Add Azure Tag Key replacement policy pack. Closes #871

policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/README.md

@@ -0,0 +1,103 @@
+---
+categories: ["storage", "tagging"]
+primary_category: "tagging"
+---
+
+# Enforce Replace Incorrect Azure Tag Key on VM Scale Set
+
+Azure resource tags are case insensitive for key comparison, but they still preserve case information in the key. For instance, setting a key as cost_center will prevent the creation of another key as Cost_Center. However, when querying the API for resource tags, the key will be returned with the original casing (e.g., cost_center). This inconsistency can lead to confusion and errors, particularly when integrating with case-sensitive programming environments.
+
+The goal of this policy pack is to provide a solution for standardizing the case of Azure tag keys by detecting tags with inconsistent casing and automatically correcting them to the desired format.
+
+This [policy pack](https://turbot.com/guardrails/docs/concepts/policy-packs) can help you configure the following settings for Virtual Machine Scale Sets:
+
+- Enforce replacement of tag keys with incorrect case.
+
+- **[Review Policy settings →](https://hub.guardrails.turbot.com/policy-packs/enforce_replace_incorrect_tag_key_on_vm_scaleset/settings)**
+
+## Getting Started
+
+### Requirements
+
+- [Terraform](https://developer.hashicorp.com/terraform/install)
+- Guardrails mods:
+  - [@turbot/azure-compute](https://hub.guardrails.turbot.com/mods/azure/mods/azure-compute)
+
+### Credentials
+
+To create a policy pack through Terraform:
+
+- Ensure you have `Turbot/Admin` permissions (or higher) in Guardrails
+- [Create access keys](https://turbot.com/guardrails/docs/guides/iam/access-keys#generate-a-new-guardrails-api-access-key) in Guardrails
+
+And then set your credentials:
+
+```sh
+export TURBOT_WORKSPACE=myworkspace.acme.com
+export TURBOT_ACCESS_KEY=acce6ac5-access-key-here
+export TURBOT_SECRET_KEY=a8af61ec-secret-key-here
+```
+
+Please see [Turbot Guardrails Provider authentication](https://registry.terraform.io/providers/turbot/turbot/latest/docs#authentication) for additional authentication methods.
+
+## Usage
+
+### Install Policy Pack
+
+> [!NOTE]
+> By default, installed policy packs are not attached to any resources.
+>
+> Policy packs must be attached to resources in order for their policy settings to take effect.
+
+Clone:
+
+```sh
+git clone https://github.com/turbot/guardrails-samples.git
+cd guardrails-samples/policy_packs/azure/storage/enforce_cost_center_tag_transform_for_storage_accounts
+```
+
+Run the Terraform to create the policy pack in your workspace:
+
+```sh
+terraform init
+terraform plan
+```
+
+Then apply the changes:
+
+```sh
+terraform apply
+```
+
+### Apply Policy Pack
+
+Log into your Guardrails workspace and [attach the policy pack to a resource](https://turbot.com/guardrails/docs/guides/policy-packs#attach-a-policy-pack-to-a-resource).
+
+If this policy pack is attached to a Guardrails folder, its policies will be applied to all accounts and resources in that folder. The policy pack can also be attached to multiple resources.
+
+For more information, please see [Policy Packs](https://turbot.com/guardrails/docs/concepts/policy-packs).
+
+### Enable Enforcement
+
+> [!TIP]
+> You can also update the policy settings in this policy pack directly in the Guardrails console.
+>
+> Please note your Terraform state file will then become out of sync and the policy settings should then only be managed in the console.
+
+By default, the policies are set to `Check` in the pack's policy settings. To enable automated enforcements, you can switch these policies settings by adding a comment to the `Check` setting and removing the comment from one of the listed enforcement options:
+
+```hcl
+resource "turbot_policy_setting" "azure_storage_storage_account_tags" {
+  resource = turbot_policy_pack.main.id
+  type     = "tmod:@turbot/azure-storage#/policy/types/storageAccountTags"
+  # value    = "Check: Tags are correct"
+  value    = "Enforce: Set tags"
+}
+```
+
+Then re-apply the changes:
+
+```sh
+terraform plan
+terraform apply
+```

policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/main.tf

@@ -0,0 +1,5 @@
+resource "turbot_policy_pack" "main" {
+  title       = "Enforce Replace Incorrect Azure Tag Key on VM Scale Set"
+  description = "This policy pack corrects inconsistent casing in Azure resource tag keys to ensure consistency."
+  akas        = ["azure_compute_enforce_replace_incorrect_tag_key_on_vm_scaleset"]
+}

policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/policies.tf

@@ -0,0 +1,47 @@
+# Azure > Compute > VM Scale Set > Tags
+resource "turbot_policy_setting" "azure_compute_virtual_machine_scale_set_tags" {
+  resource = turbot_policy_pack.main.id
+  type     = "tmod:@turbot/azure-compute#/policy/types/virtualMachineScaleSetTags"
+  value    = "Check: Tags are correct"
+  # value    = "Enforce: Set tags"
+}
+
+# Azure > Compute > VM Scale Set > Tags > Template
+resource "turbot_policy_setting" "azure_compute_virtual_machine_scale_set_tags_template" {
+  resource       = turbot_policy_pack.main.id
+  type           = "tmod:@turbot/azure-compute#/policy/types/virtualMachineScaleSetTagsTemplate"
+  template_input = <<-EOT
+    { 
+      resource {
+        turbot {
+          tags
+        }
+      }
+    }
+    EOT
+  template       = <<-EOT
+    {%- set cleanTags = [ "Cost_Center" ] -%}
+    {%- set tag_map = {} -%}
+    {%- if $.resource.turbot.tags -%}
+      {%- for clean_tag_key in cleanTags -%}
+        {%- set found_tag = false -%}
+        {%- for curr_tag_key, curr_tag_value in $.resource.turbot.tags -%}
+          {%- if ((curr_tag_key | lower) == (clean_tag_key | lower)) -%}
+            {%- set found_tag = true -%}
+            {%- if curr_tag_key != clean_tag_key -%}
+              {%- set tag_map = setAttribute(tag_map, curr_tag_key, null) -%}
+            {%- endif -%}
+          {%- endif -%}
+        {%- endfor -%}
+        {%- if not found_tag -%}
+          {%- set tag_map = setAttribute(tag_map, clean_tag_key, "abc123") -%}
+        {%- endif -%}
+      {%- endfor -%}
+    {%- endif -%}
+    {%- if tag_map | length < 1 -%}
+    []
+    {%- else -%}
+    {{ tag_map | json }}
+    {%- endif -%}
+    EOT
+}

policy_packs/azure/compute/enforce_replace_incorrect_tag_key_on_vm_scaleset/providers.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    turbot = {
+      source  = "turbot/turbot"
+      version = ">= 1.11.0"
+    }
+  }
+}
+
+provider "turbot" {
+}