aws-vpc-endpoint-cross-account-trust

A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ResourcePolicy`
target type	`Account`
source	`<endpoint policy node attached to ?endpoint>`
target	`<external account granted in the endpoint policy>`
conditions	`network_reachability` `resource_policy`
state logic	if endpoint policy explicitly names a foreign account principal: ACTIVE elif policy is Principal:'*' without org-scoping condition: CONDITIONAL(resource_policy) else: do not emit

source type

ResourcePolicy

target type

Account

source

<endpoint policy node attached to ?endpoint>

target

<external account granted in the endpoint policy>

conditions

network_reachability resource_policy

state logic

if endpoint policy explicitly names a foreign account principal: ACTIVE elif policy is Principal:'*' without org-scoping condition: CONDITIONAL(resource_policy) else: do not emit

Narrative

VPC endpoint {endpoint.name} has a policy allowing principals from a different AWS account to access the backing service - cross-account data-plane access is possible through this endpoint for accounts granted in the endpoint policy.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-endpoint-cross-account-trust
emits: CrossAccountTrust
description: A VPC endpoint policy (gateway or interface) granting access to principals in another AWS
  account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint
  policy resource is the trust artifact (modeled as ResourcePolicy source).
match:
- - endpoint: null
  - LocatedIn
  - vpc: null
where:
- node_type(?endpoint) == PrivateEndpoint
- ?endpoint.State == 'available'
- "endpoint_policy_allows_cross_account(?endpoint,\n  principal_condition='aws:PrincipalAccount != this_account'\n\
  \  OR principal='*' without aws:PrincipalOrgID restriction)"
emit:
  source_type: ResourcePolicy
  target_type: Account
  source: <endpoint policy node attached to ?endpoint>
  target: <external account granted in the endpoint policy>
  permissions: []
  conditions:
  - network_reachability
  - resource_policy
  state_logic: 'if endpoint policy explicitly names a foreign account principal: ACTIVE elif policy is
    Principal:''*'' without org-scoping condition: CONDITIONAL(resource_policy) else: do not emit'
  confidence: 0.85
  derived_from:
  - LocatedIn(?endpoint, ?vpc)
  - endpoint_policy cross-account principal
  false_positive_note: "Gateway endpoint policies (S3, DynamoDB) default to allowing all principals; the\
    \ effective restriction comes from the IAM policies of the callers AND the bucket/table resource policy.\
    \ An open gateway endpoint policy alone does not mean a foreign account can access resources through\
    \ it \u2014 the S3 bucket or DynamoDB table resource policy must also allow the foreign principal.\
    \ Downgrade to CONDITIONAL(resource_policy) when the endpoint policy is open but downstream resource\
    \ policies are not verified. Interface endpoint policies are more commonly restrictive \u2014 emit\
    \ only when the policy explicitly grants foreign principals."
  narrative: "VPC endpoint {endpoint.name} has a policy allowing principals from a different AWS account\
    \ to access the backing service \u2014 cross-account data-plane access is possible through this endpoint\
    \ for accounts granted in the endpoint policy."