Route

A principal with App Mesh route/service write actions can modify the Envoy xDS configuration delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled virtual node (traffic hijack within the mesh).

IAM principal with directconnect:DeleteVirtualInterface can disrupt existing Direct Connect routing (availability impact, not escalation).

IAM principal with Direct Connect write actions can create or modify virtual interfaces and DXGW associations, altering which networks have a routed path into AWS VPCs (network topology manipulation). Covers constructive/expansive actions only (Create, Update, Accept); Delete actions are modeled separately as CanDelete.

A private or transit Direct Connect Virtual Interface in AVAILABLE state routes the on-premises network into the attached VGW or DXGW, establishing a non-internet routed path from on-prem into AWS private address space.

A principal with ec2:CreateTransitGatewayRoute or ec2:ReplaceTransitGatewayRoute on a TGW route table can inject or overwrite routes, redirecting inter-VPC or on-premises traffic to an attacker-controlled attachment - man-in-the-middle at L3 or traffic sinkhole. Modeled as CanModifyConfiguration on the Route (TGW route table) node.

A principal with ec2:CreateRoute, ec2:ReplaceRoute, or ec2:AttachInternetGateway can make a previously-private subnet internet-routable, exposing any resource in that subnet that has a public IP.

Azure Firewall DNAT rule (classic natRuleCollections model) is ingested as a synthetic Route node encoding (firewall_id, rule_name). The route is linked to the internal destination subnet via RoutesTo edge.

Azure Firewall Policy DNAT rule (firewallPolicies/ruleCollectionGroups model) is ingested as a synthetic Route node. The route is linked to the internal destination subnet via RoutesTo edge. Target is the Firewall that references this policy.

An enabled AFD routing rule (route) linking a front door endpoint to an origin group with at least one enabled origin is a RoutesTo fact: the AFD route object (generic_type: Route, provider_type: Microsoft.Cdn/profiles/afdEndpoints/routes) routes matched internet requests to that origin resource. This is derived from the explicit normalization rule azure-frontdoor-origin-record.

A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.