aws-directconnect-dxgw-routes-to-tgw

A Direct Connect Gateway with an accepted association to a TransitGateway routes on-premises traffic to the TGW and its attached VPCs.

explicit aws emits RoutesTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

[{'dxgw': None}]

where

node_type(?dxgw) == TransitGateway ?dxgw.provider_type == 'AWS::DirectConnect::DirectConnectGateway' node_type(?tgw) == TransitGateway ?tgw.provider_type == 'AWS::EC2::TransitGateway' ?dxgw.properties.directConnectGatewayAssociations[?associationState == 'associated'].associatedGateway.id == ?tgw.native_id

emit

source typeTransitGateway
target typeTransitGateway
source?dxgw
target?tgw
conditionsnetwork_reachability
state logicCONDITIONAL(network_reachability): the DXGW→TGW routing FACT exists when the gateway association is in state 'associated'. Route propagation on the TGW's route tables determines which VPCs are reachable onward.

Narrative

The Direct Connect Gateway {dxgw.name} has an accepted association to Transit Gateway {tgw.name}, enabling traffic from the on-premises network (via a transit VIF) to reach the TGW's route tables and attached VPCs.

Raw rule rules/explicit/aws-directconnect.yaml

id: aws-directconnect-dxgw-routes-to-tgw
emits: RoutesTo
description: A Direct Connect Gateway with an accepted association to a TransitGateway routes on-premises
  traffic to the TGW and its attached VPCs.
applies_to:
- aws
match:
- - dxgw: null
where:
- node_type(?dxgw) == TransitGateway
- ?dxgw.provider_type == 'AWS::DirectConnect::DirectConnectGateway'
- node_type(?tgw) == TransitGateway
- ?tgw.provider_type == 'AWS::EC2::TransitGateway'
- ?dxgw.properties.directConnectGatewayAssociations[?associationState == 'associated'].associatedGateway.id
  == ?tgw.native_id
emit:
  source_type: TransitGateway
  target_type: TransitGateway
  source: ?dxgw
  target: ?tgw
  permissions: []
  conditions:
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability): the DXGW\u2192TGW routing FACT exists when the gateway\
    \ association is in state 'associated'. Route propagation on the TGW's route tables determines which\
    \ VPCs are reachable onward."
  confidence: 0.9
  derived_from:
  - DescribeDirectConnectGatewayAssociations.associationState == 'associated'
  false_positive_note: '(1) Association state gate: only emit when associationState == ''associated''.
    Associations in ''pending'', ''disassociating'', or ''disassociated'' state do not route traffic.
    (2) Cross-account associations: if the target TGW is in a different account, a separate CrossAccountTrust
    edge is emitted (see aws-directconnect-dxgw-cross-account-trust).'
  narrative: The Direct Connect Gateway {dxgw.name} has an accepted association to Transit Gateway {tgw.name},
    enabling traffic from the on-premises network (via a transit VIF) to reach the TGW's route tables
    and attached VPCs.
move · open · esc close