Multi-Cloud Governance Strategies

{`package terraform

import future.keywords.if
import future.keywords.in

# Helper to get a normalized map of tags/labels.
# It prioritizes 'tags', falls back to 'labels', and returns an empty map if neither exists.
resource_metadata(resource) := metadata if {
    "tags" in resource.change.after
    metadata := resource.change.after.tags
} else if {
    "labels" in resource.change.after
    metadata := resource.change.after.labels
} else := {}

# Rule: Deny if any resource is missing the 'owner' key in its metadata.
deny[msg] {
    resource := input.resource_changes[_]
    # Skip data sources and read-only resources which don't have tags.
    resource.mode == "managed"
    
    metadata := resource_metadata(resource)
    not metadata.owner

    msg := sprintf("Resource '%s' of type '%s' must have an 'owner' tag/label.", [resource.address, resource.type])
}

# Rule: Deny if any resource is missing the 'cost-center' key in its metadata.
deny[msg] {
    resource := input.resource_changes[_]
    resource.mode == "managed"
    
    metadata := resource_metadata(resource)
    not metadata["cost-center"]

    msg := sprintf("Resource '%s' of type '%s' must have a 'cost-center' tag/label.", [resource.address, resource.type])
}`}

{`package terraform

# Deny AWS S3 buckets with public ACLs
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    resource.change.after.acl == "public-read"
    msg := sprintf("S3 Bucket '%s' must not have a public ACL.", [resource.address])
}

# Deny GCP Storage buckets that grant public access
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "google_storage_bucket_iam_member"
    resource.change.after.role == "roles/storage.objectViewer"
    resource.change.after.member == "allUsers"
    msg := sprintf("GCP Bucket IAM binding for '%s' grants public access and is not allowed.", [resource.address])
}

# Deny Azure Storage Containers with public access enabled
deny[msg] {
    resource := input.resource_changes[_]
    resource.type == "azurerm_storage_container"
    resource.change.after.container_access_type == "blob" # 'blob' or 'container' allows public access
    msg := sprintf("Azure Storage Container '%s' must not allow public blob access.", [resource.address])
}`}

{`name: Multi-Cloud Policy Validation

on:
  pull_request:
    paths:
      - 'infra/**.tf'
      - 'policies/**'

jobs:
  validate-infrastructure:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Setup Conftest
        uses: open-policy-agent/setup-conftest@v2
      
      - name: Authenticate to AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: 'us-east-1'

      - name: Authenticate to Azure
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Authenticate to GCP
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: ${{ secrets.GCP_CREDENTIALS }}

      - name: Terraform Init & Plan
        id: plan
        run: |
          cd infra/ # Assuming multi-cloud TF code is in this directory
          terraform init
          terraform plan -out=tfplan
          terraform show -json tfplan > tfplan.json
        continue-on-error: true # Allow plan to fail if resources don't exist yet

      - name: Check Terraform Plan Status
        if: steps.plan.outcome == 'failure'
        run: |
          echo "Terraform plan failed. This might be expected if the PR destroys all infrastructure."
          exit 1

      - name: Run Conftest Policy Check
        run: conftest test --policy policies/ infra/tfplan.json`}