aws-vpc-route-inject-internet

A principal with ec2:CreateRoute, ec2:ReplaceRoute, or ec2:AttachInternetGateway can make a previously-private subnet internet-routable, exposing any resource in that subnet that has a public IP.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Network`
source	`?principal`
target	`?route_or_vpc`
permissions	`ec2:CreateRoute` `ec2:ReplaceRoute` `ec2:AttachInternetGateway` `ec2:AssociateRouteTable` `ec2:ReplaceRouteTableAssociation`
conditions	`iam_permission`
state logic	if any of the effective route-manipulation permissions are present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

source type

Identity

target type

Network

source

?principal

target

?route_or_vpc

permissions

ec2:CreateRoute ec2:ReplaceRoute ec2:AttachInternetGateway ec2:AssociateRouteTable ec2:ReplaceRouteTableAssociation

conditions

iam_permission

state logic

if any of the effective route-manipulation permissions are present AND NOT scp_denies: ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)

Narrative

{principal.name} can inject or replace routes in {route_or_vpc.name} (ec2:CreateRoute / ec2:ReplaceRoute / ec2:AttachInternetGateway), potentially making a private subnet internet-routable and exposing resources with public IPs to inbound internet traffic.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-route-inject-internet
emits: CanModifyConfiguration
description: A principal with ec2:CreateRoute, ec2:ReplaceRoute, or ec2:AttachInternetGateway can make
  a previously-private subnet internet-routable, exposing any resource in that subnet that has a public
  IP.
match:
- - principal: null
  - HasPermission
  - route_or_vpc: null
where:
- node_type(?route_or_vpc) in [Route, VirtualNetwork]
- effective_permission(?principal, ?route_or_vpc) contains 'ec2:CreateRoute' OR 'ec2:ReplaceRoute' OR
  'ec2:AttachInternetGateway' OR 'ec2:AssociateRouteTable' OR 'ec2:ReplaceRouteTableAssociation'
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?route_or_vpc
  permissions:
  - ec2:CreateRoute
  - ec2:ReplaceRoute
  - ec2:AttachInternetGateway
  - ec2:AssociateRouteTable
  - ec2:ReplaceRouteTableAssociation
  conditions:
  - iam_permission
  state_logic: 'if any of the effective route-manipulation permissions are present AND NOT scp_denies:
    ACTIVE elif scp_denies: BLOCKED else: CONDITIONAL(iam_permission)'
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, ?route_or_vpc) [route manipulation permissions]
  false_positive_note: "Route injection only creates internet exposure if (a) an IGW is attached (or the\
    \ principal also has ec2:AttachInternetGateway + ec2:CreateInternetGateway), AND (b) resources in\
    \ the affected subnet have public IPs. If no IGW is attached and the principal cannot attach one,\
    \ the route creates a black-hole rather than internet access \u2014 downgrade to CONDITIONAL(network_reachability).\
    \ ec2:CreateRoute can also inject routes to VPC peering connections, TGW, or VPN targets; this rule\
    \ focuses on the control-weakening capability generically."
  narrative: '{principal.name} can inject or replace routes in {route_or_vpc.name} (ec2:CreateRoute /
    ec2:ReplaceRoute / ec2:AttachInternetGateway), potentially making a private subnet internet-routable
    and exposing resources with public IPs to inbound internet traffic.'