aws.transit-gateway-route-table

Transit gateway route tables.

https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html

Associations and propagations take an API call per route table, so only the associations and propagations filters fetch them. To include them for every route table, match any count.

example:

policies:
  - name: tgw-route-table-inventory
    resource: aws.transit-gateway-route-table
    filters:
      - type: associations
        count: 0
        count_op: gte
      - type: propagations
        count: 0
        count_op: gte

Filters

• associations

• config-compliance

• event

• finding

• json-diff

• list-item

• marked-for-op

• ops-item

• propagations

• reduce

• tag-count

• value

associations

Filter transit gateway route tables by their associated attachments.

Calls GetTransitGatewayRouteTableAssociations for each route table and stores the list under c7n:Associations. Each item has TransitGatewayAttachmentId, ResourceId, ResourceType and State. attrs matches items, count and count_op compare how many match, and matched items are stored under c7n:MatchedAssociations.

example:

Find route tables that no attachment is associated with:

policies:
  - name: tgw-route-table-unassociated
    resource: aws.transit-gateway-route-table
    filters:
      - type: associations
        count: 0

properties:
  attrs:
    items:
      anyOf:
      - $ref: '#/definitions/filters/value'
      - $ref: '#/definitions/filters/valuekv'
      - additional_properties: false
        properties:
          and:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
      - additional_properties: false
        properties:
          or:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
      - additional_properties: false
        properties:
          not:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
    type: array
  count:
    type: number
  count_op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  type:
    enum:
    - associations
required:
- type

Permissions - ec2:GetTransitGatewayRouteTableAssociations

json-diff

Compute the diff from the current resource to a previous version.

A resource matches the filter if a diff exists between the current resource and the selected revision.

Utilizes config as a resource revision database.

Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).

properties:
  selector:
    enum:
    - previous
    - date
    - locked
  selector_value:
    type: string
  type:
    enum:
    - json-diff
required:
- type

Permissions - config:GetResourceConfigHistory

propagations

Filter transit gateway route tables by the attachments propagating routes to them.

Calls GetTransitGatewayRouteTablePropagations for each route table and stores the list under c7n:Propagations. Each item has TransitGatewayAttachmentId, ResourceId, ResourceType and State. attrs matches items, count and count_op compare how many match, and matched items are stored under c7n:MatchedPropagations.

example:

Find route tables that learn routes from a VPN attachment:

policies:
  - name: tgw-route-table-vpn-propagation
    resource: aws.transit-gateway-route-table
    filters:
      - type: propagations
        attrs:
          - ResourceType: vpn

properties:
  attrs:
    items:
      anyOf:
      - $ref: '#/definitions/filters/value'
      - $ref: '#/definitions/filters/valuekv'
      - additional_properties: false
        properties:
          and:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
      - additional_properties: false
        properties:
          or:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
      - additional_properties: false
        properties:
          not:
            items:
              anyOf:
              - $ref: '#/definitions/filters/value'
              - $ref: '#/definitions/filters/valuekv'
            type: array
        type: object
    type: array
  count:
    type: number
  count_op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  type:
    enum:
    - propagations
required:
- type

Permissions - ec2:GetTransitGatewayRouteTablePropagations

Actions

• auto-tag-user

• copy-related-tag

• invoke-lambda

• invoke-sfn

• mark-for-op

• normalize-tag

• notify

• post-finding

• post-item

• put-metric

• remove-tag

• rename-tag

• tag

• tag-trim

• webhook