network-internet-ingress-reach
A resource exposed to the internet is reachable by any internet (anonymous) principal - the external network entry point that seeds internet-origin attack paths.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?anon) == Identity (the
AnonymousIdentity / internet principal)
node_class(?dst) in [Compute, Data, Storage, Network, Messaging]
emit
| source type | Identity |
|---|---|
| target type | Compute Data Storage Network Messaging |
| source | ?anon |
| target | ?dst |
| conditions | network_reachability |
| state logic | Inherit the ExposedToInternet state directly. ACTIVE when the adapter confirms all exposure prerequisites (public IP, open ingress, route to IGW/equivalent — the full conjunction embedded in ExposedToInternet). CONDITIONAL(network_reachability) when any exposure prerequisite is unconfirmed by collection (e.g. IGW attachment state unknown, or CONDITIONAL ExposedToInternet inherited from adapter). BLOCKED when a WAF, Cloud Armor policy, VPC Service Controls perimeter, or stateless-firewall DENY demonstrably blocks untrusted internet ingress on the path. |
Narrative
{dst.name} is reachable from the public internet, so any anonymous internet principal has a network path to it - the external entry point for attack paths that begin off-cloud.
Raw rule rules/derived/network-chains.yaml
id: network-internet-ingress-reach
emits: CanNetworkReach
description: "A resource exposed to the internet is reachable by any internet (anonymous) principal \u2014\
\ the external network entry point that seeds internet-origin attack paths."
applies_to:
- '*'
match:
- - dst: null
- ExposedToInternet
- anon: null
where:
- node_class(?anon) == Identity (the AnonymousIdentity / internet principal)
- node_class(?dst) in [Compute, Data, Storage, Network, Messaging]
emit:
source_type: Identity
target_type:
- Compute
- Data
- Storage
- Network
- Messaging
source: ?anon
target: ?dst
permissions: []
conditions:
- network_reachability
state_logic: "Inherit the ExposedToInternet state directly. ACTIVE when the adapter confirms all exposure\
\ prerequisites (public IP, open ingress, route to IGW/equivalent \u2014 the full conjunction embedded\
\ in ExposedToInternet). CONDITIONAL(network_reachability) when any exposure prerequisite is unconfirmed\
\ by collection (e.g. IGW attachment state unknown, or CONDITIONAL ExposedToInternet inherited from\
\ adapter). BLOCKED when a WAF, Cloud Armor policy, VPC Service Controls perimeter, or stateless-firewall\
\ DENY demonstrably blocks untrusted internet ingress on the path."
confidence: min(contributing_confidences)
derived_from:
- ?dst ExposedToInternet ?anon
false_positive_note: "This edge asserts only that the INTERNET is a valid network source for ?dst \u2014\
\ it is the reachability precondition, not an exploit and not account entry. Do NOT roll it up into\
\ CanEnter*/CanExecute* here (service adapters + can-control own that). A WAF or Cloud Armor policy\
\ that blocks the relevant traffic is a real control (BLOCKED); a resource exposed only to a known\
\ corporate CIDR is not AnonymousIdentity-reachable. Messaging targets (Queue/Topic/EventBus with\
\ public wildcard resource policy) are included per ExposedToInternet's declared source set in edges.yaml."
narrative: "{dst.name} is reachable from the public internet, so any anonymous internet principal has\
\ a network path to it \u2014 the external entry point for attack paths that begin off-cloud."