azure_delete_old_snapshots.pt

name "Azure Old Snapshots"
rs_pt_ver 20180301
type "policy"
short_description "Checks for snapshots older than specified number of days and, optionally, deletes them. See the [README](https://github.com/flexera-public/policy_templates/tree/master/cost/azure/old_snapshots) and [docs.flexera.com/flexera/EN/Automation](https://docs.flexera.com/flexera/EN/Automation/AutomationGS.htm) to learn more."
severity "low"
category "Cost"
default_frequency "daily"
info(
  version: "4.0",
  provider: "Azure",
  service: "Storage",
  policy_set: "Old Snapshots"
)

##################
# User inputs    #
##################

parameter "param_email" do
  type "list"
  label "Email Address"
  description "Email addresses of the recipients you wish to notify"
end

parameter "param_azure_endpoint" do
  type "string"
  label "Azure Endpoint"
  allowed_values "management.azure.com", "management.chinacloudapi.cn"
  default "management.azure.com"
end

parameter "param_subscription_whitelist" do
  label "Subscription Whitelist"
  type "list"
  description "Whitelisted Subscriptions, if empty, all subscriptions will be checked"
end

parameter "param_snapshot_age" do
  type "number"
  label "Snapshot Age"
  description "The number of days since the snapshot was created"
  default 30
end

parameter "param_exclusion_tag_key" do
  category "User Inputs"
  label "Exclusion Tag Key"
  description "Cloud native tag key to ignore instances. Example: exclude_utilization"
  type "list"
end

parameter "param_automatic_action" do
  type "list"
  label "Automatic Actions"
  description "When this value is set, this policy will automatically take the selected action(s)"
  allowed_values ["Delete Snapshots"]
end

parameter "param_log_to_cm_audit_entries" do
  type "string"
  label "Log to CM Audit Entries"
  description "Boolean for whether or not to log any debugging information from actions to CM Audit Entries, this should be left set to No on Flexera EU"
  default "No"
  allowed_values "Yes", "No"
end

###############################################################################
# Authentication
###############################################################################

#authenticate with Azure
credentials "azure_auth" do
  schemes "oauth2"
  label "Azure"
  description "Select the Azure Resource Manager Credential from the list."
  tags "provider=azure_rm"
end

credentials "auth_flexera" do
  schemes "oauth2"
  label "flexera"
  description "Select Flexera One OAuth2 credentials"
  tags "provider=flexera"
end

###############################################################################
# Pagination
###############################################################################

#pagination support
pagination "azure_pagination" do
  get_page_marker do
    body_path "nextLink"
  end
  set_page_marker do
    uri true
  end
end

###############################################################################
# Datasources
###############################################################################

#get all subscription details.
datasource "ds_subscriptions" do
  request do
    auth $azure_auth
    pagination $azure_pagination
    host $param_azure_endpoint
    path "/subscriptions/"
    query "api-version","2020-01-01"
    header "User-Agent", "RS Policies"
  end
  result do
    encoding "json"
    collect jmes_path(response, "value[*]") do
      field "subscriptionID", jmes_path(col_item,"subscriptionId")
      field "subscriptionName", jmes_path(col_item,"displayName")
      field "state", jmes_path(col_item,"state")
    end
  end
end

datasource "ds_filtered_subscriptions" do
  run_script $js_filtered_subscriptions, $ds_subscriptions, $param_subscription_whitelist
end

#get all snapshots
datasource "ds_azure_get_snapshots" do
  iterate $ds_filtered_subscriptions
  request do
    auth $azure_auth
    pagination $azure_pagination
    host $param_azure_endpoint
    path join(["/subscriptions/", val(iter_item,"subscriptionID"), "/providers/Microsoft.Compute/snapshots"])
    query "api-version","2019-07-01"
  end
  result do
    encoding "json"
    collect jmes_path(response, "value[*]") do
      field "id", jmes_path(col_item,"id")
      field "resourceName", jmes_path(col_item,"name")
      field "resourceGroup", get(4,split(jmes_path(col_item,"id"),'/'))
      field "resourceType", jmes_path(col_item,"type")
      field "region", jmes_path(col_item, "location")
      field "tags", jmes_path(col_item,"tags")
      field "timeCreated", jmes_path(col_item,"properties.timeCreated")
      field "subscriptionID",val(iter_item,"subscriptionID")
      field "subscriptionName",val(iter_item,"subscriptionName")
    end
  end
end

datasource "ds_currency_reference" do
  request do
    host "raw.githubusercontent.com"
    path "/rightscale/policy_templates/master/cost/scheduled_reports/currency_reference.json"
    header "User-Agent", "RS Policies"
  end
end

datasource "ds_currency_code" do
  request do
    auth $auth_flexera
    host rs_optima_host
    path join(["/bill-analysis/orgs/",rs_org_id,"/settings/currency_code"])
    header "Api-Version", "0.1"
    header "User-Agent", "RS Policies"
    ignore_status [403]
  end
  result do
    encoding "json"
    field "id", jmes_path(response,"id")
    field "value", jmes_path(response,"value")
  end
end

datasource "ds_billing_centers" do
  request do
    auth $auth_flexera
    host rs_optima_host
    path join(["/analytics/orgs/",rs_org_id,"/billing_centers"])
    header "Api-Version", "1.0"
    header "User-Agent", "RS Policies"
    query "view", "allocation_table"
    ignore_status [403]
  end
  result do
    encoding "json"
    collect jmes_path(response,"[*]") do
      field "href", jmes_path(col_item,"href")
      field "id", jmes_path(col_item,"id")
      field "name", jmes_path(col_item,"name")
      field "parent_id", jmes_path(col_item,"parent_id")
    end
  end
end

datasource "ds_top_level_billing_centers" do
  run_script $js_top_level_bc, $ds_billing_centers
end

datasource "ds_snapshot_costs" do
  iterate $ds_filtered_subscriptions
  request do
    run_script $js_get_costs, val(iter_item,"subscriptionID"), $ds_top_level_billing_centers, rs_org_id, rs_optima_host
  end
  result do
    encoding "json"
    collect jmes_path(response,"rows[*]") do
      field "resource_id", jmes_path(col_item,"dimensions.resource_id")
      field "cost_nonamortized_unblended_adj", jmes_path(col_item,"metrics.cost_nonamortized_unblended_adj")
    end
  end
end

datasource "ds_filter_snapshots" do
  run_script $js_filter_snapshots, $param_exclusion_tag_key, $param_snapshot_age, $ds_azure_get_snapshots
end


datasource "ds_snapshot_cost_mapping" do
  run_script $js_snapshot_cost_mapping, $ds_filter_snapshots, $ds_snapshot_costs, $ds_currency_code, $ds_currency_reference, $ds_billing_centers
end

###############################################################################
# Scripts
###############################################################################

script "js_filtered_subscriptions", type: "javascript" do
  parameters "ds_subscriptions", "param_subscription_whitelist"
  result "results"
  code <<-EOS
  var results = []
  if ( param_subscription_whitelist.length != 0){
    results = []
    _.each(param_subscription_whitelist, function(sub){
      var found = _.find(ds_subscriptions, function(item){
        return item.subscriptionID == sub || item.subscriptionName.toLowerCase() == sub.toLowerCase();
      })
      results.push(found)
    })
  } else {
    results = ds_subscriptions
  }
EOS
end

script "js_top_level_bc", type: "javascript" do
  parameters "billing_centers"
  result "filtered_billing_centers"
  code <<-EOS
    var filtered_billing_centers =
    _.reject(billing_centers, function(bc){ return bc.parent_id != null });
  EOS
end

script "js_get_costs", type:"javascript" do
  parameters  "account_id","billing_centers","org","optima_host"
  result "request"
  code <<-EOS
    // returns date formatted as string: YYYY-mm-dd
    function getFormattedDailyDate(date) {
      var year = date.getFullYear();
      var month = (1 + date.getMonth()).toString();
      month = month.length > 1 ? month : '0' + month;
      var day = date.getDate().toString();
      day = day.length > 1 ? day : '0' + day;
      return year + '-' + month + '-' + day;
    }
    var start_date = getFormattedDailyDate(new Date(new Date().setDate(new Date().getDate() - 3)));
    var end_date = getFormattedDailyDate(new Date(new Date().setDate(new Date().getDate() - 2)));
    var request = {
      auth: "auth_flexera",
      host: optima_host,
      verb: "POST",
      path: "/bill-analysis/orgs/" + org + "/costs/select",
      body_fields: {
        "dimensions": ["resource_id"],
        "granularity": "day",
        "start_at": start_date,
        "end_at": end_date,
        "metrics": ["cost_nonamortized_unblended_adj"],
        "billing_center_ids": _.compact(_.map(billing_centers, function(value){ return value.id})),
        "limit": 10000,
        "filter": {
          "expressions": [
            {
              "dimension": "service",
              "type": "equal",
              "value": "Microsoft.Compute"
            },
            {
              "dimension": "vendor_account",
              "type": "equal",
              "value": account_id
            }
          ],
          "type": "and"
        }
      },
      headers: {
        "User-Agent": "RS Policies",
        "Api-Version": "1.0"
      },
      ignore_status: [400]
    }
  EOS
end

script "js_filter_snapshots", type: "javascript" do
  parameters "param_exclusion_tag_key", "param_snapshot_age", "ds_azure_get_snapshots"
  result "res"
  code <<-EOS
    var res = [];
    _.each(ds_azure_get_snapshots, function(snapshot){
      var tags = []
      var expectedDate=new Date();
      var is_tag_matched=false;
      var date1 = new Date(snapshot['timeCreated']);
      var date2 = new Date();
      var Difference_In_Time = date2.getTime() - date1.getTime();
      var diffDays = Difference_In_Time / (1000 * 3600 * 24);
      var age=Math.round(diffDays);
      if(age<diffDays){
        age++;
      }
      var createdTime=new Date(snapshot['timeCreated']);
      expectedDate.setDate(expectedDate.getDate()- parseInt(param_snapshot_age));

      if (typeof snapshot.tags === "undefined" || snapshot.tags === null) {
        snapshot.tags = tags
      }

      for(var k=0;k<param_exclusion_tag_key.length;k++){
        if(_.has(snapshot.tags, param_exclusion_tag_key[k])){
          is_tag_matched=true
        }
      }


      Object.keys(snapshot['tags']).forEach(function(key) {
        tags.push(key+'='+snapshot['tags'][key])
      });

      resourceTypeSplit = snapshot['resourceType'].split("/")
      service = resourceTypeSplit[0]

      if (!is_tag_matched) {
        if(createdTime.getTime()<expectedDate.getTime()){
          res.push({
            resourceID:snapshot['id'],
            resourceType:snapshot['resourceType'],
            resourceName:snapshot['resourceName'],
            region:snapshot['region'],
            tags:tags,
            service:service,
            resourceGroup:snapshot['resourceGroup'],
            timeCreated:snapshot['timeCreated'],
            subscriptionID:snapshot['subscriptionID'],
            subscriptionName:snapshot['subscriptionName'],
            age:age,
            savings:0.0
          })
        }
      }
    })
  EOS
end

script "js_snapshot_cost_mapping", type:"javascript" do
  parameters  "snapshots","snapshots_costs","ds_currency_code","ds_currency_reference", "ds_billing_centers"
  result "result"
  code <<-EOS
    var instances = [];
    var result={};
    var message=''
    var count=0;
    function formatNumber(number, separator){
      var numString =number.toString();
      var values=numString.split(".");
      var result = ''
      while (values[0].length > 3){
        var chunk = values[0].substr(-3)
        values[0] = values[0].substr(0, values[0].length - 3)
        result = separator + chunk + result
      }
      if (values[0].length > 0){
        result = values[0] + result
      }
      if(values[1]==undefined){
        return result;
      }
      return result+"."+values[1];
    }
    // Format costs with currency symbol and thousands separator
    if(ds_billing_centers.length!=0){
      // Put costs into a map by resource ID and only include them for resource IDs we actually need
      var costs_by_resource_id = {};
      _.each(snapshots, function(snapshot) {
        costs_by_resource_id[snapshot.resourceID] = [];
      });
      _.each(snapshots_costs, function(cost) {
        var costs = costs_by_resource_id[cost.resource_id];
        if (costs != null) {
          costs.push(cost);
        }
      });
      if( ds_currency_code['value'] !== undefined ) {
        if (ds_currency_reference[ds_currency_code['value']] !== undefined ) {
          var cur = ds_currency_reference[ds_currency_code['value']]['symbol']
          if( ds_currency_reference[ds_currency_code['value']]['t_separator'] !== undefined ) {
            var separator = ds_currency_reference[ds_currency_code['value']]['t_separator']
          } else {
            var separator = ""
          }
        } else {
          var cur = ""
          var separator = ""
        }
      } else {
        var cur = "$"
        var separator = ","
      }
      var total=0;
      _.each(snapshots, function(snapshot){
        var cost_objects = costs_by_resource_id[snapshot.resourceID];
        if (_.size(cost_objects) > 0){
          count++;
          var sum = _.reduce(_.compact(_.map(cost_objects, function(value){ return value.cost_nonamortized_unblended_adj})), function(memo, num){ return memo + num; }, 0);
          var monthly_savings = sum*30;
          total=total+monthly_savings;
          snapshot['savings']= (Math.round(monthly_savings * 1000) / 1000);
          snapshot['savingsCurrency']= cur;
          instances.push(snapshot)
        } else {
          snapshot['savingsCurrency']= cur;
          snapshot['savings']= 0.0;
          instances.push(snapshot)
        }
      })
      if(count){
        total=cur + ' '+formatNumber((Math.round(total * 100) / 100), separator);
        message="The total estimated monthly savings are " +total;
      } else {
        message="The Flexera Optima system does not have any data to calculate savings for these resources";
      }
    }else{
      message="You do not have the minimum required role of billing_center_viewer to view the savings";
      instances=snapshots;
    }
    result={
      "instances": instances,
      "message": message
    };
    result.instances = _.sortBy(result.instances,"region");
    result.instances = _.sortBy(result.instances,"subscriptionName");
  EOS
end

###############################################################################
# Policy
###############################################################################

policy "pol_azure_delete_old_snapshots" do
  validate $ds_snapshot_cost_mapping do
    summary_template "{{ rs_project_name }} (Account ID: {{ rs_project_id }}): {{ len data.instances }} Old Snapshots Found"
    detail_template <<-EOS
{{data.message}}.
EOS
    export "instances" do
      resource_level true
      field "accountID" do
        label "Subscription ID"
        path "subscriptionID"
      end
      field "accountName" do
        label "Subscription Name"
        path "subscriptionName"
      end
      field "resourceID" do
        label "Resource Id"
      end
      field "resourceName" do
        label "Resource Name"
      end
      field "resourceGroup" do
        label "Resource Group"
      end
      field "resourceType" do
        label "Resource Type"
      end
      field "region" do
        label "Region"
      end
      field "age" do
        label "Age In Days"
      end
      field "tags" do
        label "Tags"
      end
      field "service" do
        label "Service"
      end
      field "savings" do
        label "Estimated Monthly Savings"
      end
      field "savingsCurrency" do
        label "Savings Currency"
      end
      field "id" do
        label "ID"
        path "resourceID"
      end
    end
    hash_include "instances"
    # Send email report
    escalate $send_email_report
    # Delete snapshot if user approves
    escalate $process_snapshots
    check eq(size(val(data, "instances")), 0)
  end
end

###############################################################################
# Escalations
###############################################################################

escalation "send_email_report" do
  automatic true
  label "Send Email"
  description "Send incident email"
  email $param_email
end

escalation "process_snapshots" do
  automatic contains($param_automatic_action, "Delete Snapshots")
  label "Delete Snapshots"
  description "Delete all selected snapshots"
  run "delete_old_snapshots", data, $param_log_to_cm_audit_entries, rs_optima_host
end

###############################################################################
# Cloud Workflow
###############################################################################

define delete_old_snapshots($data, $param_log_to_cm_audit_entries, $$rs_optima_host) return $all_responses do
  $$debug = $param_log_to_cm_audit_entries == "Yes"
  $$errors = []
  $status_code=''
  $all_responses = []
  foreach $item in $data do
    sub on_error: skip do
      call azure_delete_old_snapshots($item['id'])
    end
  end
end

define azure_delete_old_snapshots($resourceID) do
  $response={}
  $syslog_subject = "Azure delete old snapshots API response: "
  $response = http_request(
          auth: $$azure_auth,
          verb: "delete",
          host: "management.azure.com",
          https: true,
          href: $resourceID,
          query_strings: {
            "api-version": "2019-07-01"
          }
        )
  if $delete_status != 202
    call sys_log($syslog_subject,to_s($response))
  end
end

define sys_log($subject, $detail) do
  # Create empty errors array if doesn't already exist
  if !$$errors
    $$errors = []
  end
  # Check if debug is enabled
  if $$debug
    # Append to global $$errors
    # This is the suggested way to capture errors
    $$errors << "Unexpected error for " + $subject + "\n  " + to_s($detail)
    # If Flexera NAM Zone, create audit_entries [to be deprecated]
    # This is the legacy method for capturing errors and only supported on Flexera NAM
    if $$rs_optima_host == "api.optima.flexeraeng.com"
      # skip_error_and_append is used to catch error if rs_cm.audit_entries.create fails unexpectedly
      $task_label = "Creating audit entry for " + $subject
      sub task_label: $task, on_error: skip_error_and_append($task) do
        rs_cm.audit_entries.create(
          notify: "None",
          audit_entry: {
            auditee_href: @@account,
            summary: $subject,
            detail: $detail
          }
        )
      end # End sub on_error
    end # End if rs_optima_host
  end # End if debug is enabled
end

define skip_error_and_append($subject) do
  $$errors << "Unexpected error for " + $subject + "\n  " + to_s($_error)
  $_error_behavior = "skip"
end