network-transit-hub-reach

A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct Connect gateway/VPN gateway) that forwards between attachments - transitive across the hub's associated route table.

derived any cloud emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'sg': None} CanReachPort {'dst': None} {'src': None} LocatedIn {'srcnet': None} {'dst': None} LocatedIn {'dstnet': None} {'srcnet': None} RoutesTo {'hub': None} {'hub': None} RoutesTo {'dstnet': None}

where

node_class(?src) in [Compute, Network] node_class(?dst) in [Compute, Data, Storage] node_type(?sg) in [SecurityGroup, Firewall] node_type(?hub) in [TransitGateway, VPN] ?srcnet != ?dstnet node_type(?dstnet) not in [TransitGateway, VPN]

emit

source type	`Compute` `Network`
target type	`Compute` `Data` `Storage`
source	`?src`
target	`?dst`
conditions	`network_reachability`
state logic	ACTIVE when both segments are attached to ?hub, the hub route table associates BOTH attachments (no segmentation isolating them), and the destination ingress admits the source. CONDITIONAL(network_reachability) if the hub route table / segmentation is uncollected, or a remote attachment's segment is out of scope. BLOCKED on a hub route-table that isolates the attachments or a NACL/firewall DENY. Inherit the weakest of both RoutesTo hops and the CanReachPort.

Narrative

{src.name}'s segment and {dst.name}'s segment are both attached to the transit hub {hub.name}, whose route table forwards between them, so {src.name} has a transitive network path to {dst.name} subject to the destination's ingress rules.

Raw rule rules/derived/network-chains.yaml

id: network-transit-hub-reach
emits: CanNetworkReach
description: "A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct\
  \ Connect gateway/VPN gateway) that forwards between attachments \u2014 transitive across the hub's\
  \ associated route table."
applies_to:
- '*'
match:
- - sg: null
  - CanReachPort
  - dst: null
- - src: null
  - LocatedIn
  - srcnet: null
- - dst: null
  - LocatedIn
  - dstnet: null
- - srcnet: null
  - RoutesTo
  - hub: null
- - hub: null
  - RoutesTo
  - dstnet: null
where:
- node_class(?src) in [Compute, Network]
- node_class(?dst) in [Compute, Data, Storage]
- node_type(?sg) in [SecurityGroup, Firewall]
- node_type(?hub) in [TransitGateway, VPN]
- ?srcnet != ?dstnet
- node_type(?dstnet) not in [TransitGateway, VPN]
emit:
  source_type:
  - Compute
  - Network
  target_type:
  - Compute
  - Data
  - Storage
  source: ?src
  target: ?dst
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when both segments are attached to ?hub, the hub route table associates BOTH attachments
    (no segmentation isolating them), and the destination ingress admits the source. CONDITIONAL(network_reachability)
    if the hub route table / segmentation is uncollected, or a remote attachment's segment is out of scope.
    BLOCKED on a hub route-table that isolates the attachments or a NACL/firewall DENY. Inherit the weakest
    of both RoutesTo hops and the CanReachPort.
  confidence: min(contributing_confidences)
  derived_from:
  - ?sg CanReachPort ?dst
  - ?srcnet RoutesTo ?hub
  - ?hub RoutesTo ?dstnet
  false_positive_note: "Transit hubs are transitive ONLY within a shared route table / segment: a TGW\
    \ with isolated route tables, a VWAN hub routing intent, or an NCC spoke set to no-export does NOT\
    \ forward between every attachment \u2014 check the hub's association/propagation before emitting\
    \ ACTIVE. A Direct Connect / VPN attachment brings on-prem as a source (the on-prem endpoint must\
    \ still admit-and-exploit the destination; see MODELING LIMITATIONS: ON-PREM SOURCES). Do not confuse\
    \ this transitive hub path with rule 3's single non-transitive peering. Hub node types are TransitGateway\
    \ and VPN per nodes.yaml \u2014 no generic 'Gateway' type exists in the taxonomy."
  narrative: '{src.name}''s segment and {dst.name}''s segment are both attached to the transit hub {hub.name},
    whose route table forwards between them, so {src.name} has a transitive network path to {dst.name}
    subject to the destination''s ingress rules.'