gcp_vpc_sc_ensure_project_v1.yaml

# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
  name: gcp-vpc-sc-ensure-project-v1
spec:
  crd:
    spec:
      names:
        kind: GCPVPCSCEnsureProjectConstraintV1
      validation:
        openAPIV3Schema:
          properties:
            required_projects:
              description: "Required project IDs"
              type: array
              items:
                type: string
  targets:
    validation.gcp.forsetisecurity.org:
      rego: | #INLINE("validator/vpc_sc_ensure_project.rego")
             #
             # Copyright 2019 Google LLC
             #
             # Licensed under the Apache License, Version 2.0 (the "License");
             # you may not use this file except in compliance with the License.
             # You may obtain a copy of the License at
             #
             #      http://www.apache.org/licenses/LICENSE-2.0
             #
             # Unless required by applicable law or agreed to in writing, software
             # distributed under the License is distributed on an "AS IS" BASIS,
             # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
             # See the License for the specific language governing permissions and
             # limitations under the License.
             #
             
             package templates.gcp.GCPVPCSCEnsureProjectConstraintV1
             
             import data.validator.gcp.lib as lib
             
             deny[{
             	"msg": message,
             	"details": metadata,
             }] {
             	constraint := input.constraint
             	asset := input.asset
             
             	asset.asset_type == "cloudresourcemanager.googleapis.com/Organization"
             	lib.has_field(asset, "service_perimeter")
             
             	lib.get_constraint_params(constraint, params)
             	required_projects_array := lib.get_default(params, "required_projects", [])
             	required_projects := {sprintf("projects/%v", [p]) | p = required_projects_array[_]}
             
             	perimeter_resources := {r | r = asset.service_perimeter.status.resources[_]}
             
             	count(perimeter_resources - required_projects) != count(perimeter_resources) - count(required_projects)
             
             	message := sprintf("Required project missing from service perimeter %v.", [asset.service_perimeter.name])
             
             	metadata := {"resource": asset.name, "service_perimeter_name": asset.service_perimeter.name}
             }
             #ENDINLINE