Derivation rules

A principal with sso:CreateTrustedTokenIssuer can register an external OIDC issuer configuration in IAM Identity Center, expanding the set of trusted token issuers - a policy modification capability.

A principal with ec2:AssociateTransitGatewayRouteTable or ec2:EnableTransitGatewayRouteTablePropagation can silently re-route an attachment to a permissive route table or add a propagation that opens routing between otherwise-isolated VPCs - a quiet network-isolation bypass. Modeled as CanModifyConfiguration on the TransitGateway node.

A consumer-account VPC with a confirmed (state==available) attachment to an owner-account Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane account entry (CanEnterAccount).

A principal with ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on a TGW route table can inject or overwrite routes, redirecting inter-VPC or on-premises traffic to an attacker-controlled attachment - man-in-the-middle at L3 or traffic sinkhole. Modeled as CanModifyConfiguration on the Route (TGW route table) node.

Reading data from a Timestream table that contains secret material yields the ability to read those secrets, enabling credential-chain pivots.

IAM-effective timestream:Select on a Timestream table allows full data-plane read (SQL-like query), yielding all time-series records including any secret or credential material stored as measures or dimensions.

A VPC peering connection whose requester and accepter VPCs belong to different AWS accounts represents cross-account network trust. The peering connection record in the accepting account's AWS account constitutes the cross-account authorization artifact, enabling principals in the peer account to reach resources in this account if SG/routing permits.

A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Source is any Compute node in the VPC that has network access to the endpoint ENI.

An available Interface VPC Endpoint (PrivateLink) makes the backing AWS or third-party service reachable from compute within the VPC via private networking, without traversing the public internet. Derived from the endpoint state and VPC co-location facts.

A PrivateLink producer endpoint with an explicit permission granting access to a foreign account principal is exposed to cross-account consumption. This is a structural fact representing the intended cross-account data-plane exposure.

A principal with ec2:ModifyVpcEndpointServicePermissions can grant or revoke access to a PrivateLink producer endpoint, controlling which principals (including foreign accounts) can consume the service.

A principal with ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry, or ec2:ReplaceNetworkAclAssociation can modify Network ACL rules, changing the firewall posture at the subnet level. This is a weaken-controls primitive for stateless packet filtering, complementary to security groups.

A principal with ec2:CreateVpcPeeringConnection can initiate a VPC peering to any VPC (including cross-account). Accepting requires ec2:AcceptVpcPeeringConnection on the accepter side. This permission enables establishing new cross-VPC connectivity.

An active VPC peering connection creates bidirectional connectivity between two VPCs. Security groups in each VPC can reference the peer's CIDR as a source/destination, expanding the effective reachability surface.

A principal with ec2:CreateRoute, ec2:ReplaceRoute, or ec2:AttachInternetGateway can make a previously-private subnet internet-routable, exposing any resource in that subnet that has a public IP.

A principal with ec2:AuthorizeSecurityGroupIngress or ec2:ModifySecurityGroupRules can add an allow-from-0.0.0.0/0 (or any source) inbound rule to a security group, potentially exposing protected resources to new network sources.

A principal with ec2:CreateSecurityGroup can create a new permissive SG, then attach it to a resource (requires ec2:ModifyNetworkInterfaceAttribute or service-specific attach permission), effectively bypassing existing rules.

A compute resource is internet-exposed when its security group has an inbound rule allowing 0.0.0.0/0 (or ::/0) on a port, the resource has a public IP, and the subnet has a route to an Internet Gateway. All three conditions must be observed facts.

A security group with an inbound allow rule allowing 0.0.0.0/0 (any source) on a specific port grants network reachability to that port from the internet. This is derived from explicit SG record collection and represents the network-layer capability to reach a listening port on a protected compute node.

A principal with ec2:AcceptTransitGatewayVpcAttachment can accept a pending attachment request, transitioning the VPC connection to active routing status.

A principal with ec2:CreateTransitGatewayVpcAttachment can initiate a VPC attachment request to a Transit Gateway, expanding the VPC's routing domain to the TGW network (if the attachment is accepted).

A VPC Lattice service network or service with authType NONE is accessible to any client in any associated VPC without IAM authentication - account-scoped exposure (or broader if the network is RAM-shared).

A principal with vpc-lattice:CreateServiceNetworkVpcAssociation can connect any VPC they control to the service network, gaining private reachability to all services in the network - lateral movement, including cross-account on RAM-shared service networks.

A consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service network can associate their VPC, gaining cross-account private reachability to owner-account services.

vpc-lattice:UpdateServiceNetwork or vpc-lattice:UpdateService with authType=NONE disables auth policy evaluation, making all services in the network (or the individual service) invocable by any connected-VPC client without IAM authentication.

vpc-lattice:UpdateRule or vpc-lattice:UpdateListener lets a principal redirect traffic to an attacker-controlled target group, intercepting L7 traffic from all service consumers.

A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC clients to the resource through the resource gateway.

A principal with vpc-lattice:CreateServiceNetworkServiceAssociation on a service network can associate an attacker-controlled service, exposing it to all connected-VPC clients for phishing/SSRF.

A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane reachability from the VPC to the service network.

vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).

Modify a customer-managed Rule Group to corrupt all Web ACLs that reference it (defense evasion with potentially multi-ACL blast radius).

Permanently delete a customer-managed Rule Group, breaking all Web ACLs that reference it (requires prior removal of all associations).

Permanently delete a Web ACL, removing WAF protection from all previously associated resources (requires prior disassociation).

Disable WAF logging by deleting or disabling logging configuration, removing event coverage and aiding evasion.

Discover WAF logging configuration (destination Firehose/S3/CloudWatch Logs), aiding recon into the logging pipeline.