aws-vpc-endpoint-service-perm-modify

A principal with ec2:ModifyVpcEndpointServicePermissions can grant or revoke access to a PrivateLink producer endpoint, controlling which principals (including foreign accounts) can consume the service.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`PrivateEndpoint`
source	`?principal`
target	`?endpoint`
permissions	`ec2:ModifyVpcEndpointServicePermissions`
conditions	`iam_permission`
state logic	if effective permission present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

source type

Identity

target type

PrivateEndpoint

source

?principal

target

?endpoint

permissions

ec2:ModifyVpcEndpointServicePermissions

conditions

iam_permission

state logic

if effective permission present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

Narrative

{principal.name} can modify the access permissions for VPC Endpoint Service {endpoint.name} (ec2:ModifyVpcEndpointServicePermissions), controlling which principals (including those in other AWS accounts) can consume this PrivateLink service endpoint.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-endpoint-service-perm-modify
emits: CanModifyConfiguration
description: A principal with ec2:ModifyVpcEndpointServicePermissions can grant or revoke access to a
  PrivateLink producer endpoint, controlling which principals (including foreign accounts) can consume
  the service.
match:
- - principal: null
  - HasPermission
  - endpoint: null
where:
- node_type(?endpoint) == PrivateEndpoint
- effective_permission(?principal, ?endpoint) contains 'ec2:ModifyVpcEndpointServicePermissions'
emit:
  source_type: Identity
  target_type: PrivateEndpoint
  source: ?principal
  target: ?endpoint
  permissions:
  - ec2:ModifyVpcEndpointServicePermissions
  conditions:
  - iam_permission
  state_logic: 'if effective permission present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else:
    CONDITIONAL(iam_permission)'
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?endpoint) [ec2:ModifyVpcEndpointServicePermissions]
  false_positive_note: ec2:ModifyVpcEndpointServicePermissions controls the principal allowlist for a
    PrivateLink service. By default, services are not accessible to any principals. Adding permissions
    grants access. The principal can add Principal:"*" (allow all) or specific accounts/role ARNs. Cross-account
    exposure is created when a foreign account principal is added to the allowlist. The impact depends
    on whether data flows through the endpoint (network-layer) and whether downstream resource policies
    (S3 bucket policy, DynamoDB policy) permit the external principal.
  narrative: '{principal.name} can modify the access permissions for VPC Endpoint Service {endpoint.name}
    (ec2:ModifyVpcEndpointServicePermissions), controlling which principals (including those in other
    AWS accounts) can consume this PrivateLink service endpoint.'