aws-tgw-assoc-modify-config

id: aws-tgw-assoc-modify-config
emits: CanModifyConfiguration
description: "A principal with ec2:AssociateTransitGatewayRouteTable or ec2:EnableTransitGatewayRouteTablePropagation\
  \ can silently re-route an attachment to a permissive route table or add a propagation that opens routing\
  \ between otherwise-isolated VPCs \u2014 a quiet network-isolation bypass. Modeled as CanModifyConfiguration\
  \ on the TransitGateway node."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - tgw: null
where:
- node_type(?principal) in [Identity]
- node_type(?tgw) == TransitGateway
- ?principal has EFFECTIVE ec2:AssociateTransitGatewayRouteTable OR ec2:EnableTransitGatewayRouteTablePropagation
  on ?tgw (or covering resource scope)
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?tgw
  permissions:
  - ec2:AssociateTransitGatewayRouteTable
  - ec2:EnableTransitGatewayRouteTablePropagation
  conditions:
  - iam_permission
  - condition_expression
  state_logic: 'ACTIVE when the principal has EFFECTIVE ec2:AssociateTransitGatewayRouteTable or ec2:EnableTransitGatewayRouteTablePropagation
    on the TGW ARN and no SCP or permission boundary denies it. BLOCKED if denied. Resource scope: AssociateTransitGatewayRouteTable
    requires both the transit-gateway-attachment and transit-gateway-route-table ARNs; EnableTransitGatewayRouteTablePropagation
    similarly. Honor those constraints.'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - '<HasPermission edge: ec2:AssociateTransitGatewayRouteTable or ec2:EnableTransitGatewayRouteTablePropagation
    on ?tgw>'
  false_positive_note: ec2:AssociateTransitGatewayRouteTable requires the ARNs for BOTH the attachment
    AND the route table; a principal who cannot reach an existing attachment cannot use this permission
    to re-associate. Do NOT assert this capability if the only CIDR that would open is already routed
    or if the destination route table has no permissive entries that open additional paths. ec2:DisassociateTransitGatewayRouteTable
    and ec2:DisableTransitGatewayRouteTablePropagation are DESTRUCTIVE (traffic black-hole); excluded
    as they do not yield an escalation or reachability path by themselves.
  narrative: '{principal.name} can re-associate a TGW attachment to a different route table (ec2:AssociateTransitGatewayRouteTable)
    or enable CIDR propagation (ec2:EnableTransitGatewayRouteTablePropagation) on {tgw.name}, silently
    opening routing paths between otherwise-isolated VPCs (network-isolation bypass).'