rage.fail

azure-vnet-route-record

explicit azure emits RoutesTo

match (record)

{ "field": "properties", "resource_type": "Microsoft.Network/routeTables/routes" }

where

properties.nextHopType != 'None' route table has at least one associated subnet

emit

source type	`Route`
target type	`Subnet`
source	`<route table node>`
target	`<destination (addressPrefix) mapped to Subnet or VNet node; 'internet' sentinel if nextHopType=Internet>`

Narrative

Route table {routeTable.name} routes {addressPrefix} -> {nextHopType} ({nextHopIpAddress}).

Raw rule rules/explicit/azure-vnet.yaml

id: azure-vnet-route-record
emits: RoutesTo
applies_to:
- azure
match_record:
  resource_type: Microsoft.Network/routeTables/routes
  field: properties
where:
- properties.nextHopType != 'None'
- route table has at least one associated subnet
emit:
  source_type: Route
  target_type: Subnet
  source: <route table node>
  target: <destination (addressPrefix) mapped to Subnet or VNet node; 'internet' sentinel if nextHopType=Internet>
  api_source: Microsoft.Network/routeTables/routes GET
  evidence_field: properties.addressPrefix + properties.nextHopType + properties.nextHopIpAddress
  narrative: Route table {routeTable.name} routes {addressPrefix} -> {nextHopType} ({nextHopIpAddress}).