aws-vpc-sg-open-inbound-reachability
A security group with an inbound allow rule allowing 0.0.0.0/0 (any source) on a specific port grants network reachability to that port from the internet. This is derived from explicit SG record collection and represents the network-layer capability to reach a listening port on a protected compute node.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_type(?sg) ==
SecurityGroup
node_type(?resource) in [Compute, Network]
sg_has_inbound_rule(?sg, cidr='0.0.0.0/0' OR cidr='::/0', port=?port, action='allow')
emit
| source type | Network |
|---|---|
| target type | Compute |
| source | ?sg |
| target | ?resource |
| conditions | network_reachability |
| state logic | if SG inbound rule exists allowing 0.0.0.0/0 on the port: ACTIVE (capability fact) else: do not emit |
Narrative
Security group {sg.name} allows inbound traffic from 0.0.0.0/0 on port {port} to {resource.name} - any host on the public internet can attempt to connect to a service listening on that port on the resource.
Raw rule rules/derived/aws/vpc.yaml
id: aws-vpc-sg-open-inbound-reachability
emits: CanReachPort
description: A security group with an inbound allow rule allowing 0.0.0.0/0 (any source) on a specific
port grants network reachability to that port from the internet. This is derived from explicit SG record
collection and represents the network-layer capability to reach a listening port on a protected compute
node.
match:
- - sg: null
- AttachedTo
- resource: null
where:
- node_type(?sg) == SecurityGroup
- node_type(?resource) in [Compute, Network]
- sg_has_inbound_rule(?sg, cidr='0.0.0.0/0' OR cidr='::/0', port=?port, action='allow')
emit:
source_type: Network
target_type: Compute
source: ?sg
target: ?resource
permissions: []
conditions:
- network_reachability
state_logic: 'if SG inbound rule exists allowing 0.0.0.0/0 on the port: ACTIVE (capability fact) else:
do not emit'
confidence: 0.9
derived_from:
- AttachedTo(?sg, ?resource)
- sg_has_inbound_rule(?sg, 0.0.0.0/0)
false_positive_note: "CanReachPort is the NETWORK-LAYER reachability capability. It does NOT assert\
\ that a service is actually listening or that end-to-end exploitability is possible \u2014 only that\
\ the network path (SG rule) allows the traffic. Actual exploitation depends on: (a) a listening service\
\ on the target port (service enumeration), (b) a public IP on the resource, and (c) a route to IGW.\
\ The network-chains linchpin will compose these facts into end-to-end CanNetworkReach. Do not emit\
\ if the SG source is restricted to a named CIDR, VPC CIDR, or another SG \u2014 only emit for 0.0.0.0/0\
\ or ::/0 (truly unrestricted)."
narrative: "Security group {sg.name} allows inbound traffic from 0.0.0.0/0 on port {port} to {resource.name}\
\ \u2014 any host on the public internet can attempt to connect to a service listening on that port\
\ on the resource."