aws-tgw-attachment-routes-to-subnet

id: aws-tgw-attachment-routes-to-subnet
emits: RoutesTo
applies_to:
- aws
match_record:
  resource_type: AWS::EC2::TransitGatewayVpcAttachment
  field: SubnetIds
where:
- attachment.State == 'available'
emit:
  source_type: TransitGateway
  target_type: Subnet
  source: <TransitGateway node for attachment.TransitGatewayId>
  target: <Subnet node for each SubnetId in attachment.SubnetIds>
  api_source: ec2:DescribeTransitGatewayVpcAttachments
  evidence_field: TransitGatewayVpcAttachment.SubnetIds + State
  conditions:
  - network_reachability
  state_logic: "ACTIVE when attachment.State == 'available'. CONDITIONAL(service_state) when State ==\
    \ 'pendingAcceptance' (cross-account attachment awaiting owner acceptance). Omit for State in [failed,\
    \ rejected, deleting, deleted, rolledBack]. This is a routing TOPOLOGY fact; it does not assert L4\
    \ reachability (SGs still apply at destination) \u2014 annotate CONDITIONAL(network_reachability)\
    \ for linchpin evaluation."
  false_positive_note: "Emit only for State == 'available'. 'pendingAcceptance' attachments have no routing\
    \ effect until accepted (CONDITIONAL(service_state)). Each SubnetId in SubnetIds generates a separate\
    \ RoutesTo edge. The attachment joins the VPC's subnets to the TGW fabric but does NOT guarantee routes\
    \ in any TGW route table \u2014 a matching propagation or static route must also exist (resolved by\
    \ aws-tgw-route-table-routes-to-subnet)."
  narrative: 'TGW {tgw.name} has an active VPC attachment including subnet {subnet.name}. This is a structural
    routing fact: the subnet is enrolled on the TGW fabric (attachment state: available). Full reachability
    requires route table evaluation.'