rage.fail

aws-tgw-create-vpc-attachment

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "ec2:CreateTransitGatewayVpcAttachment" ], "resource_arn_pattern": "arn:aws:ec2:*:*:transit-gateway/*", "resource_type": "AWS::EC2::TransitGateway" }

emit

source type	`Identity`
target type	`Network`
source	`<principal>`
target	`<TransitGateway node>`
permissions	`ec2:CreateTransitGatewayVpcAttachment`

Narrative

{principal.name} can create a VPC attachment to {tgw.name} (ec2:CreateTransitGatewayVpcAttachment), joining an attacker-controlled VPC to the TGW routing fabric and gaining routing-level access to other attached VPCs.

Raw rule rules/explicit/aws-tgw.yaml

id: aws-tgw-create-vpc-attachment
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - ec2:CreateTransitGatewayVpcAttachment
  resource_type: AWS::EC2::TransitGateway
  resource_arn_pattern: arn:aws:ec2:*:*:transit-gateway/*
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: <TransitGateway node>
  permissions:
  - ec2:CreateTransitGatewayVpcAttachment
  api_source: IAM effective-permission evaluator
  evidence_field: effective policy allows ec2:CreateTransitGatewayVpcAttachment on TGW ARN
  narrative: '{principal.name} can create a VPC attachment to {tgw.name} (ec2:CreateTransitGatewayVpcAttachment),
    joining an attacker-controlled VPC to the TGW routing fabric and gaining routing-level access to other
    attached VPCs.'