gcp-vpc-psc-private-reach

id: gcp-vpc-psc-private-reach
emits: PrivateReachability
description: A Private Service Connect consumer endpoint (forwarding rule targeting a serviceAttachment)
  provides a private internal-IP path from the consumer VPC to the producer service, without internet
  traversal.
applies_to:
- gcp
match_record:
  resource_type: compute.googleapis.com/ForwardingRule
  field: target
where:
- forwardingRule.target matches the pattern 'projects/.*/regions/.*/serviceAttachments/.*'
- forwardingRule.loadBalancingScheme is empty (PSC consumer endpoints have no scheme)
- forwardingRule.IPAddress is set (the consumer's internal VIP)
emit:
  source_type: Compute
  target_type: PrivateEndpoint
  source: <Compute workloads co-located in the consumer VPC (VirtualNetwork containing the PSC ForwardingRule)>
  target: <PrivateEndpoint node (consumer PSC ForwardingRule)>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability) \u2014 any Compute workload in the consumer VPC with\
    \ a route to the PSC endpoint's internal IP can reach the producer service. Firewall rules in the\
    \ consumer VPC may restrict which VMs can initiate the connection."
  confidence: '0.90'
  derived_from:
  - <ForwardingRule.target = serviceAttachment self-link>
  false_positive_note: "(1) PSC is unidirectional: the consumer can reach the producer; the producer network\
    \ does NOT gain access to the consumer VPC. Do not emit a reverse PrivateReachability edge. (2) The\
    \ serviceAttachment may have an accept/reject list (consumerAcceptLists). If the consumer project\
    \ is not in the accept list, the PSC connection is PENDING or REJECTED \u2014 downgrade to POTENTIAL(service_state).\
    \ (3) DNS auto-configuration for the PSC endpoint is separate. Workloads may need a private DNS record\
    \ pointing to the endpoint IP; without it the path exists but resolution requires manual DNS setup.\
    \ (4) The source of this edge is the set of Compute workloads in the consumer VPC \u2014 emit a PrivateReachability\
    \ edge per co-located workload (or express as the VPC as the implied foothold scope) when instantiated."
  narrative: Private Service Connect consumer endpoint {endpoint.name} (internal IP {ip}) in VPC {consumer_vpc.name}
    provides a private path to producer service {producer.name}. Any Compute workload in {consumer_vpc.name}
    that can route to {ip} can access the producer service without traversing the public internet.