rage.fail

aws-tgw-accept-attachment

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "ec2:AcceptTransitGatewayVpcAttachment" ], "resource_arn_pattern": "arn:aws:ec2:*:*:transit-gateway/*", "resource_type": "AWS::EC2::TransitGateway" }

emit

source type	`Identity`
target type	`Network`
source	`<principal>`
target	`<TransitGateway node>`
permissions	`ec2:AcceptTransitGatewayVpcAttachment`

Narrative

{principal.name} can accept pending VPC attachments to {tgw.name} (ec2:AcceptTransitGatewayVpcAttachment). An owner-account principal with this permission can silently accept a pending cross-account consumer attachment, transitioning it to 'available' and materializing the consumer VPC's routing access to owner-account resources. This is an escalation primitive enabling cross-account network pivots.

Raw rule rules/explicit/aws-tgw.yaml

id: aws-tgw-accept-attachment
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - ec2:AcceptTransitGatewayVpcAttachment
  resource_type: AWS::EC2::TransitGateway
  resource_arn_pattern: arn:aws:ec2:*:*:transit-gateway/*
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: <TransitGateway node>
  permissions:
  - ec2:AcceptTransitGatewayVpcAttachment
  api_source: IAM effective-permission evaluator
  evidence_field: effective policy allows ec2:AcceptTransitGatewayVpcAttachment on TGW ARN
  narrative: '{principal.name} can accept pending VPC attachments to {tgw.name} (ec2:AcceptTransitGatewayVpcAttachment).
    An owner-account principal with this permission can silently accept a pending cross-account consumer
    attachment, transitioning it to ''available'' and materializing the consumer VPC''s routing access
    to owner-account resources. This is an escalation primitive enabling cross-account network pivots.'