aws-vpc-endpoint-private-reach

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Source is any Compute node in the VPC that has network access to the endpoint ENI.

derived aws emits PrivateReachability

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'endpoint': None} LocatedIn {'vpc': None} {'compute': None} LocatedIn {'vpc': None}

where

node_type(?endpoint) == PrivateEndpoint node_type(?compute) in [VirtualMachine, ContainerService, ServerlessFunction, GenericCompute] ?endpoint.VpcEndpointType == 'Interface' ?endpoint.State == 'available'

emit

source type	`Compute`
target type	`PrivateEndpoint`
source	`?compute`
target	`?endpoint`
conditions	`network_reachability`
state logic	if endpoint state == 'available' AND DNS name resolves within VPC AND endpoint SG allows inbound from ?compute SG/CIDR: ACTIVE (private reach fact) elif endpoint state == 'available' but SG reachability unverified: CONDITIONAL(network_reachability) elif endpoint state != 'available': do not emit

Narrative

{compute.name} can reach the backing service of interface endpoint {endpoint.name} from within {vpc.name} via private networking - the endpoint provides a private IP within the VPC's address space without internet routing.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-endpoint-private-reach
emits: PrivateReachability
description: An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service
  reachable from compute within the VPC via private networking, without traversing the public internet.
  Source is any Compute node in the VPC that has network access to the endpoint ENI.
match:
- - endpoint: null
  - LocatedIn
  - vpc: null
- - compute: null
  - LocatedIn
  - vpc: null
where:
- node_type(?endpoint) == PrivateEndpoint
- node_type(?compute) in [VirtualMachine, ContainerService, ServerlessFunction, GenericCompute]
- ?endpoint.VpcEndpointType == 'Interface'
- ?endpoint.State == 'available'
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: ?compute
  target: ?endpoint
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if endpoint state == 'available' AND DNS name resolves within VPC AND endpoint SG allows\
    \ inbound from ?compute SG/CIDR:\n  ACTIVE (private reach fact)\nelif endpoint state == 'available'\
    \ but SG reachability unverified:\n  CONDITIONAL(network_reachability)\nelif endpoint state != 'available':\
    \ do not emit"
  confidence: 0.9
  derived_from:
  - LocatedIn(?endpoint, ?vpc)
  - LocatedIn(?compute, ?vpc)
  - endpoint_type == Interface, state == available
  false_positive_note: "PrivateReachability here means a compute resource co-located in the VPC can reach\
    \ the backing service via the private endpoint DNS name without internet routing. The endpoint's security\
    \ group controls which resources in the VPC can connect to the endpoint ENI \u2014 if the endpoint\
    \ SG only allows specific source SGs, emit as CONDITIONAL(network_reachability) unless the compute's\
    \ SG is confirmed as a permitted source. The endpoint policy additionally restricts which IAM principals\
    \ and actions are permitted through the endpoint; a deny-all endpoint policy blocks data-plane access\
    \ despite network reachability (not modeled here \u2014 endpoint policy is a separate HasPolicy edge).\
    \ Target is the PrivateEndpoint node itself; downstream rules (endpoint -> backing service) can chain\
    \ from here. Source class is Compute (PrivateEndpoint is not in PrivateReachability's declared source\
    \ set in edges.yaml \u2014 Compute is the correct schema-compliant type)."
  narrative: "{compute.name} can reach the backing service of interface endpoint {endpoint.name} from\
    \ within {vpc.name} via private networking \u2014 the endpoint provides a private IP within the VPC's\
    \ address space without internet routing."