# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../../schemas/custom-constraint.schema.json

custom.cloudsqlRequirePostgreSQLDatabaseFlags:
  action_type: DENY
  condition: |-
    resource.databaseVersion.startsWith('POSTGRES') && (
      !resource.settings.databaseFlags.exists(f, f.name == 'log_connections' && f.value == 'on') ||
      !resource.settings.databaseFlags.exists(f, f.name == 'log_disconnections' && f.value == 'on') ||
      !resource.settings.databaseFlags.exists(f, f.name == 'log_min_duration_statement' && f.value == '-1') ||
      !resource.settings.databaseFlags.exists(f, f.name == 'cloudsql.enable_pgaudit' && f.value == 'on') ||
      resource.settings.databaseFlags.exists(f, f.name == 'log_error_verbosity' && f.value == 'terse') ||
      resource.settings.databaseFlags.exists(f, f.name == 'log_statement' && f.value == 'none') ||
      resource.settings.databaseFlags.exists(f,
        f.name == 'log_min_messages' && f.value in ['error' , 'log', 'fatal', 'panic']
      ) ||
      resource.settings.databaseFlags.exists(f,
        f.name == 'log_min_error_statement' && f.value in ['log', 'fatal', 'panic']
      )
    )
  description: Ensure Cloud SQL for PostgreSQL instance database flags are set correctly
    (e.g log_connections)
  display_name: Require Cloud SQL for PostgreSQL instance database flags to be configured
    correctly (e.g log_connections)
  method_types:
  - CREATE
  - UPDATE
  resource_types:
  - sqladmin.googleapis.com/Instance
