diff --git a/model/azure/logs.yaml b/model/azure/logs.yaml index dd383425a2..4a5e3fc22a 100644 --- a/model/azure/logs.yaml +++ b/model/azure/logs.yaml @@ -12,7 +12,6 @@ groups: - ref: cloud.resource_id brief: The [Fully Qualified Azure Resource ID](https://docs.microsoft.com/rest/api/resources/resources/get-by-id) the log is emitted for. note: "" - - ref: event.name body: id: az.resource.log requirement_level: recommended diff --git a/model/event/common.yaml b/model/event/common.yaml index b07e25a8df..8e68c5a909 100644 --- a/model/event/common.yaml +++ b/model/event/common.yaml @@ -1,6 +1,7 @@ groups: - id: event type: attribute_group + stability: experimental brief: > This document defines attributes for Events represented using Log Records. attributes: diff --git a/policies/yaml_schema.rego b/policies/yaml_schema.rego index 4d09e4d594..c8e40680c6 100644 --- a/policies/yaml_schema.rego +++ b/policies/yaml_schema.rego @@ -48,6 +48,18 @@ deny[yaml_schema_violation(description, group.id, name)] { description := sprintf("Event name '%s' is invalid. Event name %s'", [name, invalid_name_helper]) } +# checks event.name is not referenced in event attributes +deny[yaml_schema_violation(description, group.id, name)] { + group := input.groups[_] + group.type == "event" + name := group.name + + attr := group.attributes[_] + attr.ref == "event.name" + + description := sprintf("Attribute 'event.name' is referenced on event group '%s'. Event name must be provided in 'name' property on the group", [name]) +} + # require resources have names deny[yaml_schema_violation(description, group.id, "")] { group := input.groups[_] diff --git a/policies/yaml_schema_test.rego b/policies/yaml_schema_test.rego index 4a506835e7..a6d135f9d7 100644 --- a/policies/yaml_schema_test.rego +++ b/policies/yaml_schema_test.rego @@ -24,6 +24,14 @@ test_fails_on_invalid_event_name if { } } +test_fails_on_referenced_event_name_on_event if { + event := [{ "id": "yaml_schema.test", + "type": "event", + "name": "foo", + "attributes": [{"ref": "event.name"}]}] + count(deny) == 1 with input as {"groups": event} +} + test_fails_on_invalid_resource_name if { every name in invalid_names { count(deny) >= 1 with input as {"groups": create_resource(name)}