aws-vpclattice-service-assoc-exposure

A principal with vpc-lattice:CreateServiceNetworkServiceAssociation on a service network can associate an attacker-controlled service, exposing it to all connected-VPC clients for phishing/SSRF.

derived aws emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Network`
source	`?principal`
target	`?servicenetwork`
permissions	`vpc-lattice:CreateServiceNetworkServiceAssociation`
conditions	`iam_permission` `scp_or_org_policy`
state logic	POTENTIAL(trigger_exists): the service association does not yet exist; the principal CAN create it. Once created and status turns ACTIVE, the attacker-controlled service becomes reachable to all connected-VPC clients. BLOCKED if an SCP denies vpc-lattice:CreateServiceNetworkServiceAssociation or if the service network is configured to reject cross-account service associations.

source type

Identity

target type

Network

source

?principal

target

?servicenetwork

permissions

vpc-lattice:CreateServiceNetworkServiceAssociation

conditions

iam_permission scp_or_org_policy

state logic

POTENTIAL(trigger_exists): the service association does not yet exist; the principal CAN create it. Once created and status turns ACTIVE, the attacker-controlled service becomes reachable to all connected-VPC clients. BLOCKED if an SCP denies vpc-lattice:CreateServiceNetworkServiceAssociation or if the service network is configured to reject cross-account service associations.

Narrative

{principal.name} has vpc-lattice:CreateServiceNetworkServiceAssociation on service network {servicenetwork.name}. By associating an attacker-controlled service with this network, they would expose it to all clients in any VPC connected to the network - enabling phishing, traffic hijacking, or SSRF from legitimate service consumers.

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-service-assoc-exposure
emits: CanModifyConfiguration
description: A principal with vpc-lattice:CreateServiceNetworkServiceAssociation on a service network
  can associate an attacker-controlled service, exposing it to all connected-VPC clients for phishing/SSRF.
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - servicenetwork: null
where:
- node_type(?principal) in [Identity]
- node_type(?servicenetwork) == GenericNetwork
- ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork'
- effective_action_on(?principal, ?servicenetwork) contains 'vpc-lattice:CreateServiceNetworkServiceAssociation'
emit:
  source_type: Identity
  target_type: Network
  source: ?principal
  target: ?servicenetwork
  permissions:
  - vpc-lattice:CreateServiceNetworkServiceAssociation
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'POTENTIAL(trigger_exists): the service association does not yet exist; the principal CAN
    create it. Once created and status turns ACTIVE, the attacker-controlled service becomes reachable
    to all connected-VPC clients. BLOCKED if an SCP denies vpc-lattice:CreateServiceNetworkServiceAssociation
    or if the service network is configured to reject cross-account service associations.'
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?servicenetwork (vpc-lattice:CreateServiceNetworkServiceAssociation)
  false_positive_note: "POTENTIAL only \u2014 the service must be created and associated to be reachable.\
    \ An attacker-controlled service must exist in the caller's account; this edge represents the CAPABILITY\
    \ to expose it. The service may still be subject to listener rules / routing policies that filter\
    \ traffic. Auth policy on the service network may also gate access if authType==AWS_IAM, but authType\
    \ NONE + cross-account share removes that gate entirely."
  narrative: "{principal.name} has vpc-lattice:CreateServiceNetworkServiceAssociation on service network\
    \ {servicenetwork.name}. By associating an attacker-controlled service with this network, they would\
    \ expose it to all clients in any VPC connected to the network \u2014 enabling phishing, traffic hijacking,\
    \ or SSRF from legitimate service consumers."