Scenario 1: Multiple matching IP/CIDR destinations in different resources
Resource A -> 10.10.10.10.
Resource B -> 10.10.10.10 (same port and protocol as Resource A)
Resource C -> 10.10.10.0/24
Resource D -> 10.0.0.0/8
Access policy rules:
- UserGroupA has access to Resource A
- UserGroupB has access to Resource B
- UserGroupC has access to Resource C
- UserGroupD has access to Resource D
Behavior:
- When a request comes in for “10.10.10.10” as the destination, all resources (A to D) are identified and taken forward for policy evaluation.
- At policy evaluation, a request for “10.10.10.10” can match to any of rules #1 to #4 from a destination point of view (logical equivalent is that - rule destination should be contained within the set of all possible resource matches that were identified).
- But, since each rule has an explicitly different source, the rule would only be matched to if the source also aligns (i.e. user from UserGroupA would only ever match to rule #1, and so on).