aws-vpclattice-vpc-association-record

A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane reachability from the VPC to the service network.

derived aws emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`VirtualNetwork`
target type	`GenericNetwork`
source	`?vpc`
target	`?servicenetwork`
conditions	`network_reachability`
state logic	ACTIVE when the association record status=='ACTIVE'. CONDITIONAL(service_state) when status is CREATE_IN_PROGRESS or UPDATE_IN_PROGRESS. BLOCKED when status==FAILED. CONDITIONAL(network_reachability) always: security groups on the VPC association and on target resource gates L4 access; clients must route to Lattice managed prefix list (169.254.171.x).

source type

VirtualNetwork

target type

GenericNetwork

source

?vpc

target

?servicenetwork

conditions

network_reachability

state logic

ACTIVE when the association record status=='ACTIVE'. CONDITIONAL(service_state) when status is CREATE_IN_PROGRESS or UPDATE_IN_PROGRESS. BLOCKED when status==FAILED. CONDITIONAL(network_reachability) always: security groups on the VPC association and on target resource gates L4 access; clients must route to Lattice managed prefix list (169.254.171.x).

Narrative

VPC {source.name} is associated with service network {target.name} (status ACTIVE). Clients in this VPC can reach services in the network over the AWS private backbone via Lattice-managed link-local addressing.

Raw rule rules/derived/aws/vpclattice.yaml

id: aws-vpclattice-vpc-association-record
emits: CanNetworkReach
description: A ServiceNetworkVpcAssociation record with status ACTIVE establishes concrete network-plane
  reachability from the VPC to the service network.
applies_to:
- aws
match:
- - vpc: null
  - LocatedIn
  - region: null
- - servicenetwork: null
  - LocatedIn
  - region: null
where:
- node_type(?vpc) == VirtualNetwork
- node_type(?servicenetwork) == GenericNetwork
- ?servicenetwork.provider_type == 'AWS::VpcLattice::ServiceNetwork'
- 'exists ServiceNetworkVpcAssociation record: vpcId=?vpc.id, serviceNetworkId=?servicenetwork.id, status==''ACTIVE'''
emit:
  source_type: VirtualNetwork
  target_type: GenericNetwork
  source: ?vpc
  target: ?servicenetwork
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'ACTIVE when the association record status==''ACTIVE''. CONDITIONAL(service_state) when
    status is CREATE_IN_PROGRESS or UPDATE_IN_PROGRESS. BLOCKED when status==FAILED. CONDITIONAL(network_reachability)
    always: security groups on the VPC association and on target resource gates L4 access; clients must
    route to Lattice managed prefix list (169.254.171.x).'
  confidence: 0.95
  derived_from: []
  api_source: vpc-lattice:ListServiceNetworkVpcAssociations
  evidence_field: status
  false_positive_note: "This edge represents L7-plane reachability from the VPC to the service network;\
    \ individual services may still have auth policies (authType AWS_IAM) that require the caller to be\
    \ an authenticated IAM principal. Do NOT assume any client can invoke all services just because the\
    \ VPC is associated \u2014 auth policy evaluation is a separate gate."
  narrative: VPC {source.name} is associated with service network {target.name} (status ACTIVE). Clients
    in this VPC can reach services in the network over the AWS private backbone via Lattice-managed link-local
    addressing.