aws-vpclattice-disable-auth-type

vpc-lattice:UpdateServiceNetwork or vpc-lattice:UpdateService with authType=NONE disables auth policy evaluation, making all services in the network (or the individual service) invocable by any connected-VPC client without IAM authentication.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?target`
permissions	`vpc-lattice:UpdateServiceNetwork` `vpc-lattice:UpdateService`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when UpdateServiceNetwork or UpdateService is confirmed effective on the target ARN. BLOCKED when an SCP or permission boundary denies the relevant Update action.

source type

Identity

target type

*

source

?principal

target

?target

permissions

vpc-lattice:UpdateServiceNetwork vpc-lattice:UpdateService

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when UpdateServiceNetwork or UpdateService is confirmed effective on the target ARN. BLOCKED when an SCP or permission boundary denies the relevant Update action.

Narrative

{principal.name} can set authType=NONE on {target.name} (vpc-lattice:UpdateServiceNetwork / vpc-lattice:UpdateService), disabling all auth policy evaluation. Any client in a connected VPC can then invoke services without presenting IAM credentials.

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-disable-auth-type
emits: CanModifyConfiguration
description: vpc-lattice:UpdateServiceNetwork or vpc-lattice:UpdateService with authType=NONE disables
  auth policy evaluation, making all services in the network (or the individual service) invocable by
  any connected-VPC client without IAM authentication.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - target: null
where:
- node_type(?target) in [GenericNetwork, APIGateway]
- ?target.provider_type in ['AWS::VpcLattice::ServiceNetwork', 'AWS::VpcLattice::Service']
- effective_action_on(?principal, ?target) intersects ['vpc-lattice:UpdateServiceNetwork', 'vpc-lattice:UpdateService']
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?target
  permissions:
  - vpc-lattice:UpdateServiceNetwork
  - vpc-lattice:UpdateService
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when UpdateServiceNetwork or UpdateService is confirmed effective on the target
    ARN. BLOCKED when an SCP or permission boundary denies the relevant Update action.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?target (vpc-lattice:UpdateServiceNetwork | vpc-lattice:UpdateService)
  false_positive_note: "Update actions cover many fields beyond authType (logging, name, certificates,\
    \ etc.); only the authType field produces a security consequence. This edge conservatively models\
    \ the full capability. An SCP requiring aws:RequestedRegion or restricting authType changes would\
    \ reduce the blast radius. Changing authType to NONE on a service network affects ALL services in\
    \ the network simultaneously \u2014 high blast radius. Changing authType on an individual service\
    \ affects only that service. Do NOT emit ExposedToInternet: even with authType NONE, Lattice services\
    \ are reachable only from associated VPCs, not the public internet."
  narrative: '{principal.name} can set authType=NONE on {target.name} (vpc-lattice:UpdateServiceNetwork
    / vpc-lattice:UpdateService), disabling all auth policy evaluation. Any client in a connected VPC
    can then invoke services without presenting IAM credentials.'