In cloud environments, the complexity of network architecture, especially with the prevalent use of NAT (Network Address Translation), often obscures visibility, making the detection of duplicate subnets a challenging task. This lack of transparency can lead to network inefficiencies, conflicts, and potential security risks. The NQE query I'm sharing specifically addresses this challenge, offering a streamlined approach to uncover hidden duplicate subnets, a crucial step in maintaining a robust and efficient cloud network.

To tackle the issue of detecting overlapping IPv4 CIDR blocks across different VPCs in cloud environments, I've developed a precise NQE (Network Query Engine) query. This query methodically scans through all cloud accounts and their respective VPCs, identifying any instances where IPv4 CIDR blocks overlap. The query is designed to compare each VPC within a cloud account against others, ensuring comprehensive coverage and accurate detection of duplications. Below is the NQE query that serves as a powerful tool for cloud administrators and engineers in maintaining optimal network configurations.

/**
 * @intent Finds pairs of VPCs that have overlapping IPv4 CIDR blocks
 */

foreach cloudAccount1 in network.cloudAccounts
foreach cloudAccount2 in network.cloudAccounts
where cloudAccount1.name < cloudAccount2.name
foreach vpc1 in cloudAccount1.vpcs
foreach vpc2 in cloudAccount2.vpcs
let vpc1Blocks = ipAddressSet(vpc1.ipv4CidrBlocks)
let vpc2Blocks = ipAddressSet(vpc2.ipv4CidrBlocks)
let intersection = intersect(vpc1Blocks, vpc2Blocks)
select {
  violation: !isEmpty(intersection),
  "Cloud Account 1": cloudAccount1.name,
  "VPC 1": vpc1.id,
  "IPv4 Blocks 1": vpc1.ipv4CidrBlocks,
  "Cloud Account 2": cloudAccount2.name,
  "VPC 2": vpc2.id,
  "IPv4 Blocks 2": vpc2.ipv4CidrBlocks,
  "IPv4 Blocks Overlap": intersection
}

While the provided NQE query is designed to scan across all cloud providers for overlapping IPv4 CIDR blocks, it can be easily customized to focus on a specific cloud provider. For instance, if you want to limit the query to only check within AWS environments, you can add a conditional statement to filter the VPCs by their cloud type. By including where vpc1.cloudType == CloudType.AWS and where vpc2.cloudType == CloudType.AWS in the query, it will exclusively evaluate VPCs in AWS, allowing for a more targeted analysis. This modification enhances the query's flexibility, making it adaptable to various cloud management scenarios.  This can be of course changed to match Azure and GCP as well.

Modified Query Example for AWS:

/**
 * @intent Finds pairs of VPCs that have overlapping IPv4 CIDR blocks
 */

foreach cloudAccount1 in network.cloudAccounts
foreach cloudAccount2 in network.cloudAccounts
where cloudAccount1.name < cloudAccount2.name
foreach vpc1 in cloudAccount1.vpcs
where vpc1.cloudType == CloudType.AWS
foreach vpc2 in cloudAccount2.vpcs
where vpc2.cloudType == CloudType.AWS
let vpc1Blocks = ipAddressSet(vpc1.ipv4CidrBlocks)
let vpc2Blocks = ipAddressSet(vpc2.ipv4CidrBlocks)
let intersection = intersect(vpc1Blocks, vpc2Blocks)
select {
  violation: !isEmpty(intersection),
  "Cloud Account 1": cloudAccount1.name,
  "VPC 1": vpc1.id,
  "IPv4 Blocks 1": vpc1.ipv4CidrBlocks,
  "Cloud Account 2": cloudAccount2.name,
  "VPC 2": vpc2.id,
  "IPv4 Blocks 2": vpc2.ipv4CidrBlocks,
  "IPv4 Blocks Overlap": intersection
}

This NQE query stands as a vital tool for cloud professionals seeking to maintain efficient and conflict-free network architectures in multi-cloud environments. By offering both a broad-scope analysis across various cloud providers and the flexibility to narrow down to a specific provider like AWS, it ensures that your cloud infrastructure remains robust and free from overlapping subnet issues. Implement this query in your cloud management practices to enhance network clarity and operational excellence.