aws-globalaccelerator-modify-config

A principal with globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints can redirect internet-bound anycast traffic to a different or attacker-influenced endpoint within the account (traffic hijack / defense evasion).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'target': None}

where

(node_type(?target) == LoadBalancer and ?target.provider_type == 'AWS::GlobalAccelerator::Accelerator') or (node_type(?target) == GenericNetwork and ?target.provider_type == 'AWS::GlobalAccelerator::EndpointGroup') effective_action_on(?principal, ?target) intersects [ 'globalaccelerator:UpdateEndpointGroup', 'globalaccelerator:AddEndpoints', 'globalaccelerator:UpdateListener', 'globalaccelerator:UpdateAcceleratorAttributes' ]

emit

source type	`Identity`
target type	`LoadBalancer`
source	`?principal`
target	`if(node_type(?target) == LoadBalancer, ?target, parent Accelerator of ?target)`
permissions	`globalaccelerator:UpdateEndpointGroup` `globalaccelerator:AddEndpoints` `globalaccelerator:UpdateListener` `globalaccelerator:UpdateAcceleratorAttributes`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when effective_action_on(?principal, ?target) includes at least one of the listed actions and no SCP / permission boundary explicitly denies them. BLOCKED when an SCP denies globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints at the account scope.

Narrative

{principal.name} can modify the Global Accelerator {target.name} (globalaccelerator:UpdateEndpointGroup / AddEndpoints), allowing it to redirect internet-facing anycast traffic from the accelerator's static IPs to a different or unintended endpoint within the account. If globalaccelerator:UpdateAcceleratorAttributes is also held, it can redirect or disable flow logs, suppressing network traffic telemetry.

Raw rule rules/derived/aws/globalaccelerator.yaml

id: aws-globalaccelerator-modify-config
emits: CanModifyConfiguration
description: A principal with globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints
  can redirect internet-bound anycast traffic to a different or attacker-influenced endpoint within the
  account (traffic hijack / defense evasion).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - target: null
where:
- (node_type(?target) == LoadBalancer and ?target.provider_type == 'AWS::GlobalAccelerator::Accelerator')
  or (node_type(?target) == GenericNetwork and ?target.provider_type == 'AWS::GlobalAccelerator::EndpointGroup')
- "effective_action_on(?principal, ?target) intersects [\n  'globalaccelerator:UpdateEndpointGroup',\n\
  \  'globalaccelerator:AddEndpoints',\n  'globalaccelerator:UpdateListener',\n  'globalaccelerator:UpdateAcceleratorAttributes'\n\
  ]"
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: ?principal
  target: if(node_type(?target) == LoadBalancer, ?target, parent Accelerator of ?target)
  permissions:
  - globalaccelerator:UpdateEndpointGroup
  - globalaccelerator:AddEndpoints
  - globalaccelerator:UpdateListener
  - globalaccelerator:UpdateAcceleratorAttributes
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when effective_action_on(?principal, ?target) includes at least one of the listed
    actions and no SCP / permission boundary explicitly denies them. BLOCKED when an SCP denies globalaccelerator:UpdateEndpointGroup
    or globalaccelerator:AddEndpoints at the account scope.
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - <HasPermission edge_id>
  false_positive_note: "This edge models TRAFFIC REDIRECTION, not IAM privilege escalation or code execution.\
    \ Do NOT chain to CanExecuteAs or CanEnterAccount from this edge alone \u2014 modifying a routing\
    \ config does not grant AWS credentials. The blast radius is limited to intra-account endpoint targets\
    \ (cross-account endpoints are unsupported by the service). UpdateAcceleratorAttributes (flow-log\
    \ destination change) is a defense-evasion primitive (suppresses network telemetry) rather than a\
    \ routing change; include it in the permission set but note its distinct effect. Honor SCP scoping:\
    \ many organizations restrict globalaccelerator:* to specific roles. Permissions may be scoped to\
    \ EndpointGroup or Accelerator ARNs; both are captured here."
  narrative: '{principal.name} can modify the Global Accelerator {target.name} (globalaccelerator:UpdateEndpointGroup
    / AddEndpoints), allowing it to redirect internet-facing anycast traffic from the accelerator''s static
    IPs to a different or unintended endpoint within the account. If globalaccelerator:UpdateAcceleratorAttributes
    is also held, it can redirect or disable flow logs, suppressing network traffic telemetry.'