diff --git a/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/README.md b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/README.md new file mode 100644 index 00000000..8e638524 --- /dev/null +++ b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/README.md @@ -0,0 +1,103 @@ +--- +categories: ["storage", "tagging"] +primary_category: "tagging" +--- + +# Enforce Replace Incorrect Azure Tag Key on VM Scale Set + +Azure resource tags are case insensitive for key comparison, but they still preserve case information in the key. For instance, setting a key as cost_center will prevent the creation of another key as Cost_Center. However, when querying the API for resource tags, the key will be returned with the original casing (e.g., cost_center). This inconsistency can lead to confusion and errors, particularly when integrating with case-sensitive programming environments. + +The goal of this policy pack is to provide a solution for standardizing the case of Azure tag keys by detecting tags with inconsistent casing and automatically correcting them to the desired format. + +This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for Virtual Machine Scale Sets: + +- Enforce replacement of tag keys with incorrect case. + +- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/enforce_replace_incorrect_tag_key_on_vm_scaleset/settings)** + +## Getting Started + +### Requirements + +- [Terraform](https://developer.hashicorp.com/terraform/install) +- Guardrails mods: + - [@turbot/azure-compute](https://hub.guardrails.turbot.com/mods/azure/mods/azure-compute) + +### Credentials + +To create a policy pack through Terraform: + +- Ensure you have `Turbot/Admin` permissions (or higher) in Guardrails +- [Create access keys](https://turbot.com/guardrails/docs/guides/iam/access-keys#generate-a-new-guardrails-api-access-key) in Guardrails + +And then set your credentials: + +```sh +export TURBOT_WORKSPACE=myworkspace.acme.com +export TURBOT_ACCESS_KEY=acce6ac5-access-key-here +export TURBOT_SECRET_KEY=a8af61ec-secret-key-here +``` + +Please see [Turbot Guardrails Provider authentication](https://registry.terraform.io/providers/turbot/turbot/latest/docs#authentication) for additional authentication methods. + +## Usage + +### Install Policy Pack + +> [!NOTE] +> By default, installed policy packs are not attached to any resources. +> +> Policy packs must be attached to resources in order for their policy settings to take effect. + +Clone: + +```sh +git clone https://github.com/turbot/guardrails-samples.git +cd guardrails-samples/policy_packs/azure/storage/enforce_cost_center_tag_transform_for_storage_accounts +``` + +Run the Terraform to create the policy pack in your workspace: + +```sh +terraform init +terraform plan +``` + +Then apply the changes: + +```sh +terraform apply +``` + +### Apply Policy Pack + +Log into your Guardrails workspace and [attach the policy pack to a resource](https://turbot.com/guardrails/docs/guides/policy-packs#attach-a-policy-pack-to-a-resource). + +If this policy pack is attached to a Guardrails folder, its policies will be applied to all accounts and resources in that folder. The policy pack can also be attached to multiple resources. + +For more information, please see [Policy Packs](https://turbot.com/guardrails/docs/concepts/policy-packs). + +### Enable Enforcement + +> [!TIP] +> You can also update the policy settings in this policy pack directly in the Guardrails console. +> +> Please note your Terraform state file will then become out of sync and the policy settings should then only be managed in the console. + +By default, the policies are set to `Check` in the pack's policy settings. To enable automated enforcements, you can switch these policies settings by adding a comment to the `Check` setting and removing the comment from one of the listed enforcement options: + +```hcl +resource "turbot_policy_setting" "azure_storage_storage_account_tags" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-storage#/policy/types/storageAccountTags" + # value = "Check: Tags are correct" + value = "Enforce: Set tags" +} +``` + +Then re-apply the changes: + +```sh +terraform plan +terraform apply +``` diff --git a/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/main.tf b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/main.tf new file mode 100644 index 00000000..3cc8a4ed --- /dev/null +++ b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/main.tf @@ -0,0 +1,5 @@ +resource "turbot_policy_pack" "main" { + title = "Enforce Replace Incorrect Azure Tag Key on VM Scale Set" + description = "This policy pack corrects inconsistent casing in Azure resource tag keys to ensure consistency." + akas = ["azure_compute_enforce_replace_incorrect_tag_key_on_vm_scaleset"] +} diff --git a/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/policies.tf b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/policies.tf new file mode 100644 index 00000000..6b923bdb --- /dev/null +++ b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/policies.tf @@ -0,0 +1,47 @@ +# Azure > Compute > VM Scale Set > Tags +resource "turbot_policy_setting" "azure_compute_virtual_machine_scale_set_tags" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-compute#/policy/types/virtualMachineScaleSetTags" + value = "Check: Tags are correct" + # value = "Enforce: Set tags" +} + +# Azure > Compute > VM Scale Set > Tags > Template +resource "turbot_policy_setting" "azure_compute_virtual_machine_scale_set_tags_template" { + resource = turbot_policy_pack.main.id + type = "tmod:@turbot/azure-compute#/policy/types/virtualMachineScaleSetTagsTemplate" + template_input = <<-EOT + { + resource { + turbot { + tags + } + } + } + EOT + template = <<-EOT + {%- set cleanTags = [ "Cost_Center" ] -%} + {%- set tag_map = {} -%} + {%- if $.resource.turbot.tags -%} + {%- for clean_tag_key in cleanTags -%} + {%- set found_tag = false -%} + {%- for curr_tag_key, curr_tag_value in $.resource.turbot.tags -%} + {%- if ((curr_tag_key | lower) == (clean_tag_key | lower)) -%} + {%- set found_tag = true -%} + {%- if curr_tag_key != clean_tag_key -%} + {%- set tag_map = setAttribute(tag_map, curr_tag_key, null) -%} + {%- endif -%} + {%- endif -%} + {%- endfor -%} + {%- if not found_tag -%} + {%- set tag_map = setAttribute(tag_map, clean_tag_key, "abc123") -%} + {%- endif -%} + {%- endfor -%} + {%- endif -%} + {%- if tag_map | length < 1 -%} + [] + {%- else -%} + {{ tag_map | json }} + {%- endif -%} + EOT +} \ No newline at end of file diff --git a/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/providers.tf b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/providers.tf new file mode 100644 index 00000000..3ede1821 --- /dev/null +++ b/policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/providers.tf @@ -0,0 +1,11 @@ +terraform { + required_providers { + turbot = { + source = "turbot/turbot" + version = ">= 1.11.0" + } + } +} + +provider "turbot" { +}