aws-vpc-cross-account-peering-trust

A VPC peering connection whose requester and accepter VPCs belong to different AWS accounts represents cross-account network trust. The peering connection record in the accepting account's AWS account constitutes the cross-account authorization artifact, enabling principals in the peer account to reach resources in this account if SG/routing permits.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Account`
target type	`Account`
source	`?vpc_a.account`
target	`?peer_account`
conditions	`network_reachability`
state logic	if peering is active and accounts differ: ACTIVE (the cross-account trust fact); actual network reach is CONDITIONAL(network_reachability) on SG + routing.

source type

Account

target type

Account

source

?vpc_a.account

target

?peer_account

conditions

network_reachability

state logic

if peering is active and accounts differ: ACTIVE (the cross-account trust fact); actual network reach is CONDITIONAL(network_reachability) on SG + routing.

Narrative

VPC peering connection {peering.name} links accounts across an account boundary - network traffic between {vpc_a.name} (account {source.name}) and the peer VPC in account {peer_account.name} is possible where security groups and route tables permit, creating a cross-account lateral movement surface.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-cross-account-peering-trust
emits: CrossAccountTrust
description: A VPC peering connection whose requester and accepter VPCs belong to different AWS accounts
  represents cross-account network trust. The peering connection record in the accepting account's AWS
  account constitutes the cross-account authorization artifact, enabling principals in the peer account
  to reach resources in this account if SG/routing permits.
match:
- - peering: null
  - AttachedTo
  - vpc_a: null
where:
- node_type(?peering) == Peering
- ?peering.status == 'active'
- ?peering.RequesterVpcInfo.OwnerId != ?peering.AccepterVpcInfo.OwnerId
- ?peer_account == account_node(?peering.RequesterVpcInfo.OwnerId or AccepterVpcInfo.OwnerId, opposite_of=?vpc_a.account)
emit:
  source_type: Account
  target_type: Account
  source: ?vpc_a.account
  target: ?peer_account
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'if peering is active and accounts differ: ACTIVE (the cross-account trust fact); actual
    network reach is CONDITIONAL(network_reachability) on SG + routing.'
  confidence: 0.95
  derived_from:
  - AttachedTo(?peering, ?vpc_a)
  - cross-account requester/accepter
  false_positive_note: "This edge expresses that the peering was established between two accounts \u2014\
    \ one account's owner accepted the peering request from the other. The edge does NOT assert that any\
    \ specific resource is reachable; that depends on SG rules allowing traffic from the peer CIDR and\
    \ route tables propagating the peer route. Emit only when both accounts are confirmed distinct and\
    \ peering status is 'active'. The peering connection is the supporting evidence; the edge source is\
    \ the account that owns the accepting VPC (the recipient of the cross-account trust)."
  narrative: "VPC peering connection {peering.name} links accounts across an account boundary \u2014 network\
    \ traffic between {vpc_a.name} (account {source.name}) and the peer VPC in account {peer_account.name}\
    \ is possible where security groups and route tables permit, creating a cross-account lateral movement\
    \ surface."