gcp-psc-forwarding-rule-target-ref
explicit
gcp
emits
match (record)
{
"field": "target",
"resource_type": "compute.googleapis.com/ForwardingRule"
}
where
forwardingRule.purpose == PRIVATE_SERVICE_CONNECT
emit
Raw rule rules/explicit/gcp-psc.yaml
id: gcp-psc-forwarding-rule-target-ref
emits: null
kind: evidence
applies_to:
- gcp
match_record:
resource_type: compute.googleapis.com/ForwardingRule
field: target
where:
- forwardingRule.purpose == PRIVATE_SERVICE_CONNECT
record:
on_node: <PSC ForwardingRule node>
field: psc_target
value: '<forwardingRule.target URI: serviceAttachments/... OR all-apis/vpc-sc>'
api_source: compute.forwardingRules.get
evidence_field: target
note: 'Evidence for the derived rules gcp-psc-private-reach-google-apis and gcp-psc-private-reach-producer:
the target field determines whether this forwarding rule points to a Google API bundle or a producer
Service Attachment. No RoutesTo edge is emitted because PrivateEndpoint is not a valid RoutesTo source
per schema/edges.yaml (source: [Route, Subnet, TransitGateway]).'