aws-vpclattice-weaken-auth-policy

id: aws-vpclattice-weaken-auth-policy
emits: CanModifyPolicy
description: vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service
  network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*,
  disable auth type).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - target: null
where:
- node_type(?target) in [GenericNetwork, APIGateway]
- ?target.provider_type in ['AWS::VpcLattice::ServiceNetwork', 'AWS::VpcLattice::Service']
- effective_action_on(?principal, ?target) contains 'vpc-lattice:PutAuthPolicy'
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?principal
  target: <auth policy attached to ?target>
  permissions:
  - vpc-lattice:PutAuthPolicy
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when vpc-lattice:PutAuthPolicy is confirmed effective on the target resource. BLOCKED
    if an SCP or permission boundary denies vpc-lattice:PutAuthPolicy on the service/service-network ARN.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?target (vpc-lattice:PutAuthPolicy)
  false_positive_note: "PutAuthPolicy is only actionable when the parent resource's authType is AWS_IAM;\
    \ if authType is NONE, a PUT still succeeds but the policy is not evaluated (harmless in that state).\
    \ For maximum impact, the attacker needs BOTH PutAuthPolicy AND the ability to set authType to AWS_IAM\
    \ (or the target already has authType AWS_IAM) \u2014 otherwise the policy change has no security\
    \ consequence. PutAuthPolicy alone does NOT disable auth \u2014 the attacker must write a policy with\
    \ Principal:\"*\" or similar; the capability expressed here is that they CAN write such a policy.\
    \ This is a defense-weakening capability, not an access grant by itself; pair it with CanNetworkReach\
    \ (connected VPC) for an exploitable chain."
  narrative: '{principal.name} can replace the auth policy on {target.name} (vpc-lattice:PutAuthPolicy),
    potentially allowing any IAM principal in any connected VPC to invoke services (e.g. by setting Principal:"*"
    without an org or VPC condition).'