# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../schemas/observability.schema.json

alerts:
  projectOwnershipChange:
    combiner: OR
    conditions:
      - condition_threshold:
          aggregations:
            - alignment_period: 60s
              cross_series_reducer: REDUCE_SUM
              group_by_fields:
                - metric.label.principal
                - metric.label.method_name
                - metric.label.organization_id
                - metric.label.folder_id
                - metric.label.project_id
              per_series_aligner: ALIGN_SUM
          comparison: COMPARISON_GT
          duration: 0s
          filter:
            resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/projectOwnershipChange"
          threshold_value: 0
          trigger:
            count: 1
        display_name: Project Ownership Changes
    display_name: Project Ownership Changes
    documentation:
      content: |-
        Log-based alerting policy in project ${project} detected a project ownership assignments or changes.
        ```
        (protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND
        (ProjectOwnership OR projectOwnerInvitee)
        OR
        (
          protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND
          protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
        )
        OR
        (
          protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND
          protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
        )
        ```
      mime_type: text/markdown
logging_metrics:
  projectOwnershipChange:
    bucket_name: $log_buckets:log-0/audit-logs
    description: Project Ownership Changes
    filter: |-
      (protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND
      (ProjectOwnership OR projectOwnerInvitee)
      OR
      (
        protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND
        protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
      )
      OR
      (
        protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND
        protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner"
      )
    label_extractors:
      folder_id: EXTRACT(labels.folder_id)
      method_name: EXTRACT(protoPayload.methodName)
      organization_id: EXTRACT(labels.organization_id)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
      labels:
        - description: principal
          key: principal
          value_type: STRING
        - description: method_name
          key: method_name
          value_type: STRING
        - description: organization_id
          key: organization_id
          value_type: STRING
        - description: folder_id
          key: folder_id
          value_type: STRING
        - description: project_id
          key: project_id
          value_type: STRING
      metric_kind: DELTA
      unit: "1"
      value_type: INT64
