azure-vwan-hub-vnet-connection-record
An active hub VNet connection (hubVirtualNetworkConnections, provisioningState=Succeeded) is an explicit routing fact: the Virtual Hub routes traffic to and from the connected spoke VNet.
where
properties.provisioningState == 'Succeeded'
properties.remoteVirtualNetwork.id is non-null
emit
| source type | TransitGateway |
|---|---|
| target type | VirtualNetwork |
| source | <parent Virtual Hub node> |
| target | <VirtualNetwork node resolved from properties.remoteVirtualNetwork.id> |
| state logic | ACTIVE when provisioningState == Succeeded AND the parent hub provisioningState == Succeeded AND the spoke VNet node is confirmed in collected inventory. CONDITIONAL(region_or_boundary) when the spoke VNet is in a subscription not in collection scope (cross-subscription hub connection). NOT emitted when provisioningState is Deleting, Failed, or Updating. |
Narrative
Hub {hub.name} has an active spoke connection to VNet {vnet.name} (provisioningState: Succeeded).
Raw rule rules/explicit/azure/vwan.yaml
id: azure-vwan-hub-vnet-connection-record
emits: RoutesTo
description: 'An active hub VNet connection (hubVirtualNetworkConnections, provisioningState=Succeeded)
is an explicit routing fact: the Virtual Hub routes traffic to and from the connected spoke VNet.'
applies_to:
- azure
source_config:
resource_type: Microsoft.Network/virtualHubs/hubVirtualNetworkConnections
field: properties
where:
- properties.provisioningState == 'Succeeded'
- properties.remoteVirtualNetwork.id is non-null
emit:
source_type: TransitGateway
target_type: VirtualNetwork
source: <parent Virtual Hub node>
target: <VirtualNetwork node resolved from properties.remoteVirtualNetwork.id>
api_source: Microsoft.Network/virtualHubs/hubVirtualNetworkConnections GET
evidence_field: properties.remoteVirtualNetwork.id + properties.provisioningState
state_logic: ACTIVE when provisioningState == Succeeded AND the parent hub provisioningState == Succeeded
AND the spoke VNet node is confirmed in collected inventory. CONDITIONAL(region_or_boundary) when
the spoke VNet is in a subscription not in collection scope (cross-subscription hub connection). NOT
emitted when provisioningState is Deleting, Failed, or Updating.
narrative: 'Hub {hub.name} has an active spoke connection to VNet {vnet.name} (provisioningState: Succeeded).'
derived_from: []