aws-ram-shared-tgw-network-reach

A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'share': None} CrossAccountTrust {'consumer_account': None}

where

node_type(?share) == ResourcePolicy # RAM ResourceShare node_type(?consumer_account) == Account ?share.resourceArns contains a Transit Gateway ARN (shared_resource_type == TransitGateway) ?share.status == 'ACTIVE' ?share.allowExternalPrincipals == true OR consumer_account is in the same AWS Organization

emit

source type	`Network`
target type	`Network`
source	`<consumer VPC (Network) that can attach to the shared TGW>`
target	`<owner-account VPCs and subnets routable via the shared TGW (Network)>`
permissions	`ec2:CreateTransitGatewayVpcAttachment` `ec2:DescribeTransitGatewayAttachments`
conditions	`service_state` `network_reachability`
state logic	POTENTIAL when the share is ACTIVE but no consumer attachment exists yet (consumer has the right to create one; the routing path is realizable). ACTIVE when the consumer has an existing confirmed TGW attachment (ec2:DescribeTransitGatewayAttachments + TGW route table evaluation). CONDITIONAL(service_state) when the share is PENDING. CONDITIONAL(network_reachability) on the TGW route table configuration and owner-account SG rules for targets reached via the TGW. BLOCKED if an SCP denies ec2:CreateTransitGatewayVpcAttachment in the consumer account.

Narrative

RAM share {share.name} grants account {consumer_account.name} access to Transit Gateway {tgw.name}. The consumer can attach their VPC to the TGW (ec2:CreateTransitGatewayVpcAttachment), establishing a network path through the owner's TGW to other attached VPCs, potentially including owner-account network segments (subject to TGW route table and SG rules).

Raw rule rules/derived/aws/ram.yaml

id: aws-ram-shared-tgw-network-reach
emits: CanNetworkReach
description: A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached
  to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.
match:
- - share: null
  - CrossAccountTrust
  - consumer_account: null
where:
- 'node_type(?share) == ResourcePolicy   # RAM ResourceShare'
- node_type(?consumer_account) == Account
- ?share.resourceArns contains a Transit Gateway ARN (shared_resource_type == TransitGateway)
- ?share.status == 'ACTIVE'
- ?share.allowExternalPrincipals == true OR consumer_account is in the same AWS Organization
emit:
  source_type: Network
  target_type: Network
  source: <consumer VPC (Network) that can attach to the shared TGW>
  target: <owner-account VPCs and subnets routable via the shared TGW (Network)>
  permissions:
  - ec2:CreateTransitGatewayVpcAttachment
  - ec2:DescribeTransitGatewayAttachments
  conditions:
  - service_state
  - network_reachability
  state_logic: POTENTIAL when the share is ACTIVE but no consumer attachment exists yet (consumer has
    the right to create one; the routing path is realizable). ACTIVE when the consumer has an existing
    confirmed TGW attachment (ec2:DescribeTransitGatewayAttachments + TGW route table evaluation). CONDITIONAL(service_state)
    when the share is PENDING. CONDITIONAL(network_reachability) on the TGW route table configuration
    and owner-account SG rules for targets reached via the TGW. BLOCKED if an SCP denies ec2:CreateTransitGatewayVpcAttachment
    in the consumer account.
  confidence: min(contributing_confidences) * 0.80
  derived_from:
  - <CrossAccountTrust edge_id (share -> consumer_account)>
  - <shared_resource_type == TransitGateway>
  - <TGW attachment status + route table configuration>
  false_positive_note: "CanNetworkReach here expresses that the consumer VPC is on a routing path via\
    \ the shared TGW; it does not assert bidirectional connectivity to every owner-account resource. The\
    \ TGW route table is owner-managed and controls which attachments can reach which other attachments.\
    \ When no consumer attachment exists yet, POTENTIAL is appropriate \u2014 the share grants the consumer\
    \ the RIGHT to create the attachment but it is not yet realized. If the TGW has a default deny route\
    \ table, keep CONDITIONAL(network_reachability). Do NOT assert that the consumer can reach all owner-account\
    \ VPCs just because the TGW is shared; only the specifically-routed attachments."
  narrative: RAM share {share.name} grants account {consumer_account.name} access to Transit Gateway {tgw.name}.
    The consumer can attach their VPC to the TGW (ec2:CreateTransitGatewayVpcAttachment), establishing
    a network path through the owner's TGW to other attached VPCs, potentially including owner-account
    network segments (subject to TGW route table and SG rules).