network-routed-reach

A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.

derived any cloud emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'sg': None} CanReachPort {'dst': None} {'src': None} LocatedIn {'srcnet': None} {'dst': None} LocatedIn {'dstnet': None} {'rt': None} RoutesTo {'dstnet': None} {'rt': None} AttachedTo {'srcnet': None}

where

node_class(?src) in [Compute, Network] node_class(?dst) in [Compute, Data, Storage] node_type(?sg) in [SecurityGroup, Firewall] ?srcnet != ?dstnet node_type(?dstnet) not in [TransitGateway, VPN] node_type(?srcnet) in [Subnet, Route] node_type(?rt) in [Route, Subnet]

emit

source type	`Compute` `Network`
target type	`Compute` `Data` `Storage`
source	`?src`
target	`?dst`
conditions	`network_reachability`
state logic	ACTIVE when the route from ?srcnet to ?dstnet is confirmed AND the destination ingress admits the source segment. CONDITIONAL(network_reachability) if the route table or ingress is unconfirmed, or if the SG-to-source-segment join is not fully evaluated (see MODELING LIMITATIONS). BLOCKED on a NACL/stateless-firewall DENY covering the path. Inherit the weakest of the contributing CanReachPort and RoutesTo.

Narrative

{src.name}'s subnet {srcnet.name} routes to {dstnet.name} where {dst.name} lives, and the destination admits {src.name} on the port - a routed network path exists.

Raw rule rules/derived/network-chains.yaml

id: network-routed-reach
emits: CanNetworkReach
description: A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches
  the destination when its ingress rule admits the source.
applies_to:
- '*'
match:
- - sg: null
  - CanReachPort
  - dst: null
- - src: null
  - LocatedIn
  - srcnet: null
- - dst: null
  - LocatedIn
  - dstnet: null
- - rt: null
  - RoutesTo
  - dstnet: null
- - rt: null
  - AttachedTo
  - srcnet: null
where:
- node_class(?src) in [Compute, Network]
- node_class(?dst) in [Compute, Data, Storage]
- node_type(?sg) in [SecurityGroup, Firewall]
- ?srcnet != ?dstnet
- node_type(?dstnet) not in [TransitGateway, VPN]
- node_type(?srcnet) in [Subnet, Route]
- node_type(?rt) in [Route, Subnet]
emit:
  source_type:
  - Compute
  - Network
  target_type:
  - Compute
  - Data
  - Storage
  source: ?src
  target: ?dst
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when the route from ?srcnet to ?dstnet is confirmed AND the destination ingress
    admits the source segment. CONDITIONAL(network_reachability) if the route table or ingress is unconfirmed,
    or if the SG-to-source-segment join is not fully evaluated (see MODELING LIMITATIONS). BLOCKED on
    a NACL/stateless-firewall DENY covering the path. Inherit the weakest of the contributing CanReachPort
    and RoutesTo.
  confidence: min(contributing_confidences)
  derived_from:
  - ?sg CanReachPort ?dst
  - ?rt RoutesTo ?dstnet
  - ?rt AttachedTo ?srcnet
  false_positive_note: "Both halves are required: a route without an admitting ingress rule is NOT reach,\
    \ and an ingress rule without a route is NOT reach. Confirm the route actually targets the destination's\
    \ CIDR (a default route to a NAT/IGW is egress, not a path to a private peer). Route propagation must\
    \ be enabled for the route to be live. NACL/firewall DENY on the path => BLOCKED. Hub-mediated paths\
    \ (where ?dstnet is a TransitGateway or VPN) must use rule 4 \u2014 excluding them here prevents duplicate\
    \ edges with mis-attributed state."
  narrative: "{src.name}'s subnet {srcnet.name} routes to {dstnet.name} where {dst.name} lives, and the\
    \ destination admits {src.name} on the port \u2014 a routed network path exists."