aws-vpclattice-cross-acct-vpc-assoc

A consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service network can associate their VPC, gaining cross-account private reachability to owner-account services.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'share_or_sn': None} CrossAccountTrust {'consumer_account': None} {'principal': None} HasPermission {'servicenetwork': None}

where

node_type(?consumer_account) == Account node_type(?servicenetwork) == GenericNetwork ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork' ?principal.account == ?consumer_account.id # principal is IN the consumer account effective_action_on(?principal, ?servicenetwork) contains 'vpc-lattice:CreateServiceNetworkVpcAssociation' ?share_or_sn references ?servicenetwork (either the service network itself or a RAM share covering it)

emit

source type	`Identity`
target type	`GenericNetwork`
source	`?principal`
target	`?servicenetwork`
permissions	`vpc-lattice:CreateServiceNetworkVpcAssociation`
conditions	`iam_permission` `network_reachability` `resource_policy`
state logic	POTENTIAL(trigger_exists): the VPC association does not yet exist. Upgraded to CONDITIONAL(network_reachability) once the association is ACTIVE (explicit rule fires). CONDITIONAL(resource_policy): each service in the network may require the caller to be an authenticated IAM principal per its auth policy. BLOCKED if an SCP denies vpc-lattice:CreateServiceNetworkVpcAssociation on the consumer-account principal or if the RAM share has not been accepted.

Narrative

{principal.name} (in account {consumer_account.name}) can create a VPC association on the RAM-shared service network {servicenetwork.name} (vpc-lattice:CreateServiceNetworkVpcAssociation). This would give their VPC cross-account private reachability to all services hosted by the owner account in that network.

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-cross-acct-vpc-assoc
emits: CanNetworkReach
description: A consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service
  network can associate their VPC, gaining cross-account private reachability to owner-account services.
applies_to:
- aws
match:
- - share_or_sn: null
  - CrossAccountTrust
  - consumer_account: null
- - principal: null
  - HasPermission
  - servicenetwork: null
where:
- node_type(?consumer_account) == Account
- node_type(?servicenetwork) == GenericNetwork
- ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork'
- '?principal.account == ?consumer_account.id   # principal is IN the consumer account'
- effective_action_on(?principal, ?servicenetwork) contains 'vpc-lattice:CreateServiceNetworkVpcAssociation'
- ?share_or_sn references ?servicenetwork (either the service network itself or a RAM share covering it)
emit:
  source_type: Identity
  target_type: GenericNetwork
  source: ?principal
  target: ?servicenetwork
  permissions:
  - vpc-lattice:CreateServiceNetworkVpcAssociation
  conditions:
  - iam_permission
  - network_reachability
  - resource_policy
  state_logic: 'POTENTIAL(trigger_exists): the VPC association does not yet exist. Upgraded to CONDITIONAL(network_reachability)
    once the association is ACTIVE (explicit rule fires). CONDITIONAL(resource_policy): each service in
    the network may require the caller to be an authenticated IAM principal per its auth policy. BLOCKED
    if an SCP denies vpc-lattice:CreateServiceNetworkVpcAssociation on the consumer-account principal
    or if the RAM share has not been accepted.'
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - ?share_or_sn CrossAccountTrust ?consumer_account
  - ?principal HasPermission ?servicenetwork (vpc-lattice:CreateServiceNetworkVpcAssociation)
  false_positive_note: "Requires the RAM share to be ACTIVE (accepted or org-wide). CONDITIONAL(service_state)\
    \ when the share is PENDING_ACCEPTANCE. After association, auth policies on individual services may\
    \ still gate invocation \u2014 this edge represents network plane reachability (can reach the service\
    \ network), not data plane authorization (can invoke all services). Auth policy evaluation is separate\
    \ and may further block specific callers. Scope: this edge uses Identity as source (not Network) because\
    \ the PERMISSION to create the association is what matters here; the resulting reachability is on\
    \ the consumer VPC (Network), but the capability originates with the principal (Identity). Verify\
    \ ?principal.account == ?consumer_account before emitting to avoid false owner-account matches."
  narrative: '{principal.name} (in account {consumer_account.name}) can create a VPC association on the
    RAM-shared service network {servicenetwork.name} (vpc-lattice:CreateServiceNetworkVpcAssociation).
    This would give their VPC cross-account private reachability to all services hosted by the owner account
    in that network.'