aws-vpc-tgw-accept-attachment

A principal with ec2:AcceptTransitGatewayVpcAttachment can accept a pending attachment request, transitioning the VPC connection to active routing status.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`TransitGateway`
source	`?principal`
target	`?tgw`
permissions	`ec2:AcceptTransitGatewayVpcAttachment`
conditions	`iam_permission` `service_state`
state logic	if effective ec2:AcceptTransitGatewayVpcAttachment present AND NOT scp_denies AND a pending-acceptance attachment exists: ACTIVE elif permission present but no pending attachment: CONDITIONAL(service_state) elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)

source type

Identity

target type

TransitGateway

source

?principal

target

?tgw

permissions

ec2:AcceptTransitGatewayVpcAttachment

conditions

iam_permission service_state

state logic

if effective ec2:AcceptTransitGatewayVpcAttachment present AND NOT scp_denies AND a pending-acceptance attachment exists: ACTIVE elif permission present but no pending attachment: CONDITIONAL(service_state) elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)

Narrative

{principal.name} can accept pending VPC attachment requests to Transit Gateway {tgw.name} (ec2:AcceptTransitGatewayVpcAttachment), transitioning them from pending-acceptance to active routing.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-tgw-accept-attachment
emits: CanModifyConfiguration
description: A principal with ec2:AcceptTransitGatewayVpcAttachment can accept a pending attachment request,
  transitioning the VPC connection to active routing status.
match:
- - principal: null
  - HasPermission
  - tgw: null
where:
- node_type(?tgw) == TransitGateway
- effective_permission(?principal, ?tgw) contains 'ec2:AcceptTransitGatewayVpcAttachment'
emit:
  source_type: Identity
  target_type: TransitGateway
  source: ?principal
  target: ?tgw
  permissions:
  - ec2:AcceptTransitGatewayVpcAttachment
  conditions:
  - iam_permission
  - service_state
  state_logic: 'if effective ec2:AcceptTransitGatewayVpcAttachment present AND NOT scp_denies AND a pending-acceptance
    attachment exists: ACTIVE elif permission present but no pending attachment: CONDITIONAL(service_state)
    elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)'
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?tgw) [ec2:AcceptTransitGatewayVpcAttachment]
  false_positive_note: ec2:AcceptTransitGatewayVpcAttachment is the TGW owner's permission to accept an
    inbound attachment request. The source principal (TGW owner or delegate) must hold this permission
    at the TGW scope and respond to a pending-acceptance attachment. This models the accepter role in
    cross-account TGW sharing (RAM).
  narrative: '{principal.name} can accept pending VPC attachment requests to Transit Gateway {tgw.name}
    (ec2:AcceptTransitGatewayVpcAttachment), transitioning them from pending-acceptance to active routing.'