google_long_stopped_instances.pt

name "Google Long-stopped instances"
rs_pt_ver 20180301
type "policy"
short_description "Report on any google instances that have been stopped for a long time with the option to Terminate them. \n See the [README](https://github.com/flexera-public/policy_templates/tree/master/compliance/google/long_stopped_instances) and [docs.flexera.com/flexera/EN/Automation](https://docs.flexera.com/flexera/EN/Automation/AutomationGS.htm) to learn more."
long_description ""
category "Compliance"
severity "low"
default_frequency "daily"
info(
  version: "2.7",
  provider: "GCE",
  service: "Compute",
  policy_set: "Long Stopped Instances"
)

###############################################################################
# Parameters
###############################################################################

parameter "param_email" do
  type "list"
  label "Email List"
  description "Email addresses of the recipients you wish to notify"
end

parameter "param_exclude_tags" do
  type "list"
  label "Tags to ignore"
  description "List of tags(Key or Key, value mentioned in object metadata.) that will exclude objects from being evaluated by this policy. Multiple tags are evaluated as an 'OR' condition. Tag keys or key/value pairs can be listed. Example: 'test,env=dev'"
end

parameter "param_stopped_days" do
  type "number"
  label "Stopped days"
  description "Number of days an instance is stopped before it is added to the report"
end

parameter "param_automatic_action" do
  type "list"
  label "Automatic Actions"
  description "When this value is set, this policy will automatically take the selected action(s)"
  allowed_values ["Terminate Instances"]
end

###############################################################################
# Authentication
###############################################################################

# authenticate with Google
credentials "auth_google" do
  schemes "oauth2"
  label "Google"
  description "Select the Google Cloud Credential from the list."
  tags "provider=gce"
end

pagination "google_pagination" do
  get_page_marker do
    body_path "nextPageToken"
  end
  set_page_marker do
    query "pageToken"
  end
end

#get all google project
datasource "ds_google_project" do
  request do
    auth $auth_google
    pagination $google_pagination
    host "cloudresourcemanager.googleapis.com"
    path "/v1/projects/"
    query "filter", "lifecycleState=ACTIVE"
  end
  result do
    encoding "json"
    collect jmes_path(response, "projects[*]") do
      field "projectNumber", jmes_path(col_item,"projectNumber")
      field "projectId", jmes_path(col_item,"projectId")
    end
  end
end

#https://cloud.google.com/compute/docs/reference/rest/v1/zones/list
datasource "ds_zone" do
  iterate $ds_google_project
  request do
    auth $auth_google
    pagination $google_pagination
    host "compute.googleapis.com"
    path join(["/compute/v1/projects/",val(iter_item, "projectId"),"/zones/"])
    ignore_status [403,404]
  end
  result do
    encoding "json"
      collect jmes_path(response, "items[*]") do
      field "zone", jmes_path(col_item, "name")
      field "projectId", val(iter_item, "projectId")
    end
  end
end

#https://cloud.google.com/compute/docs/reference/rest/v1/instances/list
datasource "ds_stopped_instances" do
  iterate $ds_zone
  request do
    auth $auth_google
    pagination $google_pagination
    host "compute.googleapis.com"
    path join(["/compute/v1/projects/",val(iter_item, "projectId"),"/zones/",val(iter_item, "zone"),"/instances"])
    query "filter", 'status="TERMINATED"'
    ignore_status [403,404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "items[*]") do
      field "instance_id", jmes_path(col_item, "id")
      field "instance_name", jmes_path(col_item, "name")
      field "status", jmes_path(col_item, "status")
      field "zone", val(iter_item, "zone")
      field "tags", jmes_path(col_item, "tags")
      field "projectId", val(iter_item, "projectId")
    end
  end
end

datasource "ds_stopped_instances_req_list" do
  run_script $js_stopped_instances_req_list, $ds_stopped_instances, $param_stopped_days
end

#https://cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list
datasource "ds_list_instances_with_uptime_in_window" do
  iterate $ds_stopped_instances_req_list
  request do
    auth $auth_google
    pagination $google_pagination
    host "monitoring.googleapis.com"
    path join(["/v3/projects/",val(iter_item, "projectId"),"/timeSeries/"])
    query "filter", join(['metric.type = "compute.googleapis.com/instance/uptime" AND metric.labels.instance_name =', val(iter_item,"instance_name")])
    query "interval.endTime", val(iter_item,"end_at")
    query "interval.startTime", val(iter_item,"start_at")
    ignore_status [403,404]
  end
  result do
    encoding "json"
    collect jmes_path(response, "timeSeries[*]") do
      field "instance_name", val(iter_item,"instance_name")
      field "instance_id", jmes_path(col_item, "resource.labels.instance_id")
      field "zone", jmes_path(col_item, "resource.labels.zone")
    end
  end
end

datasource "ds_report" do
  run_script $js_report, $ds_stopped_instances, $ds_list_instances_with_uptime_in_window, $param_exclude_tags
end

###############################################################################
# Scripts
###############################################################################
script "js_stopped_instances_req_list", type: "javascript" do
  parameters "ds_stopped_instances", "param_stopped_days"
  result "request"
  code <<-EOF
  var request=[];
  _.each(ds_stopped_instances, function(row){
    if(row["instance_name"] != null){
      var result = {
        "start_at": new Date(new Date().setDate(new Date().getDate() - parseInt(param_stopped_days))).toISOString(),
        "end_at": new Date().toISOString(),
        "instance_name": row["instance_name"],
        "projectId": row["projectId"]
      }
      request.push(result);
    }
  })
EOF
end

script "js_report", type: "javascript" do
  parameters "ds_stopped_instances", "ds_list_instances_with_uptime_in_window", "param_exclude_tags"
  result "result"
  code <<-EOF
  var result=[];
  var param_exclude_tags_lower=[];

  for(var i=0; i < param_exclude_tags.length; i++){
    param_exclude_tags_lower[i]=param_exclude_tags[i].toString().toLowerCase();
  }
  _.each(ds_stopped_instances, function(instance_stopped){
    var tags = instance_stopped['tags'];
    var isTagMatched=false
    var tagKeyValue=""
    if(typeof(tags) !== "undefined"){
      var tagKeys = Object.keys(tags);
      for (var j = 0; j < tagKeys.length; j++){
        var tagKey = tagKeys[j];
        var tagValue = tags[tagKey];
        //Check, if the tag present in entered param_exclude_tags, ignore the google bucket object if the tag matches/present.
        if((param_exclude_tags_lower.indexOf(tagKey.toLowerCase()) !== -1) || (param_exclude_tags_lower.indexOf((tagKey+'='+tagValue).toLowerCase()) !== -1)){
          isTagMatched = true;
        }
        if(tagValue.length > 0){
          tagKeyValue = tagKeyValue + ', '+ tagKey+'='+tagValue
        }else{
          tagKeyValue = tagKeyValue + ', '+ tagKey
        }
      }
    }

    // If we find any uptime in the param_stopped_days this list will be greater than 0.
    // If it's 0 we report on it.
    var instance_in_uptime_list = _.filter(ds_list_instances_with_uptime_in_window, function(item){
      return item.instance_id == instance_stopped.instance_id
    })

    if( instance_in_uptime_list.length == 0 && !isTagMatched ){
      result.push({
        "name": instance_stopped["instance_name"],
        "status": instance_stopped["status"],
        "instance_id": instance_stopped["instance_id"],
        "zone": instance_stopped["zone"],
        "projectId": instance_stopped["projectId"],
        "tagKeyValue":(tagKeyValue.slice(2))
      })
    }
  })

  var result = _(result).chain()
  .sortBy(function(item) {
    return item.zone;
  }).sortBy(function(item) {
    return item.projectId;
  }).value();
EOF
end

###############################################################################
# Policy
###############################################################################

policy "pol_utilization" do
  validate_each $ds_report do
    summary_template "{{ rs_project_name }} (Account ID: {{ rs_project_id }}): {{ len data }} google cloud instances in Stopped State for Over {{parameters.param_stopped_days}} Day(s)"
    check eq(0,1)
    escalate $esc_email
    escalate $esc_delete_instances
    export do
      resource_level true
      field "projectId" do
        label "Project ID"
      end
      field "zone" do
        label "Zone"
      end
      field "id" do
        label "Instance ID"
        path "instance_id"
      end
      field "name" do
        label "Name"
      end
      field "status" do
        label "Status"
      end
      field "tagKeyValue" do
        label "Tags"
      end
    end
  end
end


###############################################################################
# Escalations
###############################################################################

escalation "esc_email" do
  automatic true
  label "Send Email"
  description "Send incident email"
  email $param_email
end

escalation "esc_delete_instances" do
  automatic contains($param_automatic_action, "Terminate Instances")
  label "Delete Instances"
  description "Terminate the stopped instances"
  run "delete_instances", data
end

###############################################################################
# Cloud Workflow
###############################################################################

#https://cloud.google.com/compute/docs/reference/rest/v1/instances/delete
define delete_instances($data) return $all_responses do
  $all_responses = []
  foreach $item in $data do
    sub on_error: skip do
      $response = http_request(
        auth: $$auth_google,
        verb: "delete",
        host: "compute.googleapis.com",
        href: join(["/compute/v1/projects/", $item["projectId"], "/zones/", $item["zone"], "/instances/",$item["name"]]),
        https: true,
        headers: {
          "cache-control": "no-cache",
          "content-type": "application/json"
        }
      )
      $all_responses << $response
    end
  end
end