aws-globalaccelerator-internet-exposure

A DEPLOYED Global Accelerator with anycast IPs enabled is internet-reachable. This rule derives the exposure fact from the normalizer's structural Accelerator node.

derived aws emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`LoadBalancer`
target type	`AnonymousIdentity`
source	`?accelerator`
target	`<AnonymousIdentity>`
conditions	`service_state`
state logic	ACTIVE when Status == DEPLOYED and Enabled == true. CONDITIONAL(service_state) when Status == IN_PROGRESS or Enabled == false.

source type

LoadBalancer

target type

AnonymousIdentity

source

?accelerator

target

<AnonymousIdentity>

conditions

service_state

state logic

ACTIVE when Status == DEPLOYED and Enabled == true. CONDITIONAL(service_state) when Status == IN_PROGRESS or Enabled == false.

Narrative

{source.name} (AWS Global Accelerator) is deployed with anycast static IPs that are reachable from any host on the public internet. Backend endpoints in its Endpoint Groups receive internet traffic forwarded via these IPs.

Raw rule rules/derived/aws/globalaccelerator.yaml

id: aws-globalaccelerator-internet-exposure
emits: ExposedToInternet
description: A DEPLOYED Global Accelerator with anycast IPs enabled is internet-reachable. This rule derives
  the exposure fact from the normalizer's structural Accelerator node.
applies_to:
- aws
match:
- - accelerator: null
  - IsOfType
  - LoadBalancer
where:
- ?accelerator.provider_type == 'AWS::GlobalAccelerator::Accelerator'
- ?accelerator.Status == 'DEPLOYED'
- ?accelerator.Enabled == true
- ?accelerator.IpSets is non-empty
emit:
  source_type: LoadBalancer
  target_type: AnonymousIdentity
  source: ?accelerator
  target: <AnonymousIdentity>
  state: ACTIVE
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when Status == DEPLOYED and Enabled == true. CONDITIONAL(service_state) when Status
    == IN_PROGRESS or Enabled == false.
  derived_from:
  - accelerator_normalization (structural fact)
  confidence: 1.0
  false_positive_note: Do NOT emit for accelerators with Status != DEPLOYED or Enabled == false. Do NOT
    emit ExposedToInternet on backend endpoints; the accelerator is the internet-facing node. Internal
    ALB endpoints remain internal even when reachable via the accelerator's anycast IPs.
  narrative: '{source.name} (AWS Global Accelerator) is deployed with anycast static IPs that are reachable
    from any host on the public internet. Backend endpoints in its Endpoint Groups receive internet traffic
    forwarded via these IPs.'