gcp_enforce_labels_v1.yaml

# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
  name: gcp-enforce-labels-v1
spec:
  crd:
    spec:
      names:
        kind: GCPEnforceLabelConstraintV1
      validation:
        openAPIV3Schema:
          required: ["mandatory_labels"]
          properties:
            mandatory_labels:
              description: |
                "List of mandatory label objects to check for on all supported resources.
                Label objects should be as follow:
                label_key: label_value_regex_to_match
                Each missing label will result in a violation for scanned resources.
                Each mismatching label will result in a violation for scanned resources.
                "
              type: array
              items:
                type: object
            resource_types_to_scan:
              description: |
                "Optional parameter: list of resource types to scan for labels.
                Any resource that is not of these types will not raise any violation.

                If not passed, all tested resource types will be scanned for violations:

                - cloudresourcemanager.googleapis.com/Project
                - storage.googleapis.com/Bucket
                - compute.googleapis.com/Instance
                - compute.googleapis.com/Image
                - compute.googleapis.com/Disk
                - compute.googleapis.com/Snapshot
                - bigtableadmin.googleapis.com/Instance
                - sqladmin.googleapis.com/Instance
                - dataproc.googleapis.com/Job
                - dataproc.googleapis.com/Cluster
                - container.googleapis.com/Cluster
                - bigquery.googleapis.com/Dataset
                - bigquery.googleapis.com/Table

                Note: bigQuery Views have actually the bigquery.googleapis.com/Table resource type.

                If a resource type passed is not part of this list, the labels will be
                looked for in the data.labels key of the resource object.
                "
              type: array
              items:
                type: string
  targets:
    validation.gcp.forsetisecurity.org:
      rego: | #INLINE("validator/enforce_labels.rego")
       #
       # Copyright 2019 Google LLC
       #
       # Licensed under the Apache License, Version 2.0 (the "License");
       # you may not use this file except in compliance with the License.
       # You may obtain a copy of the License at
       #
       #      http://www.apache.org/licenses/LICENSE-2.0
       #
       # Unless required by applicable law or agreed to in writing, software
       # distributed under the License is distributed on an "AS IS" BASIS,
       # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
       # See the License for the specific language governing permissions and
       # limitations under the License.
       #
       
       package templates.gcp.GCPEnforceLabelConstraintV1
       
       import data.validator.gcp.lib as lib
       
       deny[{
       	"msg": message,
       	"details": metadata,
       }] {
       	constraint := input.constraint
       	lib.get_constraint_params(constraint, params)
       	asset := input.asset
       
       	# test if we have a valid resource
       	resource := asset.resource.data
       
       	mandatory_label := params.mandatory_labels[_]
       	label_value_pattern := mandatory_label[label_key]
       
       	default_resource_types := {
       		"cloudresourcemanager.googleapis.com/Project",
       		"storage.googleapis.com/Bucket",
       		"compute.googleapis.com/Instance",
       		"compute.googleapis.com/Image",
       		"compute.googleapis.com/Disk",
       		"compute.googleapis.com/Snapshot",
       		"bigtableadmin.googleapis.com/Instance",
       		"sqladmin.googleapis.com/Instance",
       		"dataproc.googleapis.com/Job",
       		"dataproc.googleapis.com/Cluster",
       		"container.googleapis.com/Cluster",
       		"bigquery.googleapis.com/Dataset",
       		"bigquery.googleapis.com/Table",
       		"spanner.googleapis.com/Instance",
       	}
       
       	non_standard_types := {"sqladmin.googleapis.com/Instance", "container.googleapis.com/Cluster", "spanner.googleapis.com/Instance"}
       
       	resource_types_to_scan := lib.get_default(params, "resource_types_to_scan", default_resource_types)
       
       	# test if resource needs to be scanned
       	resource_types_to_scan[_] == asset.asset_type
       
       	not label_is_valid(label_key, label_value_pattern, asset, non_standard_types)
       
       	message := sprintf("%v's label '%v' is in violation.", [asset.name, label_key])
       	metadata := {"resource": asset.name, "label_in_violation": label_key}
       }
       
       # check if label exists and if its value matches the pattern passed as a parameter for all resources to scan
       label_is_valid(label_key, label_value_pattern, asset, non_standard_types) {
       	# retrieve the right values from asset
       	resource_labels := get_labels(asset, non_standard_types)
       
       	# test if label exists in asset
       	resource_labels[label_key]
       
       	# test if label value matches pattern passed as a parameter
       	re_match(label_value_pattern, resource_labels[label_key])
       }
       
       # get_labels for cloudsql instances
       get_labels(asset, non_standard_types) = resource_labels {
       	# check if we have a non-standard type
       	asset.asset_type == non_standard_types[_]
       	asset.asset_type == "sqladmin.googleapis.com/Instance"
       	resource := asset.resource.data.settings
       	resource_labels := lib.get_default(resource, "userLabels", {})
       }
       
       # get_labels for gke cluster
       get_labels(asset, non_standard_types) = resource_labels {
       	# check if we have a non-standard type
       	asset.asset_type == non_standard_types[_]
       	asset.asset_type == "container.googleapis.com/Cluster"
       	resource := asset.resource.data
       	resource_labels := lib.get_default(resource, "resourceLabels", {})
       }
       
       # get_labels for Spanner Instances. API format.
       # This method matches data generated by Terraform Validator and other
       # tools that use the API format to represent resources.
       get_labels(asset, non_standard_types) = resource_labels {
       	asset.asset_type == "spanner.googleapis.com/Instance"
       
       	# Labels in API are within a "instance" structure.
       	lib.has_field(asset.resource.data, "instance")
       	resource := asset.resource.data.instance
       	resource_labels := lib.get_default(resource, "labels", {})
       }
       
       # get_labels for Spanner Instances. CAI format.
       # This method matches data generated by CAI, where the API
       # format has been simplified.
       get_labels(asset, non_standard_types) = resource_labels {
       	asset.asset_type == "spanner.googleapis.com/Instance"
       
       	# Labels in CAI are added as resource.data directly.
       	not lib.has_field(asset.resource.data, "instance")
       
       	resource := asset.resource.data
       	resource_labels := lib.get_default(resource, "labels", {})
       }
       
       # get_labels for most resources (not non-standard resources)
       # this defaults to asset.resource.data.labels
       get_labels(asset, non_standard_types) = resource_labels {
       	asset_type := asset.asset_type
       	not non_standard_types[asset_type]
       	resource := asset.resource.data
       	resource_labels := lib.get_default(resource, "labels", {})
       }
       #ENDINLINE