aws-vpc-peering-lateral-fact

An active VPC peering connection creates bidirectional connectivity between two VPCs. Security groups in each VPC can reference the peer's CIDR as a source/destination, expanding the effective reachability surface.

derived aws emits PeeredWith

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`VirtualNetwork`
target type	`VirtualNetwork`
source	`?vpc_a`
target	`?vpc_b`
conditions	`network_reachability`
state logic	if ?peering.status == 'active': ACTIVE (the peering fact itself is active); lateral movement across the peering is CONDITIONAL(network_reachability) — individual SG rules must allow the traffic.

source type

VirtualNetwork

target type

VirtualNetwork

source

?vpc_a

target

?vpc_b

conditions

network_reachability

state logic

if ?peering.status == 'active': ACTIVE (the peering fact itself is active); lateral movement across the peering is CONDITIONAL(network_reachability) — individual SG rules must allow the traffic.

Narrative

{vpc_a.name} is peered with {vpc_b.name} via active peering connection {peering.name} - resources in both VPCs can route to each other subject to their respective security group and route table configurations.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-peering-lateral-fact
emits: PeeredWith
description: An active VPC peering connection creates bidirectional connectivity between two VPCs. Security
  groups in each VPC can reference the peer's CIDR as a source/destination, expanding the effective reachability
  surface.
match:
- - peering: null
  - AttachedTo
  - vpc_a: null
where:
- node_type(?peering) == Peering
- ?peering.status == 'active'
- ?vpc_b == peer_vpc(?peering, opposite_of=?vpc_a)
emit:
  source_type: VirtualNetwork
  target_type: VirtualNetwork
  source: ?vpc_a
  target: ?vpc_b
  permissions: []
  conditions:
  - network_reachability
  state_logic: "if ?peering.status == 'active': ACTIVE (the peering fact itself is active); lateral movement\
    \ across the peering is CONDITIONAL(network_reachability) \u2014 individual SG rules must allow the\
    \ traffic."
  confidence: 0.98
  derived_from:
  - AttachedTo(?peering, ?vpc_a)
  - peering_status == active
  false_positive_note: "PeeredWith is a STRUCTURAL FACT \u2014 it records that connectivity is possible,\
    \ not that it is currently being exploited. End-to-end CanNetworkReach across the peering additionally\
    \ requires route table entries pointing to the peering connection AND security group rules allowing\
    \ the specific traffic. The network-chains linchpin (future work) will compose these facts. Do not\
    \ emit CanNetworkReach from this rule.\nVPC peering is NOT transitive: VPC-A peered with VPC-B and\
    \ VPC-B peered with VPC-C does NOT mean VPC-A can reach VPC-C. Do not chain PeeredWith edges."
  narrative: "{vpc_a.name} is peered with {vpc_b.name} via active peering connection {peering.name} \u2014\
    \ resources in both VPCs can route to each other subject to their respective security group and route\
    \ table configurations."