aws-vpc-tgw-create-attachment

A principal with ec2:CreateTransitGatewayVpcAttachment can initiate a VPC attachment request to a Transit Gateway, expanding the VPC's routing domain to the TGW network (if the attachment is accepted).

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`TransitGateway`
source	`?principal`
target	`?tgw`
permissions	`ec2:CreateTransitGatewayVpcAttachment`
conditions	`iam_permission` `service_state`
state logic	if effective ec2:CreateTransitGatewayVpcAttachment present AND NOT scp_denies AND TGW AutoAcceptSharedAttachments is enabled: ACTIVE elif permission present but auto-accept is disabled: CONDITIONAL(service_state) elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)

source type

Identity

target type

TransitGateway

source

?principal

target

?tgw

permissions

ec2:CreateTransitGatewayVpcAttachment

conditions

iam_permission service_state

state logic

if effective ec2:CreateTransitGatewayVpcAttachment present AND NOT scp_denies AND TGW AutoAcceptSharedAttachments is enabled: ACTIVE elif permission present but auto-accept is disabled: CONDITIONAL(service_state) elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)

Narrative

{principal.name} can create a VPC attachment to Transit Gateway {tgw.name} (ec2:CreateTransitGatewayVpcAttachment). The attachment reaches ACTIVE routing only if the TGW has auto-accept enabled or the TGW owner accepts separately.

Raw rule rules/derived/aws/vpc.yaml

id: aws-vpc-tgw-create-attachment
emits: CanModifyConfiguration
description: A principal with ec2:CreateTransitGatewayVpcAttachment can initiate a VPC attachment request
  to a Transit Gateway, expanding the VPC's routing domain to the TGW network (if the attachment is accepted).
match:
- - principal: null
  - HasPermission
  - tgw: null
where:
- node_type(?tgw) == TransitGateway
- effective_permission(?principal, ?tgw) contains 'ec2:CreateTransitGatewayVpcAttachment'
emit:
  source_type: Identity
  target_type: TransitGateway
  source: ?principal
  target: ?tgw
  permissions:
  - ec2:CreateTransitGatewayVpcAttachment
  conditions:
  - iam_permission
  - service_state
  state_logic: 'if effective ec2:CreateTransitGatewayVpcAttachment present AND NOT scp_denies AND TGW
    AutoAcceptSharedAttachments is enabled: ACTIVE elif permission present but auto-accept is disabled:
    CONDITIONAL(service_state) elif scp_denies: BLOCKED else: POTENTIAL(iam_permission)'
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, ?tgw) [ec2:CreateTransitGatewayVpcAttachment]
  false_positive_note: "Creating a TGW attachment requires the TGW to auto-accept attachments (AutoAcceptSharedAttachments\
    \ enabled) OR the TGW owner must accept via ec2:AcceptTransitGatewayVpcAttachment. Without auto-accept,\
    \ the attachment remains in 'pending-acceptance' and creates no routing \u2014 downgrade to CONDITIONAL(service_state)\
    \ if auto-accept is disabled."
  narrative: '{principal.name} can create a VPC attachment to Transit Gateway {tgw.name} (ec2:CreateTransitGatewayVpcAttachment).
    The attachment reaches ACTIVE routing only if the TGW has auto-accept enabled or the TGW owner accepts
    separately.'