aws-vpc-nacl-modify-config

A principal with ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry, or ec2:ReplaceNetworkAclAssociation can modify Network ACL rules, changing the firewall posture at the subnet level. This is a weaken-controls primitive for stateless packet filtering, complementary to security groups.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Firewall`
source	`?principal`
target	`?nacl_or_vpc`
permissions	`ec2:CreateNetworkAclEntry` `ec2:ReplaceNetworkAclEntry` `ec2:ReplaceNetworkAclAssociation`
conditions	`iam_permission`
state logic	if any of the NACL modification permissions are effective AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

source type

Identity

target type

Firewall

source

?principal

target

?nacl_or_vpc

permissions

ec2:CreateNetworkAclEntry ec2:ReplaceNetworkAclEntry ec2:ReplaceNetworkAclAssociation

conditions

iam_permission

state logic

if any of the NACL modification permissions are effective AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

Narrative

{principal.name} can create, replace, or modify Network ACL rules on {nacl_or_vpc.name} (ec2:CreateNetworkAclEntry / ec2:ReplaceNetworkAclEntry / ec2:ReplaceNetworkAclAssociation), potentially opening ingress/egress traffic at the subnet level for stateless packet filtering and bypassing SG controls at scale.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-nacl-modify-config
emits: CanModifyConfiguration
description: A principal with ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry, or ec2:ReplaceNetworkAclAssociation
  can modify Network ACL rules, changing the firewall posture at the subnet level. This is a weaken-controls
  primitive for stateless packet filtering, complementary to security groups.
match:
- - principal: null
  - HasPermission
  - nacl_or_vpc: null
where:
- node_type(?nacl_or_vpc) in [Firewall, VirtualNetwork]
- effective_permission(?principal, ?nacl_or_vpc) contains 'ec2:CreateNetworkAclEntry' OR 'ec2:ReplaceNetworkAclEntry'
  OR 'ec2:ReplaceNetworkAclAssociation'
emit:
  source_type: Identity
  target_type: Firewall
  source: ?principal
  target: ?nacl_or_vpc
  permissions:
  - ec2:CreateNetworkAclEntry
  - ec2:ReplaceNetworkAclEntry
  - ec2:ReplaceNetworkAclAssociation
  conditions:
  - iam_permission
  state_logic: 'if any of the NACL modification permissions are effective AND NOT scp_denies: ACTIVE elif
    scp_denies: BLOCKED else: CONDITIONAL(iam_permission)'
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?nacl_or_vpc) [NACL modification permissions]
  false_positive_note: "NACLs are stateless: they enforce rules in BOTH directions (inbound and outbound).\
    \ ec2:CreateNetworkAclEntry adds a new rule; ec2:ReplaceNetworkAclEntry modifies an existing rule\
    \ (commonly flipping a deny to allow or vice versa). ec2:ReplaceNetworkAclAssociation swaps out the\
    \ entire NACL for a subnet, instantly affecting all resources in the subnet. This rule models the\
    \ CAPABILITY to weaken NACL controls \u2014 actual network exposure depends on the resulting rule\
    \ set and security group rules. SGs may still block traffic even if a permissive NACL allow rule is\
    \ added. Emit as CONDITIONAL(network_reachability) if NACL modification is possible but downstream\
    \ SG filtering is unknown."
  narrative: '{principal.name} can create, replace, or modify Network ACL rules on {nacl_or_vpc.name}
    (ec2:CreateNetworkAclEntry / ec2:ReplaceNetworkAclEntry / ec2:ReplaceNetworkAclAssociation), potentially
    opening ingress/egress traffic at the subnet level for stateless packet filtering and bypassing SG
    controls at scale.'