aws-vpc-endpoint-service-cross-account

A PrivateLink producer endpoint with an explicit permission granting access to a foreign account principal is exposed to cross-account consumption. This is a structural fact representing the intended cross-account data-plane exposure.

derived aws emits ExposedToAccount

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`PrivateEndpoint`
target type	`Account`
source	`?endpoint`
target	`<foreign account in the endpoint service permissions>`
conditions	`resource_policy` `network_reachability`
state logic	if endpoint service permissions explicitly list a foreign account: ACTIVE elif permissions list Principal:"*": CONDITIONAL(resource_policy) — depends on downstream resource policy else: do not emit

source type

PrivateEndpoint

target type

Account

source

?endpoint

target

<foreign account in the endpoint service permissions>

conditions

resource_policy network_reachability

state logic

if endpoint service permissions explicitly list a foreign account: ACTIVE elif permissions list Principal:"*": CONDITIONAL(resource_policy) — depends on downstream resource policy else: do not emit

Narrative

VPC Endpoint Service {endpoint.name} has explicitly granted access permissions to principals in account {target.name} - cross-account consumers can reach the service endpoint via PrivateLink networking.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-endpoint-service-cross-account
emits: ExposedToAccount
description: A PrivateLink producer endpoint with an explicit permission granting access to a foreign
  account principal is exposed to cross-account consumption. This is a structural fact representing the
  intended cross-account data-plane exposure.
match:
- - endpoint: null
  - LocatedIn
  - vpc: null
where:
- node_type(?endpoint) == PrivateEndpoint
- ?endpoint.VpcEndpointType == 'Interface'
- ?endpoint.ServiceName == <producer service>
- endpoint_service_has_permission(?endpoint, principal_account != this_account)
emit:
  source_type: PrivateEndpoint
  target_type: Account
  source: ?endpoint
  target: <foreign account in the endpoint service permissions>
  permissions: []
  conditions:
  - resource_policy
  - network_reachability
  state_logic: "if endpoint service permissions explicitly list a foreign account: ACTIVE elif permissions\
    \ list Principal:\"*\": CONDITIONAL(resource_policy) \u2014 depends on downstream resource policy\
    \ else: do not emit"
  confidence: 0.85
  derived_from:
  - LocatedIn(?endpoint, ?vpc)
  - endpoint_service_permissions include foreign account
  false_positive_note: An endpoint service permission granting access to a foreign account exposes the
    endpoint at the network layer (PrivateReachability from the foreign account). Actual data-plane access
    depends on the resource policy of the backing service (S3 bucket policy, DynamoDB table policy, etc.).
    If the backing resource policy does NOT allow the foreign account principal, data access is blocked
    despite network exposure. Emit only when both the endpoint permission AND resource policy are confirmed
    to allow the foreign account.
  narrative: "VPC Endpoint Service {endpoint.name} has explicitly granted access permissions to principals\
    \ in account {target.name} \u2014 cross-account consumers can reach the service endpoint via PrivateLink\
    \ networking."