feat(obligatron): Augment tagging results with AMI info

packages/common/prisma/migrations/20240620104500_obligatron_ec2_images_access/migration.sql

@@ -0,0 +1 @@
+GRANT SELECT ON public.aws_ec2_images TO obligatron;

packages/common/prisma/schema.prisma

@@ -84,7 +84,6 @@ model aws_ec2_images {
   virtualization_type   String?
 
   @@id([account_id, region, arn], map: "aws_ec2_images_cqpk")
-  @@ignore
 }
 
 model aws_ec2_instances {

packages/obligatron/src/index.ts

@@ -1,8 +1,12 @@
+import type { PrismaClient } from '@prisma/client';
 import { getPrismaClient } from 'common/database';
 import { config } from 'dotenv';
 import { getConfig } from './config';
 import type { ObligationResult } from './obligations';
-import { evaluateTaggingObligation } from './obligations/tagging';
+import {
+	evaluateAmiTaggingCoverage,
+	evaluateSecurityHubTaggingCoverage,
+} from './obligations/tagging';
 
 config({ path: `../../.env` }); // Load `.env` file at the root of the repository
 
@@ -12,6 +16,20 @@ const stringIsObligation = (input: string): input is Obligation => {
 	return Obligations.filter((v) => v === input).length > 0;
 };
 
+async function getResults(
+	obligation: Obligation,
+	db: PrismaClient,
+): Promise<ObligationResult[]> {
+	switch (obligation) {
+		case 'TAGGING': {
+			return [
+				...(await evaluateSecurityHubTaggingCoverage(db)),
+				...(await evaluateAmiTaggingCoverage(db)),
+			];
+		}
+	}
+}
+
 export async function main(obligation: string) {
 	if (!stringIsObligation(obligation)) {
 		throw new Error(
@@ -38,13 +56,7 @@ export async function main(obligation: string) {
 		message: 'Starting to process obligation resources',
 	});
 
-	let results: ObligationResult[];
-
-	switch (obligation) {
-		case 'TAGGING': {
-			results = await evaluateTaggingObligation(db);
-		}
-	}
+	const results: ObligationResult[] = await getResults(obligation, db);
 
 	console.log({
 		message: 'Finished processing obligation resources, saving results to DB.',

packages/obligatron/src/obligations/tagging.test.ts

@@ -1,5 +1,5 @@
 import type { PrismaClient } from '@prisma/client';
-import { evaluateTaggingObligation } from './tagging';
+import { evaluateSecurityHubTaggingCoverage } from './tagging';
 
 const createPrismaClientWithMockedResponse = (response: unknown[]) => {
 	const aws_securityhub_findings = {
@@ -51,7 +51,7 @@ describe('The tagging obligation', () => {
 			},
 		]);
 
-		const results = await evaluateTaggingObligation(client);
+		const results = await evaluateSecurityHubTaggingCoverage(client);
 
 		expect(results).toHaveLength(2);
 		expect(results[0]).toEqual({
@@ -89,7 +89,7 @@ describe('The tagging obligation', () => {
 			},
 		]);
 
-		const results = await evaluateTaggingObligation(client);
+		const results = await evaluateSecurityHubTaggingCoverage(client);
 
 		expect(results).toHaveLength(0);
 	});
@@ -124,7 +124,7 @@ describe('The tagging obligation', () => {
 			},
 		]);
 
-		const results = await evaluateTaggingObligation(client);
+		const results = await evaluateSecurityHubTaggingCoverage(client);
 
 		expect(results).toHaveLength(2);
 	});
@@ -140,7 +140,7 @@ describe('The tagging obligation', () => {
 			},
 		]);
 
-		await expect(evaluateTaggingObligation(client)).rejects.toEqual(
+		await expect(evaluateSecurityHubTaggingCoverage(client)).rejects.toEqual(
 			new Error('Invalid resource in finding 123456789012'),
 		);
 	});

packages/obligatron/src/obligations/tagging.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from '@prisma/client';
+import type { Prisma, PrismaClient } from '@prisma/client';
 import type { ObligationResult } from '.';
 
 type FindingResource = {
@@ -42,7 +42,52 @@ const isFindingResource = (resource: unknown): resource is FindingResource =>
 	'Id' in resource &&
 	'Tags' in resource;
 
-export async function evaluateTaggingObligation(
+export async function evaluateAmiTaggingCoverage(
+	db: PrismaClient,
+): Promise<ObligationResult[]> {
+	const records = await db.aws_ec2_images.findMany({
+		where: {
+			account_id: {
+				equals: db.aws_ec2_images.fields.owner_id,
+			},
+		},
+	});
+
+	const amiTags = [
+		// The "core" tags
+		'Stack',
+		'Stage',
+		'App',
+		'gu:repo',
+
+		// Tags added by AMIgo
+		'AmigoStage',
+		'SourceAMI',
+		'BuildNumber',
+		'BuiltBy',
+		'Recipe',
+		'BakeId',
+	];
+
+	return records.flatMap<ObligationResult>((record) => {
+		const tagKeys = Object.keys(record.tags as Prisma.JsonObject);
+
+		const missingTags = amiTags.filter((tag) => !tagKeys.includes(tag));
+		console.log(`AMI ${record.arn} is missing tags: ${missingTags.join(', ')}`);
+
+		return missingTags.map<ObligationResult>((tag) => {
+			return {
+				resource: record.arn,
+				reason: `AMIs should be tagged. Missing tag: ${tag}`,
+				contacts: {
+					aws_account: record.account_id,
+				},
+			};
+		});
+	});
+}
+
+export async function evaluateSecurityHubTaggingCoverage(
 	db: PrismaClient,
 ): Promise<ObligationResult[]> {
 	const findings = await db.aws_securityhub_findings.findMany({