aws-vpc-sg-create-permissive

A principal with ec2:CreateSecurityGroup can create a new permissive SG, then attach it to a resource (requires ec2:ModifyNetworkInterfaceAttribute or service-specific attach permission), effectively bypassing existing rules.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`VirtualNetwork`
source	`?principal`
target	`?vpc`
permissions	`ec2:CreateSecurityGroup` `ec2:AuthorizeSecurityGroupIngress` `ec2:ModifyNetworkInterfaceAttribute`
conditions	`iam_permission` `resource_policy`
state logic	if all three permissions are effective AND NOT scp_denies: ACTIVE elif ec2:ModifyNetworkInterfaceAttribute is absent but service-specific attach is present: CONDITIONAL(iam_permission) else: POTENTIAL(iam_permission)

source type

Identity

target type

VirtualNetwork

source

?principal

target

?vpc

permissions

ec2:CreateSecurityGroup ec2:AuthorizeSecurityGroupIngress ec2:ModifyNetworkInterfaceAttribute

conditions

iam_permission resource_policy

state logic

if all three permissions are effective AND NOT scp_denies: ACTIVE elif ec2:ModifyNetworkInterfaceAttribute is absent but service-specific attach is present: CONDITIONAL(iam_permission) else: POTENTIAL(iam_permission)

Narrative

{principal.name} can create a new security group with permissive inbound rules in {vpc.name} (ec2:CreateSecurityGroup + ec2:AuthorizeSecurityGroupIngress) and attach it to a resource (ec2:ModifyNetworkInterfaceAttribute), bypassing existing security group controls for that resource.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-sg-create-permissive
emits: CanModifyConfiguration
description: A principal with ec2:CreateSecurityGroup can create a new permissive SG, then attach it to
  a resource (requires ec2:ModifyNetworkInterfaceAttribute or service-specific attach permission), effectively
  bypassing existing rules.
match:
- - principal: null
  - HasPermission
  - vpc: null
where:
- node_type(?vpc) == VirtualNetwork
- effective_permission(?principal, ?vpc) contains 'ec2:CreateSecurityGroup' AND effective_permission(?principal,
  '*') contains 'ec2:ModifyNetworkInterfaceAttribute' OR 'ec2:ModifyInstanceAttribute'
emit:
  source_type: Identity
  target_type: VirtualNetwork
  source: ?principal
  target: ?vpc
  permissions:
  - ec2:CreateSecurityGroup
  - ec2:AuthorizeSecurityGroupIngress
  - ec2:ModifyNetworkInterfaceAttribute
  conditions:
  - iam_permission
  - resource_policy
  state_logic: 'if all three permissions are effective AND NOT scp_denies: ACTIVE elif ec2:ModifyNetworkInterfaceAttribute
    is absent but service-specific attach is present: CONDITIONAL(iam_permission) else: POTENTIAL(iam_permission)'
  confidence: 0.8
  derived_from:
  - HasPermission(?principal, ?vpc) [ec2:CreateSecurityGroup + ec2:ModifyNetworkInterfaceAttribute]
  false_positive_note: "The attach step requires a separate permission on the target resource's network\
    \ interface or the resource itself. Without ec2:ModifyNetworkInterfaceAttribute (or an equivalent\
    \ like ecs:UpdateService changing the SG), the attacker can create a permissive SG but cannot attach\
    \ it \u2014 downgrade to POTENTIAL. This rule focuses on the VPC as the scope node (SGs live in a\
    \ VPC); the actual exposure depends on attaching to a compute resource modeled by ec2.yaml."
  narrative: '{principal.name} can create a new security group with permissive inbound rules in {vpc.name}
    (ec2:CreateSecurityGroup + ec2:AuthorizeSecurityGroupIngress) and attach it to a resource (ec2:ModifyNetworkInterfaceAttribute),
    bypassing existing security group controls for that resource.'