Aplicando Políticas de Tagging entre Nuvens

{
  "tags": {
    "team": {
      "tag_key": { "@@assign": "team" },
      "tag_value": {
        "@@assign": ["payments", "identity", "growth", "platform", "data"]
      },
      "enforced_for": {
        "@@assign": [
          "ec2:instance",
          "rds:db",
          "s3:bucket",
          "lambda:function"
        ]
      }
    },
    "environment": {
      "tag_key": { "@@assign": "environment" },
      "tag_value": {
        "@@assign": ["prod", "staging", "dev", "sandbox"]
      }
    },
    "cost-center": {
      "tag_key": { "@@assign": "cost-center" }
    }
  }
}

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "tags['team']",
          "exists": "false"
        },
        {
          "field": "type",
          "notIn": [
            "Microsoft.Resources/deployments",
            "Microsoft.Resources/deploymentScripts"
          ]
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

# Reject plans that create GCP resources without required labels
package terraform.gcp.tagging

required_labels := {"team", "environment", "cost-center"}

deny[msg] {
  resource := input.resource_changes[_]
  startswith(resource.type, "google_")
  resource.change.actions[_] == "create"

  labels := object.get(resource.change.after, "labels", {})
  missing := required_labels - {k | labels[k]}
  count(missing) > 0

  msg := sprintf(
    "%s '%s' is missing required labels: %v",
    [resource.type, resource.address, missing]
  )
}