rage.fail

aws-tgw-assoc-route-table

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "ec2:AssociateTransitGatewayRouteTable", "ec2:EnableTransitGatewayRouteTablePropagation" ], "resource_arn_pattern": "arn:aws:ec2:*:*:transit-gateway/*", "resource_type": "AWS::EC2::TransitGateway" }

emit

source type	`Identity`
target type	`Network`
source	`<principal>`
target	`<TransitGateway node>`
permissions	`ec2:AssociateTransitGatewayRouteTable` `ec2:EnableTransitGatewayRouteTablePropagation`

Narrative

{principal.name} can re-associate TGW attachments to different route tables or enable CIDR propagation on {tgw.name} (ec2:AssociateTransitGatewayRouteTable / ec2:EnableTransitGatewayRouteTablePropagation), silently opening routing between otherwise-isolated VPCs.

Raw rule rules/explicit/aws-tgw.yaml

id: aws-tgw-assoc-route-table
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - ec2:AssociateTransitGatewayRouteTable
  - ec2:EnableTransitGatewayRouteTablePropagation
  resource_type: AWS::EC2::TransitGateway
  resource_arn_pattern: arn:aws:ec2:*:*:transit-gateway/*
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: <TransitGateway node>
  permissions:
  - ec2:AssociateTransitGatewayRouteTable
  - ec2:EnableTransitGatewayRouteTablePropagation
  api_source: IAM effective-permission evaluator
  evidence_field: effective policy allows ec2:AssociateTransitGatewayRouteTable or ec2:EnableTransitGatewayRouteTablePropagation
    on TGW ARN
  narrative: '{principal.name} can re-associate TGW attachments to different route tables or enable CIDR
    propagation on {tgw.name} (ec2:AssociateTransitGatewayRouteTable / ec2:EnableTransitGatewayRouteTablePropagation),
    silently opening routing between otherwise-isolated VPCs.'