rage.fail

gcp-ncc-active-vpc-spoke-routes-to-subnet

explicit gcp emits RoutesTo

match (record)

{ "api": "networkconnectivity.projects.locations.spokes.list", "field": "state", "resource_type": "networkconnectivity.googleapis.com/Spoke", "value": "ACTIVE" }

where

spoke.linkedVpcNetwork.uri is set (VPC spoke)

emit

source type	`TransitGateway`
target type	`Subnet`
source	`<NCC Hub (TransitGateway) referenced by spoke.hub>`
target	`<Subnets in the VPC identified by spoke.linkedVpcNetwork.uri (resolved via compute.subnetworks.list)>`

Narrative

NCC Hub {hub.name} routes to subnets in VPC {vpc.name} via ACTIVE spoke {spoke.name}. All other ACTIVE spokes on {hub.name} can route to these subnets, subject to VPC ingress/egress firewall rules in {vpc.name}.

Raw rule rules/explicit/gcp-ncc.yaml

id: gcp-ncc-active-vpc-spoke-routes-to-subnet
emits: RoutesTo
applies_to:
- gcp
match_record:
  api: networkconnectivity.projects.locations.spokes.list
  resource_type: networkconnectivity.googleapis.com/Spoke
  field: state
  value: ACTIVE
where:
- spoke.linkedVpcNetwork.uri is set (VPC spoke)
emit:
  source_type: TransitGateway
  target_type: Subnet
  source: <NCC Hub (TransitGateway) referenced by spoke.hub>
  target: <Subnets in the VPC identified by spoke.linkedVpcNetwork.uri (resolved via compute.subnetworks.list)>
  api_source: networkconnectivity.projects.locations.spokes.list + compute.subnetworks.list
  evidence_field: spoke.linkedVpcNetwork.uri + spoke.state=ACTIVE
  narrative: NCC Hub {hub.name} routes to subnets in VPC {vpc.name} via ACTIVE spoke {spoke.name}. All
    other ACTIVE spokes on {hub.name} can route to these subnets, subject to VPC ingress/egress firewall
    rules in {vpc.name}.