Skip to content

AWS Tag compliance Codebundle#15

Open
saurabh3460 wants to merge 65 commits intorunwhen-contrib:mainfrom
infracloudio:tag-compliance
Open

AWS Tag compliance Codebundle#15
saurabh3460 wants to merge 65 commits intorunwhen-contrib:mainfrom
infracloudio:tag-compliance

Conversation

@saurabh3460
Copy link
Copy Markdown
Contributor

@saurabh3460 saurabh3460 commented Jan 31, 2025

The SLI produces a score of 0 (bad), 1(good), or a value in between. This score is generated by capturing the following:

  • Tag compliance for ${AWS_RESOURCE_PROVIDERS}

saurabh3460 and others added 30 commits November 20, 2024 17:14
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code under .test doesn't appear to be valid for this codebundle. At a minumum the .test folder needs a README.md that specifies how to set up a scenario to verify the codebundle. This appears to not be updated for this scenario.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added a note like this:

  1. Build Test Infrastructure:
    • Note: By default, the test environment leverages existing AWS resources such as VPCs and Security Groups that are untagged. These resources are sufficient to test the codebundle's tagging compliance functionality.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you think this function is useful across other CodeBundles, we may consider moving it into the keyword.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't seen or needed this in other CodeBundles so far, if I see anywhere it's required will definitely move to cloudcustodian core lib

Comment thread codebundles/aws-c7n-tag-compliance/runbook.robot
Comment thread codebundles/aws-c7n-tag-compliance/runbook.robot Outdated
Comment thread codebundles/aws-c7n-tag-compliance/sli.robot
Comment thread codebundles/aws-c7n-tag-compliance/sli.robot Outdated
Comment thread codebundles/aws-c7n-tag-compliance/runbook.robot Outdated
... pattern=^[a-zA-Z0-9,]+$
... example=ec2,rds,vpc,iam-group,iam-policy,iam-user,security-group
... default=ec2,rds,vpc,iam-group,iam-policy,iam-user,security-group
${AWS_RESOURCE_PROVIDERS_ID_MAPPINGS}= RW.Core.Import User Variable AWS_RESOURCE_PROVIDERS_ID_MAPPINGS
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of this? If it's needed, why doesn't it exist in the SLI? If it isn't needed, or is predictable and well known or assumed, can we remove it from the configuration?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated it now loading it through a json file that contains resource-id mapping.

@saurabh3460
Copy link
Copy Markdown
Contributor Author

@stewartshea we can review it, added simple EC2 infra

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might need a rebase, this will likely cause merge conflicts

@stewartshea
Copy link
Copy Markdown
Contributor

A few overall comments @saurabh3460 :

  • We need more "Add Pre to Report" content regarding report output, not just for issues

For scope / Issue output

  • Can we ensure that these checks only run against regions that have active resources? My small environment produced 41 issues, mostly with details about regions I don't use
  • Is it possible to group the issues by region? The amount of issues generated feels pretty large, and I suspect we could just include a list of all resources that need attention in the issue details / report, with a next step that says "Apply missing tags Name, Environment, Owner to resources in AWS region ap-northeast-3 and AWS account 982534371594" - and then the report / issue details contains a table formatted list of all resources that are missing these details?

image

@saurabh3460
Copy link
Copy Markdown
Contributor Author

A few overall comments @saurabh3460 :

  • We need more "Add Pre to Report" content regarding report output, not just for issues

For scope / Issue output

  • Can we ensure that these checks only run against regions that have active resources? My small environment produced 41 issues, mostly with details about regions I don't use
  • Is it possible to group the issues by region? The amount of issues generated feels pretty large, and I suspect we could just include a list of all resources that need attention in the issue details / report, with a next step that says "Apply missing tags Name, Environment, Owner to resources in AWS region ap-northeast-3 and AWS account 982534371594" - and then the report / issue details contains a table formatted list of all resources that are missing these details?

image

Sure, I have tried to improve it, please have a look

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants