azure-frontdoor-routes-to-origin

id: azure-frontdoor-routes-to-origin
emits: RoutesTo
description: 'An enabled AFD routing rule (route) linking a front door endpoint to an origin group with
  at least one enabled origin is a RoutesTo fact: the AFD route object (generic_type: Route, provider_type:
  Microsoft.Cdn/profiles/afdEndpoints/routes) routes matched internet requests to that origin resource.
  This is derived from the explicit normalization rule azure-frontdoor-origin-record.'
where:
- Microsoft.Cdn/profiles/{p}/afdEndpoints/{ep}/routes/{route} with properties.enabledState == 'Enabled'
- the route's originGroup has at least one origin with properties.enabledState == 'Enabled'
- origin properties.hostName is non-empty (public origin) OR properties.sharedPrivateLinkResource is not
  null (Private Link origin)
emit:
  source_type: Route
  target_type: PublicEndpoint
  source: '<AFD route node (Route, provider_type: Microsoft.Cdn/profiles/afdEndpoints/routes)>'
  target: <origin resource node (PublicEndpoint for public hostname, PrivateEndpoint for PL origin)>
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when the route is Enabled AND the origin group contains at least one Enabled, healthy
    origin. CONDITIONAL(network_reachability) if origin health cannot be confirmed from ARM data alone
    (health probe state requires runtime data). Do NOT emit for routes with enabledState == 'Disabled'
    or when the linked origin group has no enabled origins.
  derived_from:
  - azure-frontdoor-origin-record
  false_positive_note: "The source must be modeled as a Route node (generic_type: Route), NOT a LoadBalancer.\
    \ Per edges.yaml, RoutesTo source set is [Route, Subnet, TransitGateway]; LoadBalancer is NOT a valid\
    \ RoutesTo source. The AFD route object (Microsoft.Cdn/profiles/ afdEndpoints/routes or Microsoft.Cdn/profiles/endpoints\
    \ for Classic CDN) is the correct Route-class node. Emit one RoutesTo edge per (enabled-route, enabled-origin)\
    \ pair. For Classic CDN the route-equivalent is the CDN endpoint itself (Microsoft.Cdn/profiles/endpoints,\
    \ also modeled as Route for this purpose) pointing to each enabled origin. The target must match RoutesTo's\
    \ target set: [Network, Subnet]. 'Network' in edges.yaml represents the abstract Network class; concrete\
    \ types like PublicEndpoint and PrivateEndpoint (generic_type subtypes within the Network class) are\
    \ valid RoutesTo targets. An origin with enabledState == 'Disabled' is out of rotation \u2014 do not\
    \ emit RoutesTo for it."
  narrative: AFD route {source.name} (endpoint {endpoint.name}) routes matched internet requests to origin
    {target.name} ({target.hostName}). Traffic forwarded by this routing rule reaches this backend origin
    after AFD PoP processing.