# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../schemas/observability.schema.json

alerts:
  binaryAuthorizationPolicyChanges:
    combiner: OR
    conditions:
      - condition_threshold:
          aggregations:
            - alignment_period: 60s
              cross_series_reducer: REDUCE_SUM
              group_by_fields:
                - metric.label.principal
                - metric.label.method_name
                - metric.label.project_id
              per_series_aligner: ALIGN_SUM
          comparison: COMPARISON_GT
          duration: 0s
          filter:
            resource.type = "logging_bucket" AND metric.type =
            "logging.googleapis.com/user/binaryAuthorizationPolicyChanges"
          threshold_value: 0
          trigger:
            count: 1
        display_name: "Log match condition: Binary Authorization policy configuration changes"
    display_name: Binary Authorization Policy Changes
    documentation:
      content: |-
        Log-based alerting policy in project ${project} detected for a change to Binary Authorization
        project-singleton policy, weakening the enforcement or evaluation modes.

        This alert helps ensure security by monitoring configuration changes to Binary Authorization policies.
        ```
        protoPayload.methodName="google.cloud.binaryauthorization.v1.BinauthzManagementServiceV1.UpdatePolicy" AND
        protoPayload.serviceName="binaryauthorization.googleapis.com" AND
        ("ALWAYS_ALLOW" OR "DRYRUN_AUDIT_LOG_ONLY")
        ```
      mime_type: text/markdown
logging_metrics:
  binaryAuthorizationPolicyChanges:
    bucket_name: $log_buckets:log-0/audit-logs
    description: Binary Authorization Policy Changes
    filter:
      protoPayload.methodName="google.cloud.binaryauthorization.v1.BinauthzManagementServiceV1.UpdatePolicy" AND
      protoPayload.serviceName="binaryauthorization.googleapis.com" AND ("ALWAYS_ALLOW" OR "DRYRUN_AUDIT_LOG_ONLY")
    label_extractors:
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
      labels:
        - description: principal
          key: principal
          value_type: STRING
        - description: method_name
          key: method_name
          value_type: STRING
        - description: project_id
          key: project_id
          value_type: STRING
      metric_kind: DELTA
      unit: "1"
      value_type: INT64
