aws-tgw-cross-account-enter

id: aws-tgw-cross-account-enter
emits: CanNetworkReach
description: A consumer-account VPC with a confirmed (state==available) attachment to an owner-account
  Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table
  routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane
  account entry (CanEnterAccount).
applies_to:
- aws
match:
- - share: null
  - CrossAccountTrust
  - consumer_account: null
- - tgw: null
  - RoutesTo
  - subnet: null
where:
- 'node_type(?share) == ResourcePolicy   # RAM ResourceShare sharing the TGW'
- node_type(?consumer_account) == Account
- node_type(?tgw) == TransitGateway
- 'node_type(?subnet) == Subnet   # owner-account subnet reachable via TGW'
- ?tgw is the shared resource referenced in ?share.resourceArns
- '?subnet.account != ?consumer_account.id   # owner-account subnet (cross-account target)'
- consumer-account VPC attachment to ?tgw state == 'available' (ec2:DescribeTransitGatewayVpcAttachments
  confirmed)
- TGW route table has a route entry routing to ?subnet's CIDR from the consumer attachment
emit:
  source_type: Network
  target_type: Subnet
  source: <consumer VPC (VirtualNetwork containing the attachment subnets)>
  target: <owner-account Subnet reachable via TGW routes>
  permissions: []
  conditions:
  - network_reachability
  - service_state
  state_logic: CONDITIONAL(network_reachability) when the attachment is 'available', a matching TGW route
    table entry exists routing the owner CIDR via the consumer attachment, but security groups on owner-account
    ENIs still gate L4 access. CONDITIONAL(service_state) when the attachment is 'pendingAcceptance' (owner
    must accept first). POTENTIAL when the RAM share is ACTIVE and the consumer can create an attachment
    but has not yet done so. BLOCKED if SCP denies ec2:CreateTransitGatewayVpcAttachment in the consumer
    account or if AutoAcceptSharedAttachments==false AND the owner has not yet accepted the attachment.
    Never ACTIVE without confirming attachment state == 'available' AND a routed path in the TGW route
    tables.
  confidence: min(contributing_confidences) * 0.80
  derived_from:
  - <CrossAccountTrust edge_id (RAM share -> consumer_account)>
  - <RoutesTo edge_id (tgw -> owner-account subnet)>
  - <TGW VPC attachment state == available in consumer account>
  - <TGW route table entry routing owner CIDR via consumer attachment>
  false_positive_note: "This edge represents L3 NETWORK reachability only, not IAM/control-plane account\
    \ entry. Source type is Network (consumer VPC), target is Subnet (owner-account), per schema/edges.yaml\
    \ CanNetworkReach constraints. This edge requires BOTH the RAM share CrossAccountTrust AND a confirmed\
    \ 'available' TGW attachment AND a matching TGW route table entry. Without all three conditions, the\
    \ edge is POTENTIAL or CONDITIONAL. Security groups on owner-account ENIs gate L4 access; emit CONDITIONAL(network_\
    \ reachability) and note this for the analyst. Do NOT conflate with CanEnterAccount or IAM cross-account\
    \ access \u2014 TGW grants network-layer routing access only. The source is the consumer VPC (Network\
    \ class), not an IAM principal, because this is a reachability fact, not an authorization fact. Full\
    \ exploitation requires reaching a listening service inside the owner-account subnet."
  narrative: Consumer VPC {consumer_vpc.name} (account {consumer_account.name}) has a confirmed attachment
    to Transit Gateway {tgw.name} (owner account {owner_account.name}). The TGW route table routes owner-account
    subnet {subnet.name} CIDR via the consumer attachment, creating L3 network reachability from the consumer
    VPC to the owner account's subnets. Full exploitation requires overcoming L4 security group rules
    at owner- account ENIs (CONDITIONAL(network_reachability)).