gcp_vpc_sc_ensure_services_v1.yaml

# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

apiVersion: templates.gatekeeper.sh/v1alpha1
kind: ConstraintTemplate
metadata:
  name: gcp-vpc-sc-ensure-services-v1
spec:
  crd:
    spec:
      names:
        kind: GCPVPCSCEnsureServicesConstraintV1
      validation:
        openAPIV3Schema:
          properties:
            required_services:
              description: "Required services type URIs"
              type: array
              items:
                type: string
  targets:
    validation.gcp.forsetisecurity.org:
      rego: | #INLINE("validator/vpc_sc_ensure_services.rego")
             #
             # Copyright 2019 Google LLC
             #
             # Licensed under the Apache License, Version 2.0 (the "License");
             # you may not use this file except in compliance with the License.
             # You may obtain a copy of the License at
             #
             #      http://www.apache.org/licenses/LICENSE-2.0
             #
             # Unless required by applicable law or agreed to in writing, software
             # distributed under the License is distributed on an "AS IS" BASIS,
             # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
             # See the License for the specific language governing permissions and
             # limitations under the License.
             #
             
             package templates.gcp.GCPVPCSCEnsureServicesConstraintV1
             
             import data.validator.gcp.lib as lib
             
             deny[{
             	"msg": message,
             	"details": metadata,
             }] {
             	constraint := input.constraint
             	asset := input.asset
             
             	asset.asset_type == "cloudresourcemanager.googleapis.com/Organization"
             	lib.has_field(asset, "service_perimeter")
             
             	lib.get_constraint_params(constraint, params)
             	required_services_array := lib.get_default(params, "required_services", [])
             	required_services := {p | p = required_services_array[_]}
             
             	perimeter_services := {r | r = asset.service_perimeter.status.restricted_services[_]}
             
             	missing_services = required_services - perimeter_services
             
             	count(missing_services) > 0
             
             	message := sprintf("Required services %v missing from service perimeter: %v.", [concat(", ", missing_services), asset.service_perimeter.name])
             	metadata := {"resource": asset.name, "service_perimeter_name": asset.service_perimeter.name, "missing_services": missing_services}
             }
             #ENDINLINE