rage.fail

aws-tgw-modify-route-inject

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "ec2:CreateTransitGatewayRoute", "ec2:ReplaceTransitGatewayRoute" ], "resource_arn_pattern": "arn:aws:ec2:*:*:transit-gateway-route-table/*", "resource_type": "AWS::EC2::TransitGatewayRouteTable" }

emit

source type	`Identity`
target type	`Network`
source	`<principal>`
target	`<TransitGatewayRouteTable node (generic_type: Route)>`
permissions	`ec2:CreateTransitGatewayRoute` `ec2:ReplaceTransitGatewayRoute`

Narrative

{principal.name} can inject or replace routes in TGW route table {route_table.name} (ec2:CreateTransitGatewayRoute / ec2:ReplaceTransitGatewayRoute), enabling traffic redirection between attached VPCs or toward on-premises endpoints.

Raw rule rules/explicit/aws-tgw.yaml

id: aws-tgw-modify-route-inject
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - ec2:CreateTransitGatewayRoute
  - ec2:ReplaceTransitGatewayRoute
  resource_type: AWS::EC2::TransitGatewayRouteTable
  resource_arn_pattern: arn:aws:ec2:*:*:transit-gateway-route-table/*
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: '<TransitGatewayRouteTable node (generic_type: Route)>'
  permissions:
  - ec2:CreateTransitGatewayRoute
  - ec2:ReplaceTransitGatewayRoute
  api_source: IAM effective-permission evaluator
  evidence_field: effective policy allows ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute
    on route-table ARN
  narrative: '{principal.name} can inject or replace routes in TGW route table {route_table.name} (ec2:CreateTransitGatewayRoute
    / ec2:ReplaceTransitGatewayRoute), enabling traffic redirection between attached VPCs or toward on-premises
    endpoints.'