rage.fail

gcp-firewall-policy-located-in-folder

explicit gcp emits LocatedIn

match (record)

{ "field": "parent", "resource_type": "compute.googleapis.com/FirewallPolicy" }

emit

source type	`Firewall`
target type	`Folder`
source	`<Firewall policy node (Firewall class)>`
target	`<Folder or Organization node (AdministrativeBoundary) referenced by policy.parent>`

Narrative

Firewall policy {policy.name} is owned by (located in) {parent.name} (folder/organization).

Raw rule rules/explicit/gcp-firewall.yaml

id: gcp-firewall-policy-located-in-folder
emits: LocatedIn
applies_to:
- gcp
match_record:
  resource_type: compute.googleapis.com/FirewallPolicy
  field: parent
emit:
  source_type: Firewall
  target_type: Folder
  source: <Firewall policy node (Firewall class)>
  target: <Folder or Organization node (AdministrativeBoundary) referenced by policy.parent>
  api_source: compute.firewallPolicies.list / compute.firewallPolicies.get
  evidence_field: parent
  narrative: Firewall policy {policy.name} is owned by (located in) {parent.name} (folder/organization).