azure-vwan-er-connection-record

id: azure-vwan-er-connection-record
emits: RoutesTo
description: "An active ExpressRoute connection (expressRouteConnections, provisioningState=Succeeded)\
  \ is an explicit routing fact: the Virtual Hub routes traffic to and from the on-premises network via\
  \ the ExpressRoute circuit.\nNOTE \u2014 Semantic Extension: RoutesTo normally targets [Network, Subnet].\
  \ On-premises networks may not exist as discrete nodes in the collected inventory if they are not explicitly\
  \ modeled as Network nodes. In this case, the target is the ExpressRoute Circuit (TransitGateway) representing\
  \ the on-premises reachability point. The network-chains linchpin must handle TransitGateway targets\
  \ of RoutesTo as a special case distinct from Network/Subnet targets, treating them as proxies for external\
  \ networks."
applies_to:
- azure
source_config:
  resource_type: Microsoft.Network/expressRouteGateways/expressRouteConnections
  field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.expressRouteCircuitPeering.id is non-null
emit:
  source_type: TransitGateway
  target_type: TransitGateway
  source: <Virtual Hub that owns the parent expressRouteGateway>
  target: <ExpressRoute Circuit node resolved from properties.expressRouteCircuitPeering.id>
  api_source: Microsoft.Network/expressRouteGateways/expressRouteConnections GET
  evidence_field: properties.provisioningState + properties.expressRouteCircuitPeering.id
  state_logic: ACTIVE when expressRouteConnections.provisioningState == Succeeded AND the circuit's serviceProviderProvisioningState
    == Provisioned (both sides provisioned). CONDITIONAL(region_or_boundary) if circuit-side state is
    not confirmed in inventory (ER circuit may be in a different subscription or not collected). NOT emitted
    for provisioningState != Succeeded.
  narrative: 'Hub {hub.name} has an active ExpressRoute connection to circuit {erCircuit.name} (provisioningState:
    Succeeded).'
  derived_from: []