# AWS Config Rule: Require tags en todos los recursos
resource "aws_config_config_rule" "required_tags" {
name = "required-tags-enforcement"

source {
    owner             = "AWS"
    source_identifier = "REQUIRED_TAGS"
}

input_parameters = jsonencode({
    tag1Key = "Environment"
    tag2Key = "Owner"
    tag3Key = "Project"
    tag4Key = "CostCenter"
})

depends_on = [aws_config_configuration_recorder.main]
}

# Auto-remediation Lambda (trigger cuando Config detecta non-compliant)
resource "aws_lambda_function" "tag_remediation" {
function_name    = "auto-tag-resources"
runtime          = "python3.11"
handler          = "index.lambda_handler"
role             = aws_iam_role.lambda_execution.arn
filename         = "lambda-auto-tag.zip"
source_code_hash = filebase64sha256("lambda-auto-tag.zip")

environment {
    variables = {
    DEFAULT_OWNER      = "cloud-ops@company.com"
    DEFAULT_COSTCENTER = "unassigned"
    }
}
}

# EventBridge rule para trigger Lambda cuando Config detecta non-compliant
resource "aws_cloudwatch_event_rule" "config_compliance" {
name        = "config-compliance-trigger"
description = "Trigger remediation when Config detects non-compliant resources"

event_pattern = jsonencode({
    source      = ["aws.config"]
    detail-type = ["Config Rules Compliance Change"]
    detail = {
    configRuleName = ["required-tags-enforcement"]
    newEvaluationResult = {
        complianceType = ["NON_COMPLIANT"]
    }
    }
})
}

resource "aws_cloudwatch_event_target" "lambda" {
rule      = aws_cloudwatch_event_rule.config_compliance.name
target_id = "TriggerLambda"
arn       = aws_lambda_function.tag_remediation.arn
}

# GCP Organization Policy: Require labels en resources
resource "google_org_policy_policy" "require_labels" {
name   = "projects/${var.project_id}/policies/compute.requireLabels"
parent = "projects/${var.project_id}"

spec {
    rules {
    enforce = "TRUE"
    values {
        allowed_values = [
        "environment:dev",
        "environment:staging",
        "environment:production",
        "owner:*",
        "project:*",
        "costcenter:*"
        ]
    }
    }
}
}

# Cloud Function para audit labels existentes
resource "google_cloudfunctions_function" "label_audit" {
name        = "label-compliance-audit"
runtime     = "python311"
entry_point = "audit_labels"

source_archive_bucket = google_storage_bucket.functions.name
source_archive_object = google_storage_bucket_object.function_zip.name

event_trigger {
    event_type = "google.pubsub.topic.publish"
    resource   = google_pubsub_topic.daily_audit.id
}
}

# Terraform Sentinel Policy: Deny resources sin required tags
import "tfplan/v2" as tfplan

# Required tags list
required_tags = ["Environment", "Owner", "Project", "CostCenter"]

# Function para validar tags
validate_tags = func(resource) {
tags = resource.change.after.tags

for required_tags as tag {
    if tag not in keys(tags) {
    print("ERROR: Resource", resource.address, "missing required tag:", tag)
    return false
    }
}

return true
}

# Main rule
main = rule {
all tfplan.resource_changes as _, rc {
    # Solo validar resources que se crean o modifican
    rc.change.actions contains "create" or rc.change.actions contains "update"
    
    # Validar tags si resource type soporta tagging
    if "tags" in keys(rc.change.after) {
    validate_tags(rc)
    } else {
    true  # Skip si resource type no soporta tags
    }
}
}