GenericNetwork

A principal with App Mesh route/service write actions can modify the Envoy xDS configuration delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled virtual node (traffic hijack within the mesh).

A principal with globalaccelerator:UpdateEndpointGroup or globalaccelerator:AddEndpoints can redirect internet-bound anycast traffic to a different or attacker-influenced endpoint within the account (traffic hijack / defense evasion).

An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for per-service network facts.

A VPC Lattice service network or service with authType NONE is accessible to any client in any associated VPC without IAM authentication - account-scoped exposure (or broader if the network is RAM-shared).

A principal with vpc-lattice:CreateServiceNetworkVpcAssociation can connect any VPC they control to the service network, gaining private reachability to all services in the network - lateral movement, including cross-account on RAM-shared service networks.

A consumer account principal with CreateServiceNetworkVpcAssociation on a RAM-shared service network can associate their VPC, gaining cross-account private reachability to owner-account services.

vpc-lattice:UpdateServiceNetwork or vpc-lattice:UpdateService with authType=NONE disables auth policy evaluation, making all services in the network (or the individual service) invocable by any connected-VPC client without IAM authentication.

vpc-lattice:UpdateRule or vpc-lattice:UpdateListener lets a principal redirect traffic to an attacker-controlled target group, intercepting L7 traffic from all service consumers.

A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC clients to the resource through the resource gateway.

A principal with vpc-lattice:CreateServiceNetworkServiceAssociation on a service network can associate an attacker-controlled service, exposing it to all connected-VPC clients for phishing/SSRF.

A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane reachability from the VPC to the service network.

vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).

Write access to AFD rule sets and rules (Microsoft.Cdn/profiles/ruleSets/rules/write) lets an attacker inject response headers (including Set-Cookie), perform request redirects to attacker-controlled URLs, and modify URL rewrites - all without touching origins or WAF.

compute.securityPolicies.update lets a principal modify rules in a Cloud Armor security policy - deleting DENY rules, removing geo/IP blocks, disabling adaptive protection, or inserting a catch-all ALLOW - weakening the WAF/DDoS edge access control protecting the attached HTTP(S) LB backend.

compute.backendServices.setSecurityPolicy removes or replaces the Cloud Armor security policy attached to a backend service, stripping L7 DDoS mitigation and WAF rule enforcement from all traffic reaching that backend. setSecurityPolicy is a distinct IAM permission (not subsumed by compute.backendServices.update).