gcp-datastream-private-conn-network-reach
A Datastream PrivateConnection establishes VPC peering between the Datastream service network and a customer VPC, enabling network reach to private resources within that VPC and resources accessible via Cloud VPN or Dedicated Interconnect.
match (record)
{
"field": "vpcPeeringConfig.vpc",
"resource_type": "google.datastream.PrivateConnection"
}
where
privateConnection.vpcPeeringConfig.vpc is set to a non-empty VPC network resource name
privateConnection.state == CREATED (peering is established)
emit
| source type | Network |
|---|---|
| target type | Network |
| source | <PrivateConnection node (PrivateEndpoint / Network class)> |
| target | <peered VPC network and resources reachable within it> |
| conditions | network_reachability service_state |
| state logic | ACTIVE if privateConnection.state == CREATED (VPC peering is established). CONDITIONAL(service_state) if peering is CREATING or state is unknown. CONDITIONAL(network_reachability) if transitive routing through secondary hops (Cloud SQL proxy, NAT VM, on-prem via VPN) is required and not confirmed. This edge is a structural topology fact; attack value requires a stream using this private connection combined with write access (streams.update) to redirect or create stream destinations. |
Narrative
Datastream PrivateConnection {privateConnection.name} peers the Datastream service network into VPC {vpc.name}; this enables network reachability to databases at private IP addresses within {vpc.name}, including resources reachable via Cloud VPN or Dedicated Interconnect from that VPC. Streams using this private connection can reach these resources as data sources or destinations.
Raw rule rules/derived/gcp/datastream.yaml
id: gcp-datastream-private-conn-network-reach
emits: CanNetworkReach
description: A Datastream PrivateConnection establishes VPC peering between the Datastream service network
and a customer VPC, enabling network reach to private resources within that VPC and resources accessible
via Cloud VPN or Dedicated Interconnect.
match_record:
resource_type: google.datastream.PrivateConnection
field: vpcPeeringConfig.vpc
where:
- privateConnection.vpcPeeringConfig.vpc is set to a non-empty VPC network resource name
- privateConnection.state == CREATED (peering is established)
emit:
source_type: Network
target_type: Network
source: <PrivateConnection node (PrivateEndpoint / Network class)>
target: <peered VPC network and resources reachable within it>
permissions: []
conditions:
- network_reachability
- service_state
state_logic: ACTIVE if privateConnection.state == CREATED (VPC peering is established). CONDITIONAL(service_state)
if peering is CREATING or state is unknown. CONDITIONAL(network_reachability) if transitive routing
through secondary hops (Cloud SQL proxy, NAT VM, on-prem via VPN) is required and not confirmed. This
edge is a structural topology fact; attack value requires a stream using this private connection combined
with write access (streams.update) to redirect or create stream destinations.
confidence: 0.85
derived_from:
- <PrivateConnection.vpcPeeringConfig.vpc field>
false_positive_note: "VPC peering does not provide transitive routing \u2014 if a resource sits behind\
\ a secondary hop, direct reach is not guaranteed. Verify routing tables and firewall rules in the\
\ peered VPC. The peering direction gives Datastream access to the customer VPC, not vice versa. Streams\
\ must explicitly reference this PrivateConnection in their sourceConfig or destinationConfig connectivity\
\ profiles."
narrative: Datastream PrivateConnection {privateConnection.name} peers the Datastream service network
into VPC {vpc.name}; this enables network reachability to databases at private IP addresses within
{vpc.name}, including resources reachable via Cloud VPN or Dedicated Interconnect from that VPC. Streams
using this private connection can reach these resources as data sources or destinations.