aws-directconnect-dxgw-routes-to-tgw
A Direct Connect Gateway with an accepted association to a TransitGateway routes on-premises traffic to the TGW and its attached VPCs.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
[{'dxgw': None}]
where
node_type(?dxgw) ==
TransitGateway
?dxgw.provider_type == 'AWS::DirectConnect::DirectConnectGateway'
node_type(?tgw) == TransitGateway
?tgw.provider_type == 'AWS::EC2::TransitGateway'
?dxgw.properties.directConnectGatewayAssociations[?associationState == 'associated'].associatedGateway.id == ?tgw.native_id
emit
| source type | TransitGateway |
|---|---|
| target type | TransitGateway |
| source | ?dxgw |
| target | ?tgw |
| conditions | network_reachability |
| state logic | CONDITIONAL(network_reachability): the DXGW→TGW routing FACT exists when the gateway association is in state 'associated'. Route propagation on the TGW's route tables determines which VPCs are reachable onward. |
Narrative
The Direct Connect Gateway {dxgw.name} has an accepted association to Transit Gateway {tgw.name}, enabling traffic from the on-premises network (via a transit VIF) to reach the TGW's route tables and attached VPCs.
Raw rule rules/explicit/aws-directconnect.yaml
id: aws-directconnect-dxgw-routes-to-tgw
emits: RoutesTo
description: A Direct Connect Gateway with an accepted association to a TransitGateway routes on-premises
traffic to the TGW and its attached VPCs.
applies_to:
- aws
match:
- - dxgw: null
where:
- node_type(?dxgw) == TransitGateway
- ?dxgw.provider_type == 'AWS::DirectConnect::DirectConnectGateway'
- node_type(?tgw) == TransitGateway
- ?tgw.provider_type == 'AWS::EC2::TransitGateway'
- ?dxgw.properties.directConnectGatewayAssociations[?associationState == 'associated'].associatedGateway.id
== ?tgw.native_id
emit:
source_type: TransitGateway
target_type: TransitGateway
source: ?dxgw
target: ?tgw
permissions: []
conditions:
- network_reachability
state_logic: "CONDITIONAL(network_reachability): the DXGW\u2192TGW routing FACT exists when the gateway\
\ association is in state 'associated'. Route propagation on the TGW's route tables determines which\
\ VPCs are reachable onward."
confidence: 0.9
derived_from:
- DescribeDirectConnectGatewayAssociations.associationState == 'associated'
false_positive_note: '(1) Association state gate: only emit when associationState == ''associated''.
Associations in ''pending'', ''disassociating'', or ''disassociated'' state do not route traffic.
(2) Cross-account associations: if the target TGW is in a different account, a separate CrossAccountTrust
edge is emitted (see aws-directconnect-dxgw-cross-account-trust).'
narrative: The Direct Connect Gateway {dxgw.name} has an accepted association to Transit Gateway {tgw.name},
enabling traffic from the on-premises network (via a transit VIF) to reach the TGW's route tables
and attached VPCs.