aws-globalaccelerator-routes-to-endpoint

An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for per-service network facts.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'accelerator': None} IsOfType LoadBalancer {'endpointGroup': None} IsOfType GenericNetwork {'accelerator': None} Contains {'endpointGroup': None}

where

?accelerator.provider_type == 'AWS::GlobalAccelerator::Accelerator' ?endpointGroup.provider_type == 'AWS::GlobalAccelerator::EndpointGroup' ?accelerator.Status == 'DEPLOYED' and ?accelerator.Enabled == true ?endpointGroup.TrafficDialPercentage > 0 exists endpoint in ?endpointGroup.EndpointDescriptions where endpoint.Weight > 0 and endpoint.HealthState == 'HEALTHY'

emit

source type	`LoadBalancer`
target type	`LoadBalancer`
source	`?accelerator`
target	`<Endpoint target node (ALB/NLB/EC2/EIP resolved from EndpointId)>`
conditions	`network_reachability` `service_state`
state logic	CONDITIONAL(network_reachability) — per Phase 8 discipline, all per-service network forwarding facts start as CONDITIONAL. The full end-to-end internet-to-endpoint reachability chain (accounting for SGs, VPC routes, endpoint service configuration) is composed by the future network-chains linchpin file. Do NOT emit for UNHEALTHY endpoints — AWS removes them from the active routing pool; they receive zero traffic.

Narrative

{source.name} (Global Accelerator) forwards internet traffic to {target.name} via an active Endpoint Group (traffic-dial: {TrafficDialPercentage}%, endpoint weight: {Weight}). Internet clients reaching the accelerator's anycast IPs are forwarded to this healthy endpoint over the AWS private backbone.

Raw rule rules/derived/aws/globalaccelerator.yaml

id: aws-globalaccelerator-routes-to-endpoint
emits: CanNetworkReach
description: An active Endpoint Group with healthy endpoints forwards traffic from the accelerator to
  each endpoint. Emits CanNetworkReach CONDITIONAL on network reachability, per Phase 8 discipline for
  per-service network facts.
applies_to:
- aws
match:
- - accelerator: null
  - IsOfType
  - LoadBalancer
- - endpointGroup: null
  - IsOfType
  - GenericNetwork
- - accelerator: null
  - Contains
  - endpointGroup: null
where:
- ?accelerator.provider_type == 'AWS::GlobalAccelerator::Accelerator'
- ?endpointGroup.provider_type == 'AWS::GlobalAccelerator::EndpointGroup'
- ?accelerator.Status == 'DEPLOYED' and ?accelerator.Enabled == true
- ?endpointGroup.TrafficDialPercentage > 0
- exists endpoint in ?endpointGroup.EndpointDescriptions where endpoint.Weight > 0 and endpoint.HealthState
  == 'HEALTHY'
emit:
  source_type: LoadBalancer
  target_type: LoadBalancer
  source: ?accelerator
  target: <Endpoint target node (ALB/NLB/EC2/EIP resolved from EndpointId)>
  state: CONDITIONAL
  permissions: []
  conditions:
  - network_reachability
  - service_state
  state_logic: "CONDITIONAL(network_reachability) \u2014 per Phase 8 discipline, all per-service network\
    \ forwarding facts start as CONDITIONAL. The full end-to-end internet-to-endpoint reachability chain\
    \ (accounting for SGs, VPC routes, endpoint service configuration) is composed by the future network-chains\
    \ linchpin file. Do NOT emit for UNHEALTHY endpoints \u2014 AWS removes them from the active routing\
    \ pool; they receive zero traffic."
  derived_from:
  - accelerator_normalization
  - endpoint_group_normalization
  confidence: 1.0
  false_positive_note: "Do NOT emit when TrafficDialPercentage == 0 (group configured but not routing),\
    \ when endpoint Weight == 0 (endpoint excluded), or when endpoint HealthState == UNHEALTHY (endpoint\
    \ not in active pool). Endpoints must be resolved to native resource nodes; do not emit pointing to\
    \ bare endpoint descriptions. Endpoints are restricted to the same account as the accelerator \u2014\
    \ no cross-account forwarding. This edge captures per-service forwarding configuration only; transitive\
    \ reachability is future linchpin scope."
  narrative: '{source.name} (Global Accelerator) forwards internet traffic to {target.name} via an active
    Endpoint Group (traffic-dial: {TrafficDialPercentage}%, endpoint weight: {Weight}). Internet clients
    reaching the accelerator''s anycast IPs are forwarded to this healthy endpoint over the AWS private
    backbone.'