aws-vpclattice-resource-config-private-reach

A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC clients to the resource through the resource gateway.

derived aws emits PrivateReachability

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'vpc': None} CanNetworkReach {'servicenetwork': None} {'resourcegw': None} LocatedIn {'vpc': None}

where

node_type(?vpc) == VirtualNetwork node_type(?servicenetwork) == GenericNetwork node_type(?resourcegw) == PrivateEndpoint ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork' ?resourcegw.provider_type == 'AWS::VpcLattice::ResourceGateway' exists ServiceNetworkResourceAssociation: serviceNetworkId=?servicenetwork.id, resourceGatewayId=?resourcegw.id, status=='ACTIVE' resource configuration type is one of: RDS (via ARN), IP, DOMAIN

emit

source type	`Compute`
target type	`PrivateEndpoint`
source	`<generic Compute workload in ?vpc (placeholder; specific compute nodes resolve via downstream network-chains linchpin)`
target	`?resourcegw`
conditions	`network_reachability`
state logic	ACTIVE when resource config association status=='ACTIVE' and the resource gateway is deployed and active in the resource owner's VPC. CONDITIONAL(service_state) when the resource gateway is not yet provisioned or the association is CREATE_IN_PROGRESS. CONDITIONAL(network_reachability) always: target resource's security group must permit ingress from Lattice managed prefix list (169.254.171.x) on the resource port.

Narrative

Resource gateway {target.name} is associated with service network {servicenetwork.name}. Clients in connected VPCs can privately reach backend resources (e.g. RDS, IP endpoints) via this gateway - no public endpoint required, no internet traversal.

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-resource-config-private-reach
emits: PrivateReachability
description: A ServiceNetworkResourceAssociation with status ACTIVE grants PrivateReachability from connected-VPC
  clients to the resource through the resource gateway.
applies_to:
- aws
match:
- - vpc: null
  - CanNetworkReach
  - servicenetwork: null
- - resourcegw: null
  - LocatedIn
  - vpc: null
where:
- node_type(?vpc) == VirtualNetwork
- node_type(?servicenetwork) == GenericNetwork
- node_type(?resourcegw) == PrivateEndpoint
- ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork'
- ?resourcegw.provider_type == 'AWS::VpcLattice::ResourceGateway'
- 'exists ServiceNetworkResourceAssociation: serviceNetworkId=?servicenetwork.id, resourceGatewayId=?resourcegw.id,
  status==''ACTIVE'''
- 'resource configuration type is one of: RDS (via ARN), IP, DOMAIN'
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <generic Compute workload in ?vpc (placeholder; specific compute nodes resolve via downstream
    network-chains linchpin)
  target: ?resourcegw
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'ACTIVE when resource config association status==''ACTIVE'' and the resource gateway is
    deployed and active in the resource owner''s VPC. CONDITIONAL(service_state) when the resource gateway
    is not yet provisioned or the association is CREATE_IN_PROGRESS. CONDITIONAL(network_reachability)
    always: target resource''s security group must permit ingress from Lattice managed prefix list (169.254.171.x)
    on the resource port.'
  confidence: 0.9
  derived_from:
  - ?vpc CanNetworkReach ?servicenetwork
  api_source: vpc-lattice:ListServiceNetworkResourceAssociations
  evidence_field: status
  false_positive_note: PrivateReachability means the VPC can ROUTE to the resource via the resource gateway;
    it does NOT bypass the resource's own authentication (e.g. DB password, IAM DB auth). Auth policies
    are NOT supported on resource configurations; access control is the resource's own mechanism. Emit
    only when the resource gateway status is ACTIVE and the resource configuration is concrete.
  narrative: "Resource gateway {target.name} is associated with service network {servicenetwork.name}.\
    \ Clients in connected VPCs can privately reach backend resources (e.g. RDS, IP endpoints) via this\
    \ gateway \u2014 no public endpoint required, no internet traversal."