Package: probator-auditor-required-tags
probator-auditor-required-tagsPlease open issues in theProbatorrepositoryDescriptionThis auditor reviews, alerts and potentially takes action on AWS objects that are found not to be compliant with the tagging requirements.Configuration OptionsOption nameDefault ValueTypeDescriptionalert_settingsSee notes belowJSONAlert and enforcement settings for supported resourcesalways_send_emailTrueboolSend emails even in collect modeaudit_ignore_tagprobator:ignorestringProbator will ignore alerting/enforcement if resources are tagged with thisaudit_scopeaws_ec2_instancestringSelect resources (aws_ec2_instance, aws_s3_bucket)collect_onlyTrueboolDo not shutdown resources, only update cachesconfirm_shutdownTrueboolRequire manual confirmation before shutting down instancesemail_subjectResources missing required tagsstringSubject of the new issues email notificationsenabledFalseboolEnable the Required Tags auditorinterval30intHow often the auditor executes, in minutespartial_owner_matchFalseboolAllow partial matches of the Owner tagpermanent_recipient[]arrayList of email addresses to receive all alertsrequired_tags['owner', 'accounting', 'name']arrayList of required tagsExamplealert_settings:{"global":{"actions":[{"name":"alert:1","age":"now","action":"alert","order":0},{"name":"alert:2","age":"3 weeks","action":"alert","order":1},{"name":"alert:3","age":"3 weeks, 6 days","action":"alert","order":2},{"name":"stop","age":"4 weeks","action":"stop","order":3},{"name":"remove","age":"12 weeks","action":"remove","order":4}],"requiredTags":{"Name":null,"owner":"([a-zA-Z0-9._%+-]+[^+]@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})"},"extraConfig":{}},"aws_ec2_instance":{"requiredTags":{"ssmEnabled":"^(true|false)$"}}}Theglobalsection is applied to all resources, with some restrictions that we will cover in the detail sections below. In addition to theglobalsection, you can also define additional tags for some resource types or override theactionsto use a different schedule for
specific resource typesactionsTheactionsblock defines the set of actions to be taken. Using the example above, we can see that there are a total of 5 actions that
will be taken for all resources.Upon detection, send an alert immediately (age=now)After 3 weeks, send another alertAfter another 6 days, send a third alertAfter 4 weeks, stop the instance (also sends a notification)Finally after 12 weeks, remove the resource (also sends a notification)Actions can be overridden for specific resources, however if you provide a new action schedule, the global schedule will be ignored for the
resource type.Valid action typesCurrently only three types of actions are supported:alert,stopandremove.alertSends a notification to each of the registered owners for the resource accountstopStops the resource, if applicable. As an example, this will stop an EC2 Instance if it is running. The state of the resource will be
evaluated on each execution of the auditor, so if the resource is started again the stop action will be applied againremoveDeletes the resource completely, for example if the resource is an EC2 Instance, it will be terminated.required_tagsTherequired_tagsis a dictionary like object, where the keys are the names of the tags and the value is a regular expression pattern that
will be used to validate the tag value of the resource. If a tag fails to match the provided regular expression, the resource will be marked
as not compliant, with a note detailing that the tag failed matching the regular expression.If any value is valid, you can provide annullvalue instead of a regular expression, to avoid any matching from happening, instead of
using a blank / global expression such as.*extra_configThis section can be used to provide extra information that may be needed to validate a tag. At this time, this is not actively used by the
base auditor functions, but can be helpful in cases where you implement custom action methodsImplementing action methodsAction methods are simple methods which accept a single argument being theResourceobject that the action needs to be performed on. Seeprobator_auditor_required_tags/actions.pyfor example implementations.Action methods are dynamically loaded using entry points defined insetup.py, in the namespaceprobator_auditor_required_tags.actions. The name of the entry point must be<resource_type>_<action>. For example the action to remove
an S3 bucket would beaws_s3_bucket_remove.