POL-975 Google Old Snapshots Revamp / Meta Policy (#1649)

* first pass

* tweak

* update

* tweaks

* update

* tweak

* update

* update

* fix

* fix

cost/google/old_snapshots/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v3.0
+
+- Several parameters altered to be more descriptive and human-readable
+- Removed deprecated "Log to CM Audit Entries" parameter
+- Added ability to filter resources by project
+- Added ability to use wildcards when filtering resources by label
+- Added additional context to incident description
+- Normalized incident export to be consistent with other policies
+- Added human-readable recommendation to incident export
+- Added additional fields to incident export
+- Streamlined code for better readability and faster execution
+- Policy now requires a valid Flexera One credential
+
 ## v2.12
 
 - Modified `sys_log` definition to disable `rs_cm.audit_entry.create` outside Flexera NAM

cost/google/old_snapshots/README.md

@@ -1,45 +1,56 @@
 # Google Old Snapshots
 
-## What it does
+## What It Does
 
-This Policy finds Google snapshots older than the specified days and deletes them.
+This policy finds Google snapshots older than the specified number of days and raises an incident with a list of said snapshots. Optionally, it will delete them.
+
+## Functional Details
+
+The policy makes use of the Google Cloud Compute API to obtain a list of snapshots and their ages in order to produce a list of recommendations.
 
 ## Input Parameters
 
 This policy has the following input parameters required when launching the policy.
 
-- *Email addresses* - A list of email addresses to notify
-- *Snapshot age* - The number of days since the snapshot was created.
-- *Exclusion Label List* - list of tags that a snapshot can have to exclude it from the list.
+- *Email Addresses* - A list of email addresses to notify
+- *Snapshot Age Threshold* - The number of days since the snapshot was created to consider a snapshot old.
+- *Allow/Deny Projects* - Whether to treat Allow/Deny Projects List parameter as allow or deny list. Has no effect if Allow/Deny Projects List is left empty.
+- *Allow/Deny Projects List* - Filter results by project ID/name, either only allowing this list or denying it depending on how the above parameter is set. Leave blank to consider all projects.
+- *Exclusion Labels (Key:Value)* - Google labels to ignore resources that you don't want to produce recommendations for. Use Key:Value format for specific label key/value pairs, and Key:\* format to match any resource with a particular key, regardless of value. Examples: env:production, DO_NOT_DELETE:\*
 - *Automatic Actions* - When this value is set, this policy will automatically take the selected action(s).
 
 Please note that the "Automatic Actions" parameter contains a list of action(s) that can be performed on the resources. When it is selected, the policy will automatically execute the corresponding action on the data that failed the checks, post incident generation. Please leave it blank for *manual* action.
-For example if a user selects the "Delete Snapshots" action while applying the policy, all the snapshots that didn't satisfy the policy condition will be deleted.
+For example, if a user selects the "Delete Snapshots" action while applying the policy, all old snapshots will be deleted.
 
 ## Policy Actions
 
 The following policy actions are taken on any resources found to be out of compliance.
 
 - Send an email report
-- Delete old snapshots after an approval
+- Delete old snapshots after approval
 
 ## Prerequisites
 
-This policy uses [credentials](https://docs.flexera.com/flexera/EN/Automation/ManagingCredentialsExternal.htm) for connecting to the cloud -- in order to apply this policy you must have a credential registered in the system that is compatible with this policy. If there are no credentials listed when you apply the policy, please contact your cloud admin and ask them to register a credential that is compatible with this policy. The information below should be consulted when creating the credential.
+This Policy Template requires that several APIs be enabled in your Google Cloud environment:
+
+- [Cloud Resource Manager API](https://console.cloud.google.com/flows/enableapi?apiid=cloudresourcemanager.googleapis.com)
+- [Compute Engine API](https://console.cloud.google.com/flows/enableapi?apiid=compute.googleapis.com)
 
-### Credential configuration
+This Policy Template uses [Credentials](https://docs.flexera.com/flexera/EN/Automation/ManagingCredentialsExternal.htm) for authenticating to datasources -- in order to apply this policy you must have a Credential registered in the system that is compatible with this policy. If there are no Credentials listed when you apply the policy, please contact your Flexera Org Admin and ask them to register a Credential that is compatible with this policy. The information below should be consulted when creating the credential(s).
 
-For administrators [creating and managing credentials](https://docs.flexera.com/flexera/EN/Automation/ManagingCredentialsExternal.htm) to use with this policy, the following information is needed:
+- [**Google Cloud Credential**](https://docs.flexera.com/flexera/EN/Automation/ProviderCredentials.htm#automationadmin_4083446696_1121577) (*provider=gce*) which has the following:
+  - Permissions
+    - `resourcemanager.projects.get`
+    - `compute.snapshots.get`
+    - `compute.snapshots.list`
+    - `compute.snapshots.delete`*
 
-Provider tag value to match this policy: `gce`
+\* Only required for taking action; the policy will still function in a read-only capacity without these permissions.
 
-Required permissions in the provider:
+- [**Flexera Credential**](https://docs.flexera.com/flexera/EN/Automation/ProviderCredentials.htm) (*provider=flexera*) which has the following roles:
+  - `billing_center_viewer`
 
-- The `compute.snapshots.delete` permission
-- The `compute.snapshots.list` permission
-- The `compute.snapshots.get` permission
-- The `compute.regions.list` permission
-- The `resourcemanager.projects.get` permission
+The [Provider-Specific Credentials](https://docs.flexera.com/flexera/EN/Automation/ProviderCredentials.htm) page in the docs has detailed instructions for setting up Credentials for the most common providers.
 
 ## Supported Clouds