aws-vpclattice-auth-none-exposed-to-account

id: aws-vpclattice-auth-none-exposed-to-account
emits: ExposedToAccount
description: "A VPC Lattice service network or service with authType NONE is accessible to any client\
  \ in any associated VPC without IAM authentication \u2014 account-scoped exposure (or broader if the\
  \ network is RAM-shared)."
applies_to:
- aws
match: []
where:
- node_type(resource) in [GenericNetwork, APIGateway]
- resource.provider_type in ['AWS::VpcLattice::ServiceNetwork', 'AWS::VpcLattice::Service']
- resource.authType == 'NONE'
- exists at least one CanNetworkReach edge to this resource (or a parent service network)
emit:
  source_type: GenericNetwork
  target_type: Account
  source: <resource (ServiceNetwork or Service)
  target: <AWS Account owning the resource>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability): authType=NONE removes the IAM auth gate, but VPC association
    (CanNetworkReach) is still required for any client to reach the service. A client must exist in a
    connected VPC to invoke. BLOCKED if an SCP enforces authType == AWS_IAM (some SCPs include a condition
    requiring vpc-lattice:authType to be AWS_IAM on create/update). Do NOT emit ACTIVE; CanNetworkReach
    is a prerequisite condition.'
  confidence: 0.9
  derived_from: []
  false_positive_note: "ExposedToAccount, NOT ExposedToInternet. authType NONE does not make the service\
    \ publicly internet-routable \u2014 there is no public IP. Exposure is limited to clients in VPCs\
    \ associated with the service network. If the service network is RAM-shared cross-account, the exposure\
    \ extends to those consumer accounts as well, but still only to their VPC-resident clients. Do not\
    \ emit for authType == AWS_IAM (policy still evaluated even if it contains Principal:'*' \u2014 that\
    \ is handled by CrossAccountTrust)."
  narrative: "{source.name} has authType=NONE \u2014 no auth policy is evaluated for incoming requests.\
    \ Any client in a VPC associated with the service network can invoke services without IAM credentials,\
    \ representing account-wide (and potentially cross-account) unauthenticated access within connected\
    \ VPCs."