rage.fail

gcp-ar-located-in

explicit gcp emits LocatedIn

match (record)

{ "field": "name (locations/*)", "resource_type": "google.artifactregistry.Repository" }

where

repository name path contains a location segment (locations/<region>)

emit

source type	`*`
source	`<Artifact Registry repository node>`
target	`<location / region boundary>`

Narrative

{repo.name} is located in {location} (Artifact Registry repos are region-scoped).

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-located-in
emits: LocatedIn
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: name (locations/*)
where:
- repository name path contains a location segment (locations/<region>)
emit:
  source_type: '*'
  source: <Artifact Registry repository node>
  target: <location / region boundary>
  api_source: artifactregistry.projects.locations.repositories.list
  evidence_field: name (location segment)
  narrative: '{repo.name} is located in {location} (Artifact Registry repos are region-scoped).'