permissions:
  - elasticloadbalancing:SetSecurityGroups
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when effective-permission evaluator confirms elasticloadbalancing:SetSecurityGroups\
    \ on the LB ARN (or wildcard scope). The minimum required permission is SetSecurityGroups alone \u2014\
    \ the attacker can reference an existing permissive SG in the same VPC to replace the LB's current\
    \ SGs. An attacker with additional permissions (ec2:AuthorizeSecurityGroupIngress or ec2:CreateSecurityGroup)\
    \ can create or modify a permissive SG as well, amplifying the attack; however, these are optional\
    \ amplifiers, not required preconditions. BLOCKED if SCP denies elasticloadbalancing:SetSecurityGroups."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?lb (elasticloadbalancing:SetSecurityGroups)
  false_positive_note: "NLBs (Network Load Balancers) of type 'network' do NOT support security groups\
    \ by default \u2014 this action is ALB/CLB only. Check ?lb.properties.type; if type == 'network' and\
    \ SecurityGroupAssociations is absent/empty, do NOT emit this rule. (Newer opt-in NLB security group\
    \ support is uncommon; collect SecurityGroupAssociations attribute to verify before emitting.) This\
    \ edge is a NETWORK-GATE WEAKENING primitive \u2014 it opens inbound access to the LB, which then\
    \ forwards to backends. Do NOT chain directly to CanEnterAccount / CanExecuteAs; the path continues\
    \ via the RoutesTo + CanNetworkReach linchpin (future network-chains file)."
  narrative: '{principal.name} can call elasticloadbalancing:SetSecurityGroups on {lb.name}, replacing
    its security groups with a permissive one. This opens inbound access to the load balancer from any
    source (0.0.0.0/0), weakening the network control gate that restricts who can reach the backends behind
    it.'