aws-directconnect-vif-routes-to-gateway

id: aws-directconnect-vif-routes-to-gateway
emits: RoutesTo
description: A private or transit Direct Connect Virtual Interface in AVAILABLE state routes the on-premises
  network into the attached VGW or DXGW, establishing a non-internet routed path from on-prem into AWS
  private address space.
applies_to:
- aws
match:
- - vif: null
  - AttachedTo
  - gateway: null
where:
- node_type(?vif) == Route
- ?vif.provider_type == 'AWS::DirectConnect::VirtualInterface'
- ?vif.properties.virtualInterfaceType in ['private', 'transit']
- ?vif.properties.virtualInterfaceState == 'available'
- node_type(?gateway) in [TransitGateway, VirtualNetwork]
- ?gateway.provider_type in ['AWS::DirectConnect::DirectConnectGateway', 'AWS::EC2::VPNGateway', 'AWS::EC2::TransitGateway']
emit:
  source_type: Route
  target_type: Network
  source: ?vif
  target: ?gateway
  permissions: []
  conditions:
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability): the routing FACT exists when the VIF is in AVAILABLE\
    \ state and attached to the gateway (VGW or DXGW). Whether a specific workload in the target VPC is\
    \ actually reachable from on-prem additionally requires (a) route propagation to subnets, (b) security\
    \ group rules, and (c) NACLs \u2014 these are evaluated by the network-chains linchpin. Downgrade\
    \ to UNKNOWN if VIF state cannot be confirmed from collected data. Do NOT emit for public VIFs (virtualInterfaceType\
    \ == 'public')."
  confidence: 0.9
  derived_from:
  - DescribeVirtualInterfaces.virtualGatewayId or directConnectGatewayId
  false_positive_note: "(1) AVAILABLE-state gate: only VIFs with virtualInterfaceState == 'available'\
    \ provide active routing. Pending, confirming, deleting, or deleted VIFs do NOT \u2014 do not emit\
    \ for those states. (2) Public VIF exclusion: a VIF of type 'public' routes to AWS public IP ranges,\
    \ not into a VPC \u2014 there is no lateral-movement path to private compute resources. Do NOT emit\
    \ RoutesTo for public VIFs. (3) Hosted connections: on hosted DX (provisioned by an AWS partner),\
    \ the physical connection is in the partner account; only the VIF is visible to the customer. The\
    \ RoutesTo fact is still valid from the customer's graph perspective. (4) Route propagation: even\
    \ with a valid VIF\u2192VGW RoutesTo, subnets only receive the on-prem routes if VGW route propagation\
    \ is enabled on the route table. This onward reachability is handled by the network-chains linchpin\
    \ \u2014 not here. (5) DXGW transit VIFs: emit VIF\u2192DXGW only; the DXGW\u2192TGW RoutesTo is a\
    \ separate fact from DescribeDirectConnectGatewayAssociations."
  narrative: "The Direct Connect Virtual Interface {vif.name} (type: {vif.properties.virtualInterfaceType},\
    \ state: available) routes the on-premises network ({vif.properties.amazonSideAsn}) into {gateway.name}.\
    \ Any system on the on-premises network that can route to the VIF's peering addresses has a non-internet\
    \ path into this AWS gateway and, transitively, into the attached VPC(s) \u2014 subject to route propagation,\
    \ security groups, and NACLs."