rage.fail

gcp-ncc-cross-project-spoke-trust

explicit gcp emits CrossProjectTrust

match (record)

{ "api": "networkconnectivity.projects.locations.spokes.list", "field": "hub", "resource_type": "networkconnectivity.googleapis.com/Spoke" }

where

project(spoke.name) != project(spoke.hub)

emit

source type	`Project`
target type	`Project`
source	`<spoke Project (project segment of spoke.name)>`
target	`<hub Project (project segment of spoke.hub)>`

Narrative

Spoke {spoke.name} in project {spoke_project.name} is attached to NCC Hub {hub.name} in project {hub_project.name}. These two projects share the same NCC routing domain, creating a cross-project network trust relationship. Spoke state: {spoke.state}.

Raw rule rules/explicit/gcp-ncc.yaml

id: gcp-ncc-cross-project-spoke-trust
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  api: networkconnectivity.projects.locations.spokes.list
  resource_type: networkconnectivity.googleapis.com/Spoke
  field: hub
where:
- project(spoke.name) != project(spoke.hub)
emit:
  source_type: Project
  target_type: Project
  source: <spoke Project (project segment of spoke.name)>
  target: <hub Project (project segment of spoke.hub)>
  api_source: networkconnectivity.projects.locations.spokes.list
  evidence_field: spoke.name (spoke project) + spoke.hub (hub project)
  narrative: 'Spoke {spoke.name} in project {spoke_project.name} is attached to NCC Hub {hub.name} in
    project {hub_project.name}. These two projects share the same NCC routing domain, creating a cross-project
    network trust relationship. Spoke state: {spoke.state}.'