aws-route53-private-zone-shadow

route53:CreateHostedZone with --vpc or route53:AssociateVPCWithHostedZone enables creating a shadow private zone or extending an existing zone's resolution scope across VPCs - DNS MITM for all workloads in the associated VPC.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'zone': None}

where

node_type(?zone) == DNS ?zone.provider_type == 'AWS::Route53::HostedZone' ?zone.properties.type == 'Private' effective_action_on(?principal, ?zone) contains 'route53:CreateHostedZone' OR effective_action_on(?principal, ?zone) contains 'route53:AssociateVPCWithHostedZone'

emit

source type	`Identity`
target type	`DNS`
source	`?principal`
target	`?zone`
permissions	`route53:CreateHostedZone` `route53:AssociateVPCWithHostedZone`
conditions	`iam_permission` `scp_or_org_policy` `network_reachability`
state logic	CONDITIONAL(network_reachability) — the IAM permission to create or associate a private zone is confirmed effective, but actual DNS hijacking within a VPC requires the attacker to have network reachability inside that VPC to benefit from the shadowed/extended resolution. An attacker outside all associated VPCs cannot observe or exploit the zone changes. BLOCKED if an SCP denies route53:CreateHostedZone or route53:AssociateVPCWithHostedZone.

Narrative

{principal.name} can create a private hosted zone with an associated VPC, or extend an existing private zone to additional VPCs (route53:CreateHostedZone with --vpc or route53:AssociateVPCWithHostedZone). An attacker with network reachability inside an associated VPC can hijack DNS resolution for all workloads in that VPC - enabling credential capture and MITM attacks on internally-trusted services.

Raw rule rules/derived/aws/route53.yaml

id: aws-route53-private-zone-shadow
emits: CanModifyConfiguration
description: "route53:CreateHostedZone with --vpc or route53:AssociateVPCWithHostedZone enables creating\
  \ a shadow private zone or extending an existing zone's resolution scope across VPCs \u2014 DNS MITM\
  \ for all workloads in the associated VPC."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - zone: null
where:
- node_type(?zone) == DNS
- ?zone.provider_type == 'AWS::Route53::HostedZone'
- ?zone.properties.type == 'Private'
- effective_action_on(?principal, ?zone) contains 'route53:CreateHostedZone' OR effective_action_on(?principal,
  ?zone) contains 'route53:AssociateVPCWithHostedZone'
emit:
  source_type: Identity
  target_type: DNS
  source: ?principal
  target: ?zone
  permissions:
  - route53:CreateHostedZone
  - route53:AssociateVPCWithHostedZone
  conditions:
  - iam_permission
  - scp_or_org_policy
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) \u2014 the IAM permission to create or associate a private\
    \ zone is confirmed effective, but actual DNS hijacking within a VPC requires the attacker to have\
    \ network reachability inside that VPC to benefit from the shadowed/extended resolution. An attacker\
    \ outside all associated VPCs cannot observe or exploit the zone changes. BLOCKED if an SCP denies\
    \ route53:CreateHostedZone or route53:AssociateVPCWithHostedZone."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?zone (route53:CreateHostedZone | route53:AssociateVPCWithHostedZone, Private)
  false_positive_note: "Private zone creation/association is CONDITIONAL on the attacker having network\
    \ reachability inside an associated VPC. Honor the zone's VPC associations \u2014 the zone only affects\
    \ resolution for workloads consulting it within those specific VPCs. Cross-account VPC association\
    \ requires authorization from the VPC owner (AssociateVPCWithHostedZone is typically cross-account\
    \ and needs permission from both zone owner and VPC owner). An SCP denying the action yields BLOCKED."
  narrative: "{principal.name} can create a private hosted zone with an associated VPC, or extend an existing\
    \ private zone to additional VPCs (route53:CreateHostedZone with --vpc or route53:AssociateVPCWithHostedZone).\
    \ An attacker with network reachability inside an associated VPC can hijack DNS resolution for all\
    \ workloads in that VPC \u2014 enabling credential capture and MITM attacks on internally-trusted\
    \ services."