aws-vpclattice-create-vpc-assoc-lateral

A principal with vpc-lattice:CreateServiceNetworkVpcAssociation can connect any VPC they control to the service network, gaining private reachability to all services in the network - lateral movement, including cross-account on RAM-shared service networks.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'servicenetwork': None}

where

node_type(?servicenetwork) == GenericNetwork ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork' effective_action_on(?principal, ?servicenetwork) contains 'vpc-lattice:CreateServiceNetworkVpcAssociation'

emit

source type	`Identity`
target type	`GenericNetwork`
source	`?principal`
target	`?servicenetwork`
permissions	`vpc-lattice:CreateServiceNetworkVpcAssociation`
conditions	`iam_permission` `network_reachability`
state logic	POTENTIAL(trigger_exists): the VPC association does not yet exist. The principal CAN create it (permission confirmed); once created and status turns ACTIVE, the explicit aws-vpclattice-vpc-association-record rule fires and yields CONDITIONAL(network_reachability). Downgrade to BLOCKED if an SCP or permission boundary denies vpc-lattice:CreateServiceNetworkVpcAssociation. For cross-account scenarios on a RAM-shared service network, this becomes CrossAccountTrust + CanNetworkReach (see aws-vpclattice-cross-acct-vpc-assoc).

Narrative

{principal.name} has vpc-lattice:CreateServiceNetworkVpcAssociation on service network {servicenetwork.name}. By associating a VPC they control, they would gain private reachability to all services in the network - a lateral movement pivot (potentially cross-account if the service network is RAM-shared).

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-create-vpc-assoc-lateral
emits: CanNetworkReach
description: "A principal with vpc-lattice:CreateServiceNetworkVpcAssociation can connect any VPC they\
  \ control to the service network, gaining private reachability to all services in the network \u2014\
  \ lateral movement, including cross-account on RAM-shared service networks."
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - servicenetwork: null
where:
- node_type(?servicenetwork) == GenericNetwork
- ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork'
- effective_action_on(?principal, ?servicenetwork) contains 'vpc-lattice:CreateServiceNetworkVpcAssociation'
emit:
  source_type: Identity
  target_type: GenericNetwork
  source: ?principal
  target: ?servicenetwork
  permissions:
  - vpc-lattice:CreateServiceNetworkVpcAssociation
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'POTENTIAL(trigger_exists): the VPC association does not yet exist. The principal CAN create
    it (permission confirmed); once created and status turns ACTIVE, the explicit aws-vpclattice-vpc-association-record
    rule fires and yields CONDITIONAL(network_reachability). Downgrade to BLOCKED if an SCP or permission
    boundary denies vpc-lattice:CreateServiceNetworkVpcAssociation. For cross-account scenarios on a RAM-shared
    service network, this becomes CrossAccountTrust + CanNetworkReach (see aws-vpclattice-cross-acct-vpc-assoc).'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?principal HasPermission ?servicenetwork (vpc-lattice:CreateServiceNetworkVpcAssociation)
  false_positive_note: "POTENTIAL only \u2014 the association must be created and must reach ACTIVE status\
    \ before reachability is established. The created association's security groups (specified at creation\
    \ time) further gate which clients can use Lattice addresses. Reachability to individual services\
    \ is also gated by each service's auth policy (authType AWS_IAM requires a valid SigV4 request and\
    \ a matching identity-based policy on the caller). For cross-account: the principal must also have\
    \ a VPC in their account to associate \u2014 if they lack a VPC they cannot exercise this permission.\
    \ Do NOT emit ACTIVE; always POTENTIAL until the association record exists."
  narrative: "{principal.name} has vpc-lattice:CreateServiceNetworkVpcAssociation on service network {servicenetwork.name}.\
    \ By associating a VPC they control, they would gain private reachability to all services in the network\
    \ \u2014 a lateral movement pivot (potentially cross-account if the service network is RAM-shared)."