rage.fail

aws-tgw-modify-tgw

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "actions": [ "ec2:ModifyTransitGateway" ], "resource_arn_pattern": "arn:aws:ec2:*:*:transit-gateway/*", "resource_type": "AWS::EC2::TransitGateway" }

emit

source type	`Identity`
target type	`Network`
source	`<principal>`
target	`<TransitGateway node>`
permissions	`ec2:ModifyTransitGateway`

Narrative

{principal.name} can modify TGW options on {tgw.name} (ec2:ModifyTransitGateway), including enabling AutoAcceptSharedAttachments. When AutoAcceptSharedAttachments is true, consumer-account VPC attachments automatically transition from 'pendingAcceptance' to 'available' without owner approval, materializing cross-account network pivots into ACTIVE routing paths. This is an escalation primitive that weakens attachment isolation.

Raw rule rules/explicit/aws-tgw.yaml

id: aws-tgw-modify-tgw
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  actions:
  - ec2:ModifyTransitGateway
  resource_type: AWS::EC2::TransitGateway
  resource_arn_pattern: arn:aws:ec2:*:*:transit-gateway/*
emit:
  source_type: Identity
  target_type: Network
  source: <principal>
  target: <TransitGateway node>
  permissions:
  - ec2:ModifyTransitGateway
  api_source: IAM effective-permission evaluator
  evidence_field: effective policy allows ec2:ModifyTransitGateway on TGW ARN
  narrative: '{principal.name} can modify TGW options on {tgw.name} (ec2:ModifyTransitGateway), including
    enabling AutoAcceptSharedAttachments. When AutoAcceptSharedAttachments is true, consumer-account VPC
    attachments automatically transition from ''pendingAcceptance'' to ''available'' without owner approval,
    materializing cross-account network pivots into ACTIVE routing paths. This is an escalation primitive
    that weakens attachment isolation.'