Repository: cloud-custodian/cloud-custodian

Issue:
azure - rename keyvault-keys to keyvault-key
Plural form is not used anywhere else, so we should rename the resource.

There might be a notion of 'aliases' for resources, we should utilize it if available to avoid double registration and breaking changes.


Discussion:

Resolving patch:
diff --git a/tools/c7n_azure/c7n_azure/filters.py b/tools/c7n_azure/c7n_azure/filters.py
--- a/tools/c7n_azure/c7n_azure/filters.py
+++ b/tools/c7n_azure/c7n_azure/filters.py
@@ -996,7 +996,7 @@ class ParentFilter(Filter):
 
         policies:
           - name: kv-keys-from-tagged-keyvaults
-            resource: azure.keyvault-keys
+            resource: azure.keyvault-key
             filters:
               - type: parent
                 filter:
diff --git a/tools/c7n_azure/c7n_azure/resources/key_vault_keys.py b/tools/c7n_azure/c7n_azure/resources/key_vault_keys.py
--- a/tools/c7n_azure/c7n_azure/resources/key_vault_keys.py
+++ b/tools/c7n_azure/c7n_azure/resources/key_vault_keys.py
@@ -28,9 +28,9 @@
 log = logging.getLogger('custodian.azure.keyvault.keys')
 
 
-@resources.register('keyvault-keys')
+@resources.register('keyvault-key', aliases=['keyvault-keys'])
 class KeyVaultKeys(ChildResourceManager):
-    """Key Vault Keys Resource
+    """Key Vault Key Resource
 
     :example:
 
@@ -42,7 +42,7 @@ class KeyVaultKeys(ChildResourceManager):
           - name: keyvault-keys
             description:
               List all keys from 'keyvault_test' and 'keyvault_prod' vaults
-            resource: azure.keyvault-keys
+            resource: azure.keyvault-key
             filters:
               - type: keyvault
                 vaults:
@@ -59,7 +59,7 @@ class KeyVaultKeys(ChildResourceManager):
           - name: keyvault-keys
             description:
               List all keys that are older than 30 days
-            resource: azure.keyvault-keys
+            resource: azure.keyvault-key
             filters:
               - type: value
                 key: attributes.created
@@ -78,7 +78,7 @@ class KeyVaultKeys(ChildResourceManager):
           - name: keyvault-keys
             description:
               List all non-HSM keys
-            resource: azure.keyvault-keys
+            resource: azure.keyvault-key
             filters:
               - not:
                  - type: key-type


Test patch:
diff --git a/tools/c7n_azure/tests_azure/test_filters_parent.py b/tools/c7n_azure/tests_azure/test_filters_parent.py
--- a/tools/c7n_azure/tests_azure/test_filters_parent.py
+++ b/tools/c7n_azure/tests_azure/test_filters_parent.py
@@ -28,7 +28,7 @@ class ParentFilterTest(BaseTest):
     def test_schema(self):
         self.assertTrue(self.load_policy({
             'name': 'test-policy',
-            'resource': 'azure.keyvault-keys',
+            'resource': 'azure.keyvault-key',
             'filters': [
                 {'type': 'parent',
                  'filter': {
@@ -61,7 +61,7 @@ def test_verify_parent_filter(self):
             ),
             {
                 'name': 'test-policy',
-                'resource': 'azure.keyvault-keys',
+                'resource': 'azure.keyvault-key',
                 'filters': [
                     {'type': 'parent',
                      'filter': {
diff --git a/tools/c7n_azure/tests_azure/test_functional_filters_parent.py b/tools/c7n_azure/tests_azure/test_functional_filters_parent.py
--- a/tools/c7n_azure/tests_azure/test_functional_filters_parent.py
+++ b/tools/c7n_azure/tests_azure/test_functional_filters_parent.py
@@ -28,7 +28,7 @@ def tearDown(self, *args, **kwargs):
     def test_kv_has_keys(self):
         p = self.load_policy({
             'name': 'test-policy',
-            'resource': 'azure.keyvault-keys',
+            'resource': 'azure.keyvault-key',
             'filters': [
                 {'type': 'parent',
                  'filter': {
@@ -47,7 +47,7 @@ def test_kv_has_keys(self):
     def test_kv_has_0_keys(self):
         p = self.load_policy({
             'name': 'test-policy',
-            'resource': 'azure.keyvault-keys',
+            'resource': 'azure.keyvault-key',
             'filters': [
                 {'type': 'parent',
                  'filter': {
diff --git a/tools/c7n_azure/tests_azure/tests_resources/test_keyvault_keys.py b/tools/c7n_azure/tests_azure/tests_resources/test_keyvault_keys.py
--- a/tools/c7n_azure/tests_azure/tests_resources/test_keyvault_keys.py
+++ b/tools/c7n_azure/tests_azure/tests_resources/test_keyvault_keys.py
@@ -34,11 +34,21 @@ def test_key_vault_keys_schema_validate(self):
         }, validate=True)
         self.assertTrue(p)
 
+        p = self.load_policy({
+            'name': 'test-key-vault',
+            'resource': 'azure.keyvault-key',
+            'filters': [
+                {'type': 'keyvault', 'vaults': ['kv1', 'kv2']},
+                {'type': 'key-type', 'key-types': ['RSA', 'RSA-HSM', 'EC', 'EC-HSM']}
+            ]
+        }, validate=True)
+        self.assertTrue(p)
+
     @arm_template('keyvault.json')
     def test_key_vault_keys_keyvault(self):
         p = self.load_policy({
             'name': 'test-key-vault',
-            'resource': 'azure.keyvault-keys',
+            'resource': 'azure.keyvault-key',
             'filters': [
                 {
                     'type': 'parent',
@@ -58,7 +68,7 @@ def test_key_vault_keys_keyvault(self):
     def test_key_vault_keys_type(self):
         p = self.load_policy({
             'name': 'test-key-vault',
-            'resource': 'azure.keyvault-keys',
+            'resource': 'azure.keyvault-key',
             'filters': [
                 {
                     'type': 'key-type',