rage.fail

gcp-certmanager-located-in

explicit gcp emits LocatedIn

match (record)

{ "field": "name (locations/*)", "resource_type": "google.privateca.CaPool" }

where

CA pool is regional (projects/*/locations/<region>/caPools/*)

emit

source type	`*`
source	`<CA pool node>`
target	`<region / location boundary>`

Narrative

{capool.name} is located in {region}.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-located-in
emits: LocatedIn
applies_to:
- gcp
match_record:
  resource_type: google.privateca.CaPool
  field: name (locations/*)
where:
- CA pool is regional (projects/*/locations/<region>/caPools/*)
emit:
  source_type: '*'
  source: <CA pool node>
  target: <region / location boundary>
  api_source: privateca.projects.locations.caPools.get
  evidence_field: name
  narrative: '{capool.name} is located in {region}.'