aws-elb-routes-to-target-group

An ALB or NLB listener with a forward action creates a network path from the LB to its backend targets (instances/IPs/ALBs). This is a CONDITIONAL(network_reachability) fact - the LB SG must allow inbound AND the backend SG must allow inbound from the LB's SG/IP range.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'lb': None} HasListener {'listener': None} {'listener': None} HasForwardAction {'target_group': None}

where

node_type(?lb) == LoadBalancer ?listener.properties.DefaultActions[*].Type contains 'forward' ?listener.properties.DefaultActions[*].ForwardConfig.TargetGroups is non-empty ?target_group is registered with at least one backend target (instance, ip, or alb)

emit

source type	`LoadBalancer`
target type	`Compute` `Network`
source	`?lb`
target	`<backend targets (Compute instances/IPs or Network ALB) registered in the TargetGroup>`
conditions	`network_reachability` `service_state`
state logic	CONDITIONAL(network_reachability) always — the LB provides an L7/L4 path to the backend but whether traffic actually reaches the backend depends on: (a) the LB's SG allowing the inbound port (for ALB/CLB); (b) the backend's SG allowing inbound from the LB SG/ENI IPs; (c) at least one healthy registered target. Promote to ACTIVE only when all three conditions are confirmed by collector evidence. CONDITIONAL(service_state) when no healthy targets exist. The state remains CONDITIONAL until the scoring engine validates both the inbound and backend security group rules.

Narrative

{source.name}'s listener on port {listener.port} ({listener.protocol}) forwards matching traffic through the load balancer to backend targets in the target group, providing a conditional network path to {target.name} subject to security group rules on both the LB and the backend.

Raw rule rules/derived/aws/elb.yaml

id: aws-elb-routes-to-target-group
emits: CanNetworkReach
description: "An ALB or NLB listener with a forward action creates a network path from the LB to its backend\
  \ targets (instances/IPs/ALBs). This is a CONDITIONAL(network_reachability) fact \u2014 the LB SG must\
  \ allow inbound AND the backend SG must allow inbound from the LB's SG/IP range."
applies_to:
- aws
match:
- - lb: null
  - HasListener
  - listener: null
- - listener: null
  - HasForwardAction
  - target_group: null
where:
- node_type(?lb) == LoadBalancer
- ?listener.properties.DefaultActions[*].Type contains 'forward'
- ?listener.properties.DefaultActions[*].ForwardConfig.TargetGroups is non-empty
- ?target_group is registered with at least one backend target (instance, ip, or alb)
emit:
  source_type: LoadBalancer
  target_type:
  - Compute
  - Network
  source: ?lb
  target: <backend targets (Compute instances/IPs or Network ALB) registered in the TargetGroup>
  state: CONDITIONAL
  permissions: []
  api_source: elasticloadbalancing:DescribeLoadBalancers + elasticloadbalancing:DescribeListeners + elasticloadbalancing:DescribeTargetGroups
    + elasticloadbalancing:DescribeTargetHealth
  evidence_field: Listener.DefaultActions[*].ForwardConfig.TargetGroups + TargetHealth[*].Target
  conditions:
  - network_reachability
  - service_state
  state_logic: "CONDITIONAL(network_reachability) always \u2014 the LB provides an L7/L4 path to the backend\
    \ but whether traffic actually reaches the backend depends on: (a) the LB's SG allowing the inbound\
    \ port (for ALB/CLB); (b) the backend's SG allowing inbound from the LB SG/ENI IPs; (c) at least one\
    \ healthy registered target. Promote to ACTIVE only when all three conditions are confirmed by collector\
    \ evidence. CONDITIONAL(service_state) when no healthy targets exist. The state remains CONDITIONAL\
    \ until the scoring engine validates both the inbound and backend security group rules."
  confidence: 0.8
  derived_from:
  - ?lb HasListener ?listener (with forward action)
  - ?listener HasForwardAction ?target_group
  false_positive_note: "Do NOT emit end-to-end CanNetworkReach from the internet through the LB to the\
    \ backend in a single step \u2014 that is the transitive network-chains linchpin (FUTURE). Emit only:\
    \ (1) ExposedToInternet on the LB (from aws-elb-internet-facing-explicit), and (2) this CanNetworkReach\
    \ from the LB to the backend (the second hop). The network-chains file will compose them. Emit for\
    \ ALL target types (instance, ip, alb) where the target is a Compute or Network node. For Lambda targets,\
    \ use CanTrigger (aws-elb-trigger-lambda-target) instead \u2014 Lambda is invoked, not network-reached.\
    \ For redirect/fixed-response actions, do NOT emit \u2014 no backend target is reached."
  narrative: '{source.name}''s listener on port {listener.port} ({listener.protocol}) forwards matching
    traffic through the load balancer to backend targets in the target group, providing a conditional
    network path to {target.name} subject to security group rules on both the LB and the backend.'