unlabeled_resources.pt

name "Google Unlabeled Resources"
rs_pt_ver 20180301
type "policy"
short_description "Find all labelable Google resources missing any of the user-provided labels with the option to update the labels. See the [README](https://github.com/flexera-public/policy_templates/tree/master/compliance/google/unlabeled_resources) and [docs.flexera.com/flexera/EN/Automation](https://docs.flexera.com/flexera/EN/Automation/AutomationGS.htm) to learn more."
long_description ""
category "Compliance"
severity "low"
default_frequency "weekly"
info(
  version: "3.1.1",
  provider: "Google",
  service: "Compute",
  policy_set: "Untagged Resources",
  hide_skip_approvals: "true"
)

###############################################################################
# Parameters
###############################################################################

parameter "param_email" do
  type "list"
  category "Policy Settings"
  label "Email Addresses"
  description "A list of email addresses to notify."
  default []
end

parameter "param_labels" do
  type "list"
  category "Filters"
  label "Labels"
  description "The policy will report resources missing the specified labels. Enter the key name to look for resources missing a key, and enter Key==Value to find resources missing a specific Key:Value pair. Other operators and regex are supported; please see the README for more details."
  default []
end

parameter "param_labels_boolean" do
  type "string"
  category "Filters"
  label "Any / All"
  description "Whether to report on instances missing any of the specified labels or all of them. Only applicable if more than one value is entered in the \"Labels\" field."
  allowed_values "Any", "All"
  default "Any"
end

parameter "param_projects_allow_or_deny" do
  type "string"
  category "Filters"
  label "Allow/Deny Projects"
  description "Allow or Deny entered Projects. See the README for more details."
  allowed_values "Allow", "Deny"
  default "Allow"
end

parameter "param_projects_list" do
  type "list"
  category "Filters"
  label "Allow/Deny Projects List"
  description "A list of allowed or denied Project IDs/names. See the README for more details."
  default []
end

parameter "param_resource_types" do
  type "list"
  category "Filters"
  label "Resource Types"
  description "The types of resources to check labels for. Any options not selected will not be reported on."
  allowed_values ["Projects", "Persistent Disks", "VPN Gateways (Internal)", "VPN Gateways (External)", "Images", "Virtual Machines", "Snapshots", "Storage Buckets"]
  default ["Persistent Disks", "VPN Gateways (Internal)", "VPN Gateways (External)", "Images", "Virtual Machines", "Snapshots", "Storage Buckets"]
end

###############################################################################
# Authentication
###############################################################################

credentials "auth_google" do
  schemes "oauth2"
  label "Google"
  description "Select the Google Cloud Credential from the list."
  tags "provider=gce"
end

credentials "auth_flexera" do
  schemes "oauth2"
  label "Flexera"
  description "Select Flexera One OAuth2 credentials"
  tags "provider=flexera"
end

###############################################################################
# Pagination
###############################################################################

pagination "pagination_google" do
  get_page_marker do
    body_path "nextPageToken"
  end
  set_page_marker do
    query "pageToken"
  end
end

###############################################################################
# Datasources & Scripts
###############################################################################

# Table to derive region from zone
datasource "ds_zone_to_region" do
  run_script $js_zone_to_region
end

script "js_zone_to_region", type:"javascript" do
  result "result"
  code <<-EOS
  result = {
    "us-east1-b": "us-east1",
    "us-east1-c": "us-east1",
    "us-east1-d": "us-east1",
    "us-east4-c": "us-east4",
    "us-east4-b": "us-east4",
    "us-east4-a": "us-east4",
    "us-central1-c": "us-central1",
    "us-central1-a": "us-central1",
    "us-central1-f": "us-central1",
    "us-central1-b": "us-central1",
    "us-west1-b": "us-west1",
    "us-west1-c": "us-west1",
    "us-west1-a": "us-west1",
    "europe-west4-a": "europe-west4",
    "europe-west4-b": "europe-west4",
    "europe-west4-c": "europe-west4",
    "europe-west1-b": "europe-west1",
    "europe-west1-d": "europe-west1",
    "europe-west1-c": "europe-west1",
    "europe-west3-c": "europe-west3",
    "europe-west3-a": "europe-west3",
    "europe-west3-b": "europe-west3",
    "europe-west2-c": "europe-west2",
    "europe-west2-b": "europe-west2",
    "europe-west2-a": "europe-west2",
    "asia-east1-b": "asia-east1",
    "asia-east1-a": "asia-east1",
    "asia-east1-c": "asia-east1",
    "asia-southeast1-b": "asia-southeast1",
    "asia-southeast1-a": "asia-southeast1",
    "asia-southeast1-c": "asia-southeast1",
    "asia-northeast1-b": "asia-northeast1",
    "asia-northeast1-c": "asia-northeast1",
    "asia-northeast1-a": "asia-northeast1",
    "asia-south1-c": "asia-south1",
    "asia-south1-b": "asia-south1",
    "asia-south1-a": "asia-south1",
    "australia-southeast1-b": "australia-southeast1",
    "australia-southeast1-c": "australia-southeast1",
    "australia-southeast1-a": "australia-southeast1",
    "southamerica-east1-b": "southamerica-east1",
    "southamerica-east1-c": "southamerica-east1",
    "southamerica-east1-a": "southamerica-east1",
    "asia-east2-a": "asia-east2",
    "asia-east2-b": "asia-east2",
    "asia-east2-c": "asia-east2",
    "asia-northeast2-a": "asia-northeast2",
    "asia-northeast2-b": "asia-northeast2",
    "asia-northeast2-c": "asia-northeast2",
    "asia-northeast3-a": "asia-northeast3",
    "asia-northeast3-b": "asia-northeast3",
    "asia-northeast3-c": "asia-northeast3",
    "asia-south2-a": "asia-south2",
    "asia-south2-b": "asia-south2",
    "asia-south2-c": "asia-south2",
    "asia-southeast2-a": "asia-southeast2",
    "asia-southeast2-b": "asia-southeast2",
    "asia-southeast2-c": "asia-southeast2",
    "australia-southeast2-a": "australia-southeast2",
    "australia-southeast2-b": "australia-southeast2",
    "australia-southeast2-c": "australia-southeast2",
    "europe-central2-a": "europe-central2",
    "europe-central2-b": "europe-central2",
    "europe-central2-c": "europe-central2",
    "europe-north1-a": "europe-north1",
    "europe-north1-b": "europe-north1",
    "europe-north1-c": "europe-north1",
    "europe-southwest1-a": "europe-southwest1",
    "europe-southwest1-b": "europe-southwest1",
    "europe-southwest1-c": "europe-southwest1",
    "europe-west6-a": "europe-west6",
    "europe-west6-b": "europe-west6",
    "europe-west6-c": "europe-west6",
    "northamerica-northeast1-a": "northamerica-northeast1",
    "northamerica-northeast1-b": "northamerica-northeast1",
    "northamerica-northeast1-c": "northamerica-northeast1",
    "northamerica-northeast2-a": "northamerica-northeast2",
    "northamerica-northeast2-b": "northamerica-northeast2",
    "northamerica-northeast2-c": "northamerica-northeast2",
    "us-west2-a": "us-west2",
    "us-west2-b": "us-west2",
    "us-west2-c": "us-west2",
    "us-west3-a": "us-west3",
    "us-west3-b": "us-west3",
    "us-west3-c": "us-west3",
    "us-west4-a": "us-west4",
    "us-west4-b": "us-west4",
    "us-west4-c": "us-west4",
    "us-west5-a": "us-west5",
    "us-west5-b": "us-west5",
    "us-west5-c": "us-west5",
    "us-west6-a": "us-west6",
    "us-west6-b": "us-west6",
    "us-west6-c": "us-west6",
    "us-west7-a": "us-west7",
    "us-west7-b": "us-west7",
    "us-west7-c": "us-west7"
  }
EOS
end

# Get applied policy metadata for use later
datasource "ds_applied_policy" do
  request do
    auth $auth_flexera
    host rs_governance_host
    path join(["/api/governance/projects/", rs_project_id, "/applied_policies/", policy_id])
    header "Api-Version", "1.0"
  end
end

datasource "ds_google_projects" do
  request do
    auth $auth_google
    pagination $pagination_google
    host "cloudresourcemanager.googleapis.com"
    path "/v1/projects/"
    query "filter", "(lifecycleState:ACTIVE)"
    # Header X-Meta-Flexera has no affect on datasource query, but is required for Meta Policies
    # Forces `ds_is_deleted` datasource to run first during policy execution
    header "Meta-Flexera", val($ds_is_deleted, "path")
  end
  result do
    encoding "json"
    collect jmes_path(response, "projects[*]") do
      field "number", jmes_path(col_item, "projectNumber")
      field "id", jmes_path(col_item, "projectId")
      field "name", jmes_path(col_item, "name")
      field "labels", jmes_path(col_item, "labels")
    end
  end
end

datasource "ds_google_projects_filtered" do
  run_script $js_google_projects_filtered, $ds_google_projects, $param_projects_allow_or_deny, $param_projects_list
end

script "js_google_projects_filtered", type: "javascript" do
  parameters "ds_google_projects", "param_projects_allow_or_deny", "param_projects_list"
  result "result"
  code <<-EOS
  if (param_projects_list.length > 0) {
    result = _.filter(ds_google_projects, function(project) {
      include_project = _.contains(param_projects_list, project['id']) || _.contains(param_projects_list, project['name']) || _.contains(param_projects_list, project['number'])

      if (param_projects_allow_or_deny == "Deny") {
        include_project = !include_project
      }

      return include_project
    })
  } else {
    result = ds_google_projects
  }
EOS
end

datasource "ds_disks_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/aggregated/disks"
end

datasource "ds_vpn_gateway_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/aggregated/vpnGateways"
end

datasource "ds_external_vpn_gateway_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/global/externalVpnGateways"
end

datasource "ds_images_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/global/images"
end

datasource "ds_instances_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/aggregated/instances"
end

datasource "ds_snapshots_uris" do
  run_script $js_generate_uris, $ds_google_projects_filtered, $param_resource_types, "/global/snapshots"
end

script "js_generate_uris", type: "javascript" do
  parameters "ds_google_projects_filtered", "param_resource_types", "endpoint"
  result "result"
  code <<-EOS
  param_mapping = {
    "/aggregated/disks": "Persistent Disks"
    "/aggregated/vpnGateways": "VPN Gateways (Internal)"
    "/global/externalVpnGateways": "VPN Gateways (External)"
    "/global/images": "Images"
    "/aggregated/instances": "Virtual Machines"
    "/global/snapshots": "Snapshots"
  }

  result = []

  if (_.contains(param_resource_types, param_mapping[endpoint])) {
    result = _.map(ds_google_projects_filtered, function(project) {
      return {
        projectId: project['id'],
        projectName: project['name'],
        projectNumber: project['number'],
        requestType: param_mapping[endpoint],
        uri: '/compute/v1/projects/' + project['id'] + endpoint
      }
    })
  }
EOS
end

datasource "ds_bucket_uris" do
  run_script $js_bucket_uris, $ds_google_projects_filtered, $param_resource_types
end

script "js_bucket_uris", type: "javascript" do
  parameters "ds_google_projects_filtered", "param_resource_types"
  result "result"
  code <<-EOS
  result = []

  if (_.contains(param_resource_types, "Storage Buckets")) {
    result = _.map(ds_google_projects_filtered, function(project) {
      return {
        projectId: project['id'],
        projectName: project['name'],
        projectNumber: project['number'],
        requestType: "Storage Buckets"
      }
    })
  }
EOS
end

datasource "ds_get_disks" do
  iterate $ds_disks_uris
  request do
    auth $auth_google
    pagination $pagination_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    field "disks", jq(response, "[ .items | to_entries | map_values(.value) | map(select(has(\"disks\"))) | .[].disks | .[] | { id,name,kind,type,description,labels,status,sizeGb,selfLink,zone,creationTimestamp,labelFingerprint }]")
    field "projectId", val(iter_item, "projectId")
    field "projectName", val(iter_item, "projectName")
    field "projectNumber", val(iter_item, "projectNumber")
    field "requestType", val(iter_item, "requestType")
  end
end

datasource "ds_disks" do
  run_script $js_disks, $ds_get_disks, $ds_zone_to_region
end

script "js_disks", type: "javascript" do
  parameters "ds_get_disks", "ds_zone_to_region"
  result "result"
  code <<-EOS
  result = []

  _.each(ds_get_disks, function(response) {
    _.each(response['disks'], function(resource) {
      zone = null
      region = null

      if (typeof(resource['zone']) == 'string') {
        zone = resource['zone'].split('/')[8]
        region = ds_zone_to_region[zone]
      }

      type = null

      if (typeof(resource['type']) == 'string') {
        type = resource['type'].split('/')[10]
      }

      if (zone != null) {
        result.push({
          id: resource['id'],
          name: resource['name'],
          kind: resource['kind'],
          description: resource['description'],
          labels: resource['labels'],
          labelFingerprint: resource['labelFingerprint'],
          status: resource['status'],
          sizeGb: resource['sizeGb'],
          selfLink: resource['selfLink'],
          creationTime: resource['creationTimestamp'],
          projectId: response['projectId'],
          projectName: response['projectName'],
          projectNumber: response['projectNumber'],
          requestType: response['requestType'],
          zone: zone,
          region: region,
          type: type
        })
      }
    })
  })
EOS
end

datasource "ds_get_vpn_gateways" do
  iterate $ds_vpn_gateway_uris
  request do
    auth $auth_google
    pagination $pagination_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    field "vpnGateways", jq(response, "[ .items | to_entries | map_values(.value) | map(select(has(\"vpnGateways\"))) | .[].vpnGateways | .[] | { id,name,kind,description,labels,selfLink,region,gatewayIpVersion,labelFingerprint }]")
    field "projectId", val(iter_item, "projectId")
    field "projectName", val(iter_item, "projectName")
    field "projectNumber", val(iter_item, "projectNumber")
    field "requestType", val(iter_item, "requestType")
  end
end

datasource "ds_vpn_gateways" do
  run_script $js_vpn_gateways, $ds_get_vpn_gateways
end

script "js_vpn_gateways", type: "javascript" do
  parameters "ds_get_vpn_gateways"
  result "result"
  code <<-EOS
  result = []

  _.each(ds_get_vpn_gateways, function(response) {
    _.each(response['vpnGateways'], function(resource) {
      result.push({
        id: resource['id'],
        name: resource['name'],
        kind: resource['kind'],
        description: resource['description'],
        labels: resource['labels'],
        labelFingerprint: resource['labelFingerprint'],
        selfLink: resource['selfLink'],
        region: resource['region'],
        gatewayIpVersion: resource['gatewayIpVersion'],
        projectId: response['projectId'],
        projectName: response['projectName'],
        projectNumber: response['projectNumber'],
        requestType: response['requestType']
      })
    })
  })
EOS
end

datasource "ds_external_vpn_gateways" do
  iterate $ds_external_vpn_gateway_uris
  request do
    auth $auth_google
    pagination $pagination_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "items[*]") do
      field "id", jmes_path(col_item, "id")
      field "name", jmes_path(col_item, "name")
      field "kind", jmes_path(col_item, "kind")
      field "description", jmes_path(col_item, "description")
      field "labels", jmes_path(col_item, "labels")
      field "labelFingerprint", jmes_path(col_item, "labelFingerprint")
      field "selfLink", jmes_path(col_item, "selfLink")
      field "creationTimestamp", jmes_path(col_item, "creationTimestamp")
      field "redundancyType", jmes_path(col_item, "redundancyType")
      field "projectId", val(iter_item, "projectId")
      field "projectName", val(iter_item, "projectName")
      field "projectNumber", val(iter_item, "projectNumber")
      field "requestType", val(iter_item, "requestType")
    end
  end
end

datasource "ds_images" do
  iterate $ds_images_uris
  request do
    auth $auth_google
    pagination $pagination_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "items[*]") do
      field "id", jmes_path(col_item, "id")
      field "name", jmes_path(col_item, "name")
      field "kind", jmes_path(col_item, "kind")
      field "description", jmes_path(col_item, "description")
      field "labels", jmes_path(col_item, "labels")
      field "labelFingerprint", jmes_path(col_item, "labelFingerprint")
      field "selfLink", jmes_path(col_item, "selfLink")
      field "creationTimestamp", jmes_path(col_item, "creationTimestamp")
      field "sourceType", jmes_path(col_item, "sourceType")
      field "status", jmes_path(col_item, "status")
      field "diskSizeGb", jmes_path(col_item, "diskSizeGb")
      field "sourceDisk", jmes_path(col_item, "sourceDisk")
      field "sourceDiskId", jmes_path(col_item, "sourceDiskId")
      field "sourceImage", jmes_path(col_item, "sourceImage")
      field "sourceImageId", jmes_path(col_item, "sourceImageId")
      field "sourceSnapshot", jmes_path(col_item, "sourceSnapshot")
      field "sourceSnapshotId", jmes_path(col_item, "sourceSnapshotId")
      field "family", jmes_path(col_item, "family")
      field "projectId", val(iter_item, "projectId")
      field "projectName", val(iter_item, "projectName")
      field "projectNumber", val(iter_item, "projectNumber")
      field "requestType", val(iter_item, "requestType")
    end
  end
end

datasource "ds_get_instances" do
  iterate $ds_instances_uris
  request do
    auth $auth_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    field "instances", jq(response, "[ .items | to_entries | map_values(.value) | map(select(has(\"instances\"))) | .[].instances | .[] | {id,name,selfLink,status,tags,zone,kind,hostname,cpuPlatform,labels,description,machineType,labelFingerprint}]")
    field "projectId", val(iter_item, "projectId")
    field "projectName", val(iter_item, "projectName")
    field "projectNumber", val(iter_item, "projectNumber")
    field "requestType", val(iter_item, "requestType")
  end
end

datasource "ds_instances" do
  run_script $js_instances, $ds_get_instances, $ds_zone_to_region
end

script "js_instances", type: "javascript" do
  parameters "ds_get_instances", "ds_zone_to_region"
  result "result"
  code <<-EOS
  result = []

  _.each(ds_get_instances, function(response) {
    _.each(response['instances'], function(resource) {
      zone = resource['zone'].split('/')[8]
      region = ds_zone_to_region[zone]

      result.push({
        id: resource['id'],
        name: resource['name'],
        description: resource['description'],
        status: resource['status'],
        selfLink: resource['selfLink'],
        cpuPlatform: resource['cpuPlatform'],
        machineType: resource['machineType'],
        hostname: resource['hostname'],
        kind: resource['kind'],
        labels: resource['labels'],
        labelFingerprint: resource['labelFingerprint'],
        projectId: response['projectId'],
        projectName: response['projectName'],
        projectNumber: response['projectNumber'],
        requestType: response['requestType'],
        zone: zone,
        region: region
      })
    })
  })
EOS
end

datasource "ds_snapshots" do
  iterate $ds_snapshots_uris
  request do
    auth $auth_google
    pagination $pagination_google
    host "compute.googleapis.com"
    path val(iter_item, 'uri')
    header "User-Agent", "RS Policies"
    header "Content-Type", "application/json"
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "items[*]") do
      field "id", jmes_path(col_item, "id")
      field "name", jmes_path(col_item, "name")
      field "kind", jmes_path(col_item, "kind")
      field "description", jmes_path(col_item, "description")
      field "labels", jmes_path(col_item, "labels")
      field "labelFingerprint", jmes_path(col_item, "labelFingerprint")
      field "selfLink", jmes_path(col_item, "selfLink")
      field "creationTimestamp", jmes_path(col_item, "creationTimestamp")
      field "snapshotType", jmes_path(col_item, "snapshotType")
      field "status", jmes_path(col_item, "status")
      field "diskSizeGb", jmes_path(col_item, "diskSizeGb")
      field "sourceDisk", jmes_path(col_item, "sourceDisk")
      field "sourceDiskId", jmes_path(col_item, "sourceDiskId")
      field "projectId", val(iter_item, "projectId")
      field "projectName", val(iter_item, "projectName")
      field "projectNumber", val(iter_item, "projectNumber")
      field "requestType", val(iter_item, "requestType")
    end
  end
end

datasource "ds_storage_buckets" do
  iterate $ds_bucket_uris
  request do
    auth $auth_google
    host "storage.googleapis.com"
    path "/storage/v1/b"
    query "projection", "full"
    query "project", val(iter_item, "projectId")
    ignore_status [403, 404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "items[*]") do
      field "id", jmes_path(col_item, "id")
      field "name", jmes_path(col_item, "name")
      field "kind", jmes_path(col_item, "kind")
      field "labels", jmes_path(col_item, "labels")
      field "labelFingerprint", jmes_path(col_item, "labelFingerprint")
      field "selfLink", jmes_path(col_item, "selfLink")
      field "location", jmes_path(col_item, "location")
      field "projectId", val(iter_item, "projectId")
      field "projectName", val(iter_item, "projectName")
      field "projectNumber", val(iter_item, "projectNumber")
      field "requestType", val(iter_item, "requestType")
    end
  end
end

datasource "ds_google_resources" do
  run_script $js_google_resources, $ds_google_projects_filtered, $ds_disks, $ds_vpn_gateways, $ds_external_vpn_gateways, $ds_images, $ds_instances, $ds_snapshots, $ds_storage_buckets, $param_resource_types
end

script "js_google_resources", type: "javascript" do
  parameters "ds_google_projects_filtered", "ds_disks", "ds_vpn_gateways", "ds_external_vpn_gateways", "ds_images", "ds_instances", "ds_snapshots", "ds_storage_buckets", "param_resource_types"
  result "result"
  code <<-'EOS'
  projects = []

  if (_.contains(param_resource_types, "Projects")) {
    projects = _.map(ds_google_projects_filtered, function(project) {
      return {
        id: project['id'],
        name: project['name'],
        labels: project['labels'],
        projectId: project['id'],
        projectName: project['name'],
        projectNumber: project['number'],
        selfLink: "https://cloudresourcemanager.googleapis.com/v3/projects/" + project['name'],
        kind: "project",
        requestType: "Projects",
        location: ""
      }
    })
  }

  result = projects.concat(ds_disks, ds_vpn_gateways, ds_external_vpn_gateways, ds_images, ds_instances, ds_snapshots, ds_storage_buckets)
EOS
end

datasource "ds_google_resources_missing_labels" do
  run_script $js_google_resources_missing_labels, $ds_google_resources, $ds_applied_policy, $param_labels, $param_labels_boolean
end

script "js_google_resources_missing_labels", type: "javascript" do
  parameters "ds_google_resources", "ds_applied_policy", "param_labels", "param_labels_boolean"
  result "result"
  code <<-'EOS'
  result = []

  comparators = _.map(param_labels, function(item) {
    if (item.indexOf('==') != -1) {
      return { comparison: '==', key: item.split('==')[0], value: item.split('==')[1], string: item }
    }

    if (item.indexOf('!=') != -1) {
      return { comparison: '!=', key: item.split('!=')[0], value: item.split('!=')[1], string: item }
    }

    if (item.indexOf('=~') != -1) {
      value = item.split('=~')[1]
      regex = new RegExp(value.slice(1, value.length - 1))
      return { comparison: '=~', key: item.split('=~')[0], value: regex, string: item }
    }

    if (item.indexOf('!~') != -1) {
      value = item.split('!~')[1]
      regex = new RegExp(value.slice(1, value.length - 1))
      return { comparison: '!~', key: item.split('!~')[0], value: regex, string: item }
    }

    // If = is present but none of the above are, assume user error and that the user intended ==
    if (item.indexOf('=') != -1) {
      return { comparison: '==', key: item.split('=')[0], value: item.split('=')[1], string: item }
    }

    // Assume we're just testing for a key if none of the comparators are found
    return { comparison: 'key', key: item, value: null, string: item }
  })

  if (comparators.length > 0) {
    // Check each VM for missing labels
    _.each(ds_google_resources, function(resource) {
      resource_labels = resource['labels']
      if (typeof(resource_labels) != 'object') { resource_labels = {} }

      // Store a list of missing labels
      missing_labels = []

      _.each(comparators, function(comparator) {
        comparison = comparator['comparison']
        value = comparator['value']
        string = comparator['string']
        resource_label = resource_labels[comparator['key']]

        if (comparison == 'key' && resource_label == undefined) { missing_labels.push(string) }
        if (comparison == '==' && resource_label != value) { missing_labels.push(string) }
        if (comparison == '!=' && resource_label == value) { missing_labels.push(string) }

        if (comparison == '=~') {
          if (resource_label == undefined) { missing_labels.push(string) }
          if (resource_label != undefined && !value.test(resource_label)) { missing_labels.push(string) }
        }

        if (comparison == '!~') {
          if (resource_label != undefined && value.test(resource_label)) { missing_labels.push(string) }
        }
      })

      if (missing_labels.length == comparators.length || (missing_labels.length > 0 && param_labels_boolean == 'Any')) {
        new_resource = resource
        new_resource['missing_labels'] = missing_labels
        result.push(new_resource)
      }
    })
  }
EOS
end

datasource "ds_missing_labels_incident" do
  run_script $js_missing_labels_incident, $ds_google_resources_missing_labels, $ds_applied_policy, $param_labels, $param_labels_boolean
end

script "js_missing_labels_incident", type: "javascript" do
  parameters "ds_google_resources_missing_labels", "ds_applied_policy", "param_labels", "param_labels_boolean"
  result "result"
  code <<-'EOS'
  resource_mapping = {
    "Persistent Disks": "Persistent Disk",
    "VPN Gateways (Internal)": "VPN Gateway (Internal)",
    "VPN Gateways (External)": "VPN Gateway (External)",
    "Images": "Image",
    "Virtual Machines": "Virtual Machine",
    "Snapshots": "Snapshot",
    "Storage Buckets": "Storage Bucket",
    "Projects": "Project"
  }

  result = _.map(ds_google_resources_missing_labels, function(resource) {
    resource_labels = []

    if (typeof(resource['labels']) == 'object') {
      _.each(Object.keys(resource['labels']), function(key) {
        resource_labels.push(key + '=' + resource['labels'][key])
      })
    }

    return {
      accountID: resource['projectId'],
      accountName: resource['projectName'],
      projectNumber: resource['projectNumber'],
      resourceName: resource['name'],
      resourceID: resource['id'],
      resourceType: resource_mapping[resource['requestType']],
      region: resource['region'],
      zone: resource['zone'],
      status: resource['status'],
      selfLink: resource['selfLink'],
      labels_object: resource['labels'],
      labels: resource_labels.join(', '),
      labelFingerprint: resource['labelFingerprint'],
      missing_labels: resource['missing_labels'].join(', '),
      policy_name: ds_applied_policy['name'],
      message: ""
    }
  })

  // Dummy item to ensure that the check statement in the policy executes at least once
  result.push({
    accountID: "",
    accountName: "",
    projectNumber: "",
    resourceName: "",
    resourceID: "",
    resourceType: "",
    region: "",
    zone: "",
    status: "",
    selfLink: "",
    labels_object: "",
    labels: "",
    labelFingerprint: "",
    missing_labels: "",
    policy_name: "",
    message: ""
  })

  phrase = "one or more"
  if (param_labels_boolean == "All") { phrase = "all" }

  message = ["The following Google resources are missing ", phrase, " of the following labels:\n\n"].join('')
  label_list = _.map(param_labels, function(label) { return ["- ", label, "\n"].join('') }).join('')
  disclaimer = "\nThe above settings can be modified by editing the applied policy and changing the appropriate parameters."

  result[0]['message'] = message + label_list + disclaimer
EOS
end

###############################################################################
# Policy
###############################################################################

policy "pol_unlabeled_resources" do
  validate_each $ds_missing_labels_incident do
    summary_template "{{ with index data 0 }}{{ .policy_name }}{{ end }}: {{ len data }} Google Resources Missing Labels Found"
    detail_template "{{ with index data 0 }}{{ .message }}{{ end }}"
    # Policy check fails and incident is created only if data is not empty and the Parent Policy has not been terminated
    check logic_or($ds_parent_policy_terminated, eq(val(item, "resourceID"), ""))
    escalate $esc_email
    escalate $esc_label_resources
    export do
      resource_level true
      field "accountID" do
        label "Project ID"
      end
      field "accountName" do
        label "Project Name"
      end
      field "projectNumber" do
        label "Project Number"
      end
      field "resourceName" do
        label "Resource Name"
      end
      field "resourceID" do
        label "Resource ID"
      end
      field "labels" do
        label "Labels"
      end
      field "missing_labels" do
        label "Missing Labels"
      end
      field "labelFingerprint" do
        label "labelFingerprint"
      end
      field "resourceType" do
        label "Resource Type"
      end
      field "region" do
        label "Region"
      end
      field "status" do
        label "Status"
      end
      field "selfLink" do
        label "Resource Link"
      end
      field "id" do
        label "ID"
        path "resourceID"
      end
      field "labels_object" do
        label "Labels Object"
      end
    end
  end
end

###############################################################################
# Escalations
###############################################################################

escalation "esc_email" do
  automatic true
  label "Send Email"
  description "Send incident email"
  email $param_email
end

escalation "esc_label_resources" do
  automatic false
  label "Label Resources"
  description "Label the selected unlabeled resources"
  parameter "param_labels_to_add" do
    type "list"
    category "Actions"
    label "Add Labels (Key=Value)"
    description "Cloud native labels to add to instances with missing labels. Use Key=Value format. Example: env=production"
    allowed_pattern /^[^=]+=[^=]+$/
    # No default value, user input required
  end
  run "label_resources", data, $param_labels_to_add
end

###############################################################################
# Cloud Workflow
###############################################################################

define label_resources($data, $param_labels_to_add) return $all_responses do
  $$all_responses = []

  foreach $resource in $data do
    sub on_error: handle_error() do
      if $resource["resourceType"] == "Storage Bucket"
        call label_bucket($resource, $param_labels_to_add) retrieve $label_response
      elsif $resource["resourceType"] == "Project"
        call label_project($resource, $param_labels_to_add) retrieve $label_response
      else
        call label_resource($resource, $param_labels_to_add) retrieve $label_response
      end
    end
  end

  if inspect($$errors) != "null"
    raise join($$errors, "\n")
  end
end

define label_bucket($resource, $param_labels_to_add) return $response do
  $labels_to_add = $resource["labels_object"]

  if $labels_to_add == null
    $labels_to_add = {}
  end

  foreach $label in $param_labels_to_add do
    $key = first(split($label, "=" ))
    $value = last(split($label, "="))
    $labels_to_add[$key] = $value
  end

  $url = $resource["selfLink"]
  task_label("PATCH " + $url)

  $response = http_patch(
    auth: $$auth_google,
    url: $url,
    headers: {
      "cache-control": "no-cache",
      "content-type": "application/json"
    },
    body: {
      "labels": $labels_to_add
    }
  )

  task_label("Patch Google resource response: " + $resource["id"] + " " + to_json($response))
  $$all_responses << to_json({"req": "PATCH " + $url, "resp": $response})

  if $response["code"] != 204 && $response["code"] != 202 && $response["code"] != 200
    raise "Unexpected response patching Google resource: "+ $resource["id"] + " " + to_json($response)
  else
    task_label("Patch Google resource successful: " + $resource["id"])
  end
end

define label_project($resource, $param_labels_to_add) return $response do
  $labels_to_add = $resource["labels_object"]

  if $labels_to_add == null
    $labels_to_add = {}
  end

  foreach $label in $param_labels_to_add do
    $key = first(split($label, "=" ))
    $value = last(split($label, "="))
    $labels_to_add[$key] = $value
  end

  $url = $resource["selfLink"]
  task_label("PATCH " + $url)

  $response = http_patch(
    auth: $$auth_google,
    url: $url,
    headers: {
      "cache-control": "no-cache",
      "content-type": "application/json"
    },
    body: {
      "labels": $labels_to_add
    }
  )

  task_label("Patch Google Project response: " + $resource["name"] + " " + to_json($response))
  $$all_responses << to_json({"req": "PATCH " + $url, "resp": $response})

  if $response["code"] != 204 && $response["code"] != 202 && $response["code"] != 200
    raise "Unexpected response patching Google Project: "+ $resource["name"] + " " + to_json($response)
  else
    task_label("Patch Google Project successful: " + $resource["name"])
  end
end

define label_resource($resource, $param_labels_to_add) return $response do
  $labels_to_add = $resource["labels_object"]

  if $labels_to_add == null
    $labels_to_add = {}
  end

  foreach $label in $param_labels_to_add do
    $key = first(split($label, "=" ))
    $value = last(split($label, "="))
    $labels_to_add[$key] = $value
  end

  $url = join([$resource["selfLink"], "/setLabels"])
  task_label("POST " + $url)

  $response = http_post(
    auth: $$auth_google,
    url: $url,
    headers: {
      "cache-control": "no-cache",
      "content-type": "application/json"
    },
    body: {
      "labels": $labels_to_add,
      "labelFingerprint": $resource["labelFingerprint"]
    }
  )

  task_label("Post Google resource response: " + $resource["id"] + " " + to_json($response))
  $$all_responses << to_json({"req": "POST " + $url, "resp": $response})

  if $response["code"] != 204 && $response["code"] != 202 && $response["code"] != 200
    raise "Unexpected response posting Google resource: "+ $resource["id"] + " " + to_json($response)
  else
    task_label("Post Google resource successful: " + $resource["id"])
  end
end

define handle_error() do
  if !$$errors
    $$errors = []
  end
  $$errors << $_error["type"] + ": " + $_error["message"]
  # We check for errors at the end, and raise them all together
  # Skip errors handled by this definition
  $_error_behavior = "skip"
end

###############################################################################
# Meta Policy [alpha]
# Not intended to be modified or used by policy developers
###############################################################################

# If the meta_parent_policy_id is not set it will evaluate to an empty string and we will look for the policy itself,
# if it is set we will look for the parent policy.
datasource "ds_get_policy" do
  request do
    auth $auth_flexera
    host rs_governance_host
    ignore_status [404]
    path join(["/api/governance/projects/", rs_project_id, "/applied_policies/", switch(ne(meta_parent_policy_id, ""), meta_parent_policy_id, policy_id)])
    header "Api-Version", "1.0"
  end
  result do
    encoding "json"
    field "id", jmes_path(response, "id")
  end
end

datasource "ds_parent_policy_terminated" do
  run_script $js_decide_if_self_terminate, $ds_get_policy, policy_id, meta_parent_policy_id
end

# If the policy was applied by a meta_parent_policy we confirm it exists if it doesn't we confirm we are deleting
# This information is used in two places:
# - determining whether or not we make a delete call
# - determining if we should create an incident (we don't want to create an incident on the run where we terminate)
script "js_decide_if_self_terminate", type: "javascript" do
  parameters "found", "self_policy_id", "meta_parent_policy_id"
  result "result"
  code <<-EOS
  var result
  if (meta_parent_policy_id != "" && found.id == undefined) {
    result = true
  } else {
    result = false
  }
  EOS
end

# Two potentials ways to set this up:
# - this way and make a unneeded 'get' request when not deleting
# - make the delete request an interate and have it iterate over an empty array when not deleting and an array with one item when deleting
script "js_make_terminate_request", type: "javascript" do
  parameters "should_delete", "policy_id", "rs_project_id", "rs_governance_host"
  result "request"
  code <<-EOS

  var request = {
    auth:  'auth_flexera',
    host: rs_governance_host,
    path: "/api/governance/projects/" + rs_project_id + "/applied_policies/" + policy_id,
    headers: {
      "API-Version": "1.0",
      "Content-Type":"application/json"
    },
  }

  if (should_delete) {
    request.verb = 'DELETE'
  }
  EOS
end

datasource "ds_terminate_self" do
  request do
    run_script $js_make_terminate_request, $ds_parent_policy_terminated, policy_id, rs_project_id, rs_governance_host
  end
end

datasource "ds_is_deleted" do
  run_script $js_check_deleted, $ds_terminate_self
end

# This is just a way to have the check delete request connect to the farthest leaf from policy.
# We want the delete check to the first thing the policy does to avoid the policy erroring before it can decide whether or not it needs to self terminate
# Example a customer deletes a credential and then terminates the parent policy. We still want the children to self terminate
# The only way I could see this not happening is if the user who applied the parent_meta_policy was offboarded or lost policy access, the policies who are impersonating the user
# would not have access to self-terminate
# It may be useful for the backend to enable a mass terminate at some point for all meta_child_policies associated with an id.
script "js_check_deleted", type: "javascript" do
  parameters "response"
  result "result"
  code <<-EOS
  result = {"path":"/"}
  EOS
end