aws-tgw-route-inject-modify-config

A principal with ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on a TGW route table can inject or overwrite routes, redirecting inter-VPC or on-premises traffic to an attacker-controlled attachment - man-in-the-middle at L3 or traffic sinkhole. Modeled as CanModifyConfiguration on the Route (TGW route table) node.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'route_table': None}

where

node_type(?principal) in [Identity] node_type(?route_table) == Route # TGW Route Table node ?principal has EFFECTIVE ec2:CreateTransitGatewayRoute OR ec2:ReplaceTransitGatewayRoute on ?route_table (or resource scope covers it)

emit

source type	`Identity`
target type	`Route`
source	`?principal`
target	`?route_table`
permissions	`ec2:CreateTransitGatewayRoute` `ec2:ReplaceTransitGatewayRoute`
conditions	`iam_permission` `condition_expression`
state logic	ACTIVE when the principal has EFFECTIVE (post-evaluation) ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on the route table ARN (or a wildcard resource scope covering it), and no SCP or permission boundary denies it. BLOCKED if an SCP or boundary denies the action at this resource scope.

Narrative

{principal.name} has ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on TGW route table {route_table.name}. An attacker can inject or overwrite a route to redirect traffic for any CIDR to an attacker-controlled VPC attachment, enabling L3 traffic interception or a man-in-the-middle path across VPCs or to on-premises.

Raw rule rules/derived/aws/tgw.yaml

id: aws-tgw-route-inject-modify-config
emits: CanModifyConfiguration
description: "A principal with ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on a TGW\
  \ route table can inject or overwrite routes, redirecting inter-VPC or on-premises traffic to an attacker-controlled\
  \ attachment \u2014 man-in-the-middle at L3 or traffic sinkhole. Modeled as CanModifyConfiguration on\
  \ the Route (TGW route table) node."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - route_table: null
where:
- node_type(?principal) in [Identity]
- 'node_type(?route_table) == Route   # TGW Route Table node'
- ?principal has EFFECTIVE ec2:CreateTransitGatewayRoute OR ec2:ReplaceTransitGatewayRoute on ?route_table
  (or resource scope covers it)
emit:
  source_type: Identity
  target_type: Route
  source: ?principal
  target: ?route_table
  permissions:
  - ec2:CreateTransitGatewayRoute
  - ec2:ReplaceTransitGatewayRoute
  conditions:
  - iam_permission
  - condition_expression
  state_logic: ACTIVE when the principal has EFFECTIVE (post-evaluation) ec2:CreateTransitGatewayRoute
    or ec2:ReplaceTransitGatewayRoute on the route table ARN (or a wildcard resource scope covering it),
    and no SCP or permission boundary denies it. BLOCKED if an SCP or boundary denies the action at this
    resource scope.
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - '<HasPermission edge: ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on route_table>'
  false_positive_note: "Honor resource scope: ec2:CreateTransitGatewayRoute requires the route table ARN\
    \ (arn:aws:ec2:*:*:transit-gateway-route-table/*) in the resource condition. A resource:\"*\" grant\
    \ is wide and covers all TGW route tables in the account. A narrowly-scoped grant covers only specific\
    \ route tables \u2014 do not expand the target set beyond confirmed resource scope. ec2:DeleteTransitGatewayRoute\
    \ (traffic black-hole) is DESTRUCTIVE and excluded from this rule; it does not yield an attack path\
    \ by itself (it removes routing, does not redirect it). Emitting for REPLACE vs. CREATE: both are\
    \ equivalent from a route-injection standpoint (REPLACE overwrites an existing route, CREATE adds\
    \ a new one). The CanModifyConfiguration edge covers both."
  narrative: '{principal.name} has ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on
    TGW route table {route_table.name}. An attacker can inject or overwrite a route to redirect traffic
    for any CIDR to an attacker-controlled VPC attachment, enabling L3 traffic interception or a man-in-the-middle
    path across VPCs or to on-premises.'