gcp-lb-internal-reachable

id: gcp-lb-internal-reachable
emits: PrivateReachability
description: An internal Application Load Balancer or internal passthrough NLB (loadBalancingScheme INTERNAL
  or INTERNAL_MANAGED) is reachable only from within the VPC, peered VPCs, or connected on-premises networks.
  A compute resource with a foothold in the same VPC can reach the internal LB frontend and, through it,
  the backends.
where:
- forwardingRule.loadBalancingScheme in [INTERNAL, INTERNAL_MANAGED]
- forwardingRule.IPAddress is a private RFC-1918 address
- source compute resource is in the same VPC (or a peered VPC / VPN-connected network)
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <Compute resource in the same VPC>
  target: <internal ForwardingRule (frontend IP)>
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'CONDITIONAL(network_reachability): confirmed only when the source compute resource is
    in the same VPC subnet or a peered/VPN-connected network AND no GFW/VPC firewall rule blocks the connection
    to the internal LB''s frontend IP. Do NOT emit for EXTERNAL / EXTERNAL_MANAGED forwarding rules.'
  false_positive_note: 'Internal LBs have their own GFW firewall requirements (health-check probes must
    be allowed from 130.211.0.0/22 and 35.191.0.0/16). Firewall rules on the backend VMs/subnet may still
    block connections even if the LB frontend is reachable. Shared VPC: an internal LB in the host project''s
    VPC is reachable from service project VMs that use that subnet (if permitted). Emit PrivateReachability
    for the most specific source node confirmed in-network.'
  narrative: Internal LB {target.name} is reachable from compute resource {source.name} over the VPC network
    on its private frontend IP. A foothold in {source.name} provides access to the internal LB's backends
    (via private routing), which may include sensitive internal services not intended for external reach.