VirtualNetwork

A principal with App Mesh route/service write actions can modify the Envoy xDS configuration delivered to mesh sidecars, redirecting in-mesh or inbound gateway traffic to an attacker-controlled virtual node (traffic hijack within the mesh).

A private or transit Direct Connect Virtual Interface in AVAILABLE state routes the on-premises network into the attached VGW or DXGW, establishing a non-internet routed path from on-prem into AWS private address space.

A principal with ec2:CreateNetworkAclEntry, ec2:ReplaceNetworkAclEntry, or ec2:ReplaceNetworkAclAssociation can modify Network ACL rules, changing the firewall posture at the subnet level. This is a weaken-controls primitive for stateless packet filtering, complementary to security groups.

A principal with ec2:CreateVpcPeeringConnection can initiate a VPC peering to any VPC (including cross-account). Accepting requires ec2:AcceptVpcPeeringConnection on the accepter side. This permission enables establishing new cross-VPC connectivity.

An active VPC peering connection creates bidirectional connectivity between two VPCs. Security groups in each VPC can reference the peer's CIDR as a source/destination, expanding the effective reachability surface.

A principal with ec2:CreateRoute, ec2:ReplaceRoute, or ec2:AttachInternetGateway can make a previously-private subnet internet-routable, exposing any resource in that subnet that has a public IP.

A principal with ec2:CreateSecurityGroup can create a new permissive SG, then attach it to a resource (requires ec2:ModifyNetworkInterfaceAttribute or service-specific attach permission), effectively bypassing existing rules.

A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC clients to the resource through the resource gateway.

A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane reachability from the VPC to the service network.

A Microsoft.Network/privateDnsZones/virtualNetworkLinks ARM record directly observes that a private DNS zone is linked to a VNet. This is a structural fact: the zone's DNS records apply to name resolution within that VNet.

Write access to VNet peerings lets an attacker create or modify peerings, extending network reachability from an attacker-controlled VNet into this VNet.

An active hub VNet connection (hubVirtualNetworkConnections, provisioningState=Succeeded) is an explicit routing fact: the Virtual Hub routes traffic to and from the connected spoke VNet.