aws-vpc-peering-create-accept

A principal with ec2:CreateVpcPeeringConnection can initiate a VPC peering to any VPC (including cross-account). Accepting requires ec2:AcceptVpcPeeringConnection on the accepter side. This permission enables establishing new cross-VPC connectivity.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`VirtualNetwork`
source	`?principal`
target	`?vpc`
permissions	`ec2:CreateVpcPeeringConnection` `ec2:AcceptVpcPeeringConnection`
conditions	`iam_permission`
state logic	if effective permissions present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

source type

Identity

target type

VirtualNetwork

source

?principal

target

?vpc

permissions

ec2:CreateVpcPeeringConnection ec2:AcceptVpcPeeringConnection

conditions

iam_permission

state logic

if effective permissions present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

Narrative

{principal.name} can initiate or accept VPC peering connections for {vpc.name} (ec2:CreateVpcPeeringConnection / ec2:AcceptVpcPeeringConnection), enabling bidirectional network connectivity to be established between {vpc.name} and any peer VPC, including those in other AWS accounts.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-peering-create-accept
emits: CanModifyConfiguration
description: A principal with ec2:CreateVpcPeeringConnection can initiate a VPC peering to any VPC (including
  cross-account). Accepting requires ec2:AcceptVpcPeeringConnection on the accepter side. This permission
  enables establishing new cross-VPC connectivity.
match:
- - principal: null
  - HasPermission
  - vpc: null
where:
- node_type(?vpc) == VirtualNetwork
- effective_permission(?principal, ?vpc) contains 'ec2:CreateVpcPeeringConnection' OR 'ec2:AcceptVpcPeeringConnection'
emit:
  source_type: Identity
  target_type: VirtualNetwork
  source: ?principal
  target: ?vpc
  permissions:
  - ec2:CreateVpcPeeringConnection
  - ec2:AcceptVpcPeeringConnection
  conditions:
  - iam_permission
  state_logic: 'if effective permissions present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else:
    CONDITIONAL(iam_permission)'
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?vpc) [ec2:CreateVpcPeeringConnection | ec2:AcceptVpcPeeringConnection]
  false_positive_note: "ec2:CreateVpcPeeringConnection alone lets the principal REQUEST a peering; the\
    \ peer account must accept with ec2:AcceptVpcPeeringConnection on its side (or the same principal\
    \ must have accept rights in the target account). Without acceptance, the peering is in 'pending-acceptance'\
    \ state and creates no connectivity \u2014 downgrade to POTENTIAL(network_reachability) if the principal\
    \ cannot accept. Cross-account acceptance requires the peer account's cooperation unless the principal\
    \ also has access to the peer account."
  narrative: '{principal.name} can initiate or accept VPC peering connections for {vpc.name} (ec2:CreateVpcPeeringConnection
    / ec2:AcceptVpcPeeringConnection), enabling bidirectional network connectivity to be established between
    {vpc.name} and any peer VPC, including those in other AWS accounts.'