rage.fail

gcp-ncc-active-interconnect-spoke-routes-to-onprem

explicit gcp emits RoutesTo

match (record)

{ "api": "networkconnectivity.projects.locations.spokes.list", "field": "state", "resource_type": "networkconnectivity.googleapis.com/Spoke", "value": "ACTIVE" }

where

spoke.linkedInterconnectAttachments[].uri is set (Interconnect spoke)

emit

source type	`TransitGateway`
target type	`Subnet`
source	`<NCC Hub (TransitGateway) referenced by spoke.hub>`
target	`<CIDR ranges announced via BGP by the Interconnect attachment (external on-premises networks)>`

Narrative

NCC Hub {hub.name} routes to on-premises CIDR prefixes via ACTIVE Interconnect spoke {spoke.name}. All other ACTIVE spokes on {hub.name} can route to these BGP-announced prefixes, subject to on-premises firewall rules at the far end of the Interconnect attachment.

Raw rule rules/explicit/gcp-ncc.yaml

id: gcp-ncc-active-interconnect-spoke-routes-to-onprem
emits: RoutesTo
applies_to:
- gcp
match_record:
  api: networkconnectivity.projects.locations.spokes.list
  resource_type: networkconnectivity.googleapis.com/Spoke
  field: state
  value: ACTIVE
where:
- spoke.linkedInterconnectAttachments[].uri is set (Interconnect spoke)
emit:
  source_type: TransitGateway
  target_type: Subnet
  source: <NCC Hub (TransitGateway) referenced by spoke.hub>
  target: <CIDR ranges announced via BGP by the Interconnect attachment (external on-premises networks)>
  api_source: networkconnectivity.projects.locations.spokes.list + compute.interconnectAttachments.get
  evidence_field: spoke.linkedInterconnectAttachments[].uri + spoke.state=ACTIVE
  narrative: NCC Hub {hub.name} routes to on-premises CIDR prefixes via ACTIVE Interconnect spoke {spoke.name}.
    All other ACTIVE spokes on {hub.name} can route to these BGP-announced prefixes, subject to on-premises
    firewall rules at the far end of the Interconnect attachment.