aws-vpc-sg-authorize-ingress

id: aws-vpc-sg-authorize-ingress
emits: CanModifyConfiguration
description: A principal with ec2:AuthorizeSecurityGroupIngress or ec2:ModifySecurityGroupRules can add
  an allow-from-0.0.0.0/0 (or any source) inbound rule to a security group, potentially exposing protected
  resources to new network sources.
match:
- - principal: null
  - HasPermission
  - sg: null
where:
- node_type(?sg) == SecurityGroup
- effective_permission(?principal, ?sg) contains 'ec2:AuthorizeSecurityGroupIngress' OR 'ec2:ModifySecurityGroupRules'
emit:
  source_type: Identity
  target_type: SecurityGroup
  source: ?principal
  target: ?sg
  permissions:
  - ec2:AuthorizeSecurityGroupIngress
  - ec2:ModifySecurityGroupRules
  conditions:
  - iam_permission
  state_logic: "if effective_permission(?principal, ?sg) contains 'ec2:AuthorizeSecurityGroupIngress'\
    \ OR 'ec2:ModifySecurityGroupRules' AND NOT scp_denies those actions at ?principal scope:\n  ACTIVE\n\
    elif scp_denies:\n  BLOCKED\nelse:\n  CONDITIONAL(iam_permission)"
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, ?sg) [ec2:AuthorizeSecurityGroupIngress | ec2:ModifySecurityGroupRules]
  false_positive_note: "ec2:AuthorizeSecurityGroupIngress and ec2:ModifySecurityGroupRules are both effective\
    \ means to add inbound allow rules. This edge models the CAPABILITY to weaken the SG \u2014 it does\
    \ NOT assert that 0.0.0.0/0 is currently allowed. Whether the resulting rule actually opens internet\
    \ access depends on the resource also having a public IP and a route to an IGW; that composition is\
    \ the network-chains linchpin (future work). Do not emit ExposedToInternet from this rule alone \u2014\
    \ only from aws-vpc-sg-internet-exposed-compute when all three facts are observed.\nec2:RevokeSecurityGroupIngress\
    \ is a destructive action (removes allow rules), modeled as CanModifyConfiguration of weaker security\
    \ posture but primarily a denial/persistence tool \u2014 not separately emitted here unless used offensively.\n\
    An SCP denying ec2:AuthorizeSecurityGroupIngress at the principal's scope should set state: BLOCKED."
  narrative: '{principal.name} can add inbound allow rules to security group {sg.name} (ec2:AuthorizeSecurityGroupIngress
    / ec2:ModifySecurityGroupRules), opening network access to any resource protected by this security
    group from any source the attacker specifies, including 0.0.0.0/0.'