aws-vpc-endpoint-private-reach-compute

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Derived from the endpoint state and VPC co-location facts.

derived aws emits PrivateReachability

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`PrivateEndpoint`
source	`?compute`
target	`?endpoint`
conditions	`network_reachability`
state logic	if endpoint state == 'available' AND endpoint DNS resolves within the VPC AND endpoint SG allows inbound from ?compute SG or CIDR: ACTIVE elif endpoint state == 'available' but SG reachability unverified: CONDITIONAL(network_reachability) elif endpoint state != 'available': do not emit

source type

Compute

target type

PrivateEndpoint

source

?compute

target

?endpoint

conditions

network_reachability

state logic

if endpoint state == 'available' AND endpoint DNS resolves within the VPC AND endpoint SG allows inbound from ?compute SG or CIDR: ACTIVE elif endpoint state == 'available' but SG reachability unverified: CONDITIONAL(network_reachability) elif endpoint state != 'available': do not emit

Narrative

Compute resource {compute.name} can reach the backing service of interface endpoint {endpoint.name} from within {vpc.name} via private networking - the endpoint provides a private IP address without internet routing.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-endpoint-private-reach-compute
emits: PrivateReachability
description: An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service
  reachable from compute within the VPC via private networking, without traversing the public internet.
  Derived from the endpoint state and VPC co-location facts.
match:
- - endpoint: null
  - LocatedIn
  - vpc: null
- - compute: null
  - LocatedIn
  - vpc: null
where:
- node_type(?endpoint) == PrivateEndpoint
- node_type(?compute) in [VirtualMachine, ContainerService, ServerlessFunction, GenericCompute]
- ?endpoint.VpcEndpointType == 'Interface'
- ?endpoint.State == 'available'
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: ?compute
  target: ?endpoint
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if endpoint state == 'available' AND endpoint DNS resolves within the VPC AND endpoint\
    \ SG allows inbound from ?compute SG or CIDR: ACTIVE elif endpoint state == 'available' but SG reachability\
    \ unverified:\n  CONDITIONAL(network_reachability)\nelif endpoint state != 'available': do not emit"
  confidence: 0.9
  derived_from:
  - LocatedIn(?endpoint, ?vpc)
  - LocatedIn(?compute, ?vpc)
  - endpoint_state == available
  false_positive_note: PrivateReachability is a NETWORK-LAYER capability; it means the compute can reach
    the endpoint via private IP without internet routing. The endpoint's security group controls which
    compute resources can connect to the endpoint ENI. If the endpoint SG only allows specific source
    SGs, emit as CONDITIONAL(network_reachability) unless the compute's SG is confirmed as a permitted
    source. The endpoint policy additionally restricts which IAM principals and actions are permitted
    through the endpoint; that is a separate HasPolicy edge (not network reachability). Only emit when
    co-location in the VPC and endpoint availability are confirmed.
  narrative: "Compute resource {compute.name} can reach the backing service of interface endpoint {endpoint.name}\
    \ from within {vpc.name} via private networking \u2014 the endpoint provides a private IP address\
    \ without internet routing."