CanNetworkReach

A CloudFront distribution can reach its configured origin (S3 bucket, ALB, API Gateway, or custom HTTP endpoint) over the network. This is a structural routing fact that feeds the network-chains linchpin.

A principal with elasticfilesystem:ModifyMountTargetSecurityGroups can modify mount target security groups to enable NFS access, converting conditional data-access edges to active.

An ALB or NLB listener with a forward action creates a network path from the LB to its backend targets (instances/IPs/ALBs). This is a CONDITIONAL(network_reachability) fact - the LB SG must allow inbound AND the backend SG must allow inbound from the LB's SG/IP range.

An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for per-service network facts.

A shared subnet collapses the inter-account network boundary: consumer workloads launched into the shared subnet are on-link with owner-account resources, yielding on-subnet network reachability.

A shared Transit Gateway enables the consumer VPC to reach owner-account resources attached to the TGW, derived from the CrossAccountTrust fact and confirmed TGW attachments.

A consumer-account VPC with a confirmed (state==available) attachment to an owner-account Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane account entry (CanEnterAccount).

A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane reachability from the VPC to the service network.

A principal with vpc-lattice:CreateServiceNetworkVpcAssociation can connect any VPC they control to the service network, gaining private reachability to all services in the network - lateral movement, including cross-account on RAM-shared service networks.

A consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service network can associate their VPC, gaining cross-account private reachability to owner-account services.

A Cloud Build private worker pool peered into a VPC gives build steps network access to private resources in that VPC.

Cloud Run resource with Direct VPC egress / Serverless VPC Access connector can reach private targets.

A Datastream PrivateConnection establishes VPC peering between the Datastream service network and a customer VPC, enabling network reach to private resources within that VPC and resources accessible via Cloud VPN or Dedicated Interconnect.

datastream.privateConnections.create lets a principal establish a VPC peering from the Datastream service network to an attacker-controlled VPC or a sensitive customer network, enabling network reach for probing or bridging boundaries.

A principal with iap.tunnelInstances.accessViaIAP can open a TCP tunnel through Google IAP to any port on the target GCE instance (SSH/22, RDP/3389, or any custom TCP port) without the instance having a public IP. This provides direct network-level reach to a private VM from any location with HTTPS access to Google's infrastructure.

A principal with iap.tunnelDestGroups.accessViaIAP can reach hosts in a TunnelDestGroup via IAP TCP forwarding. DestGroups enable IAP tunnels to non-GCE endpoints (Cloud Run internal, on-prem hosts, or other private services reachable within the VPC). This provides private-network reach to those endpoints without a VPN.

A principal with iap.webServiceVersions.accessViaIAP (or parent-level iap.webTypes.accessViaIAP / iap.web.accessViaIAP) can reach an IAP-protected web application (App Engine, Cloud Run, GKE Ingress, or backend service via HTTPS LB) after authenticating through Google IAP. This provides network-level reach to the backend application, though the backend's own authorization layer may further gate access.

A service-project service account holding compute.networkUser on a host-project subnet can create workloads whose NICs land in that subnet, giving those workloads internal-IP reachability to all other resources in the subnet (including those from other service projects).

A source co-located with the destination in the same Subnet reaches it when the destination's SG/NSG/firewall admits the source segment on a listening port.

A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.

A source reaches a destination across a SINGLE VPC/VNet peering when the destination's ingress admits it - peering is non-transitive, so exactly one direct hop.

A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct Connect gateway/VPN gateway) that forwards between attachments - transitive across the hub's associated route table.

A resource exposed to the internet is reachable by any internet (anonymous) principal - the external network entry point that seeds internet-origin attack paths.

A private-link/PSC/private-endpoint path makes a PaaS/data/storage service reachable to an in-network consumer, often across account/project boundaries without internet exposure.

An internet principal that can reach an internet-facing load balancer can also reach the LB's backend targets - composing internet-entry with LB-to-backend forwarding.

A principal with elasticfilesystem:CreateMountTarget can place a new mount target in a subnet they control, gaining network access to the EFS file system.