rage.fail

gcp-clouddns-private-zone-vpc-attachment

explicit gcp emits LocatedIn

where

zone.visibility == 'private' privateVisibilityConfig.networks[] contains at least one networkUrl

emit

source type	`DNS`
target type	`VirtualNetwork`
source	`<private Cloud DNS managed zone>`
target	`<VPC network referenced in privateVisibilityConfig.networks[]>`

Narrative

Private Cloud DNS zone {zone.name} is located in and resolvable from VPC network {network.name}.

Raw rule rules/explicit/gcp-clouddns.yaml

id: gcp-clouddns-private-zone-vpc-attachment
emits: LocatedIn
applies_to:
- gcp
source_config:
  resource_type: dns.googleapis.com/ManagedZone
  field: privateVisibilityConfig.networks
where:
- zone.visibility == 'private'
- privateVisibilityConfig.networks[] contains at least one networkUrl
emit:
  source_type: DNS
  target_type: VirtualNetwork
  source: <private Cloud DNS managed zone>
  target: <VPC network referenced in privateVisibilityConfig.networks[]>
  api_source: dns.managedZones.get (GET /dns/v1/projects/{project}/managedZones/{zone})
  evidence_field: privateVisibilityConfig.networks[].networkUrl
  narrative: Private Cloud DNS zone {zone.name} is located in and resolvable from VPC network {network.name}.