POL-1191 Azure Hybrid Use Benefit Policy for SQL Revamp (#2020)

* update

* fix

* update

* update

* update

* update

* update

* update

* update

.dangerfile/policy_tests.rb

@@ -1069,7 +1069,7 @@ def policy_bad_comma_spacing?(file)
   policy_code.each_line.with_index do |line, index|
     line_number = index + 1
 
-    if line.include?(",") && !line.include?("allowed_pattern") && !line.include?('= ","')
+    if line.include?(",") && !line.include?("allowed_pattern") && !line.include?('= ","') && !line.include?("(',')") && !line.include?('(",")')
       if line.strip.match(/,\s{2,}/) || line.strip.match(/\s,/) || line.strip.match(/,[^\s]/)
         fail_message += "Line #{line_number.to_s}: Possible invalid spacing between comma-separated items found.\nComma separated items should be organized as follows, with a single space following each comma: apple, banana, pear\n\n"
       end

cost/azure/hybrid_use_benefit_sql/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v4.0
+
+- Fixed bug where databases ineligible for AHUB would appear in incident
+- Added support for Elastic Pool recommendations, including automated actions
+- Several parameters altered to be more descriptive and human-readable
+- Added improved subscription, region, and tag filtering for results
+- Normalized incident export to be consistent with other policies
+- Added human-readable recommendation to incident export
+- Streamlined code for better readability and faster execution
+
 ## v3.1
 
 - Fixed error where policy would fail completely when trying to access resources credential does not have access to. Policy will now simply skip these resources.

cost/azure/hybrid_use_benefit_sql/README.md

@@ -1,30 +1,44 @@
 # Azure Hybrid Use Benefit Policy for SQL
 
-## What it does
+## What It Does
 
 This Policy Template is used to automatically apply the Azure Hybrid Use Benefit (AHUB) to all eligible SQL instances in an Azure Subscription.
 
-## Functional Details
+## How It Works
 
-- The policy identifies all SQL databases in Azure that are not currently using [Azure Hybrid Use Benefit](https://azure.microsoft.com/en-us/pricing/hybrid-benefit/). These can be SQL Virtual Machines, SQL Databases or SQL Managed Instances. It raises an incident for all applicable instances not currently using AHUB, which once approved, will enable AHUB on all identified instances.
-- The Exclusion Tag parameter is a string value. Supply the Tag Key only. Tag Values are not analyzed and therefore are not need. If the exclusion tag key is used on an Instance, that Instance is presumed to be exempt from this policy.
-- This policy does not track licenses or availability. It is your responsibility to ensure you are not under licensed.
+- The policy identifies all SQL databases in Azure that are not currently using [Azure Hybrid Use Benefit](https://azure.microsoft.com/en-us/pricing/hybrid-benefit/). These can be SQL Virtual Machines, SQL Elastic Pools, SQL Databases or SQL Managed Instances. It raises an incident for all applicable instances not currently using AHUB, which once approved, will enable AHUB on all identified instances.
+- This policy does not track licenses or availability. It is your responsibility to ensure that you have valid licenses for all resources that AHUB is enabled for.
 
 ## Input Parameters
 
 This policy has the following input parameters required when launching the policy.
 
-- *Exclusion Tag Key* - an Azure-native instance tag to ignore instances that are not using AHUB. Only supply the tag key. The policy assumes that the tag value is irrelevant.
-- *Email addresses* - A list of email addresses of the recipients you wish to notify
+- *Email Addresses* - A list of email addresses to notify
 - *Azure Endpoint* - Azure Endpoint to access resources
-- *Subscription Allowed List* - Allowed Subscriptions, if empty, all subscriptions will be checked
+- *Allow/Deny Subscriptions* - Allow or Deny entered Subscriptions to filter results.
+- *Allow/Deny Subscriptions List* - A list of allowed or denied Subscription IDs/names. Leave blank to check all Subscriptions.
+- *Allow/Deny Regions* - Allow or Deny entered regions to filter results.
+- *Allow/Deny Regions List* - A list of allowed or denied regions. Leave blank to check all Subscriptions.
+- *Exclusion Tags* - The policy will filter resources containing the specified tags from the results. The following formats are supported:
+  - `Key` - Filter all resources with the specified tag key.
+  - `Key==Value` - Filter all resources with the specified tag key:value pair.
+  - `Key!=Value` - Filter all resources missing the specified tag key:value pair. This will also filter all resources missing the specified tag key.
+  - `Key=~/Regex/` - Filter all resources where the value for the specified key matches the specified regex string.
+  - `Key!~/Regex/` - Filter all resources where the value for the specified key does not match the specified regex string. This will also filter all resources missing the specified tag key.
+- *Exclusion Tags: Any / All* - Whether to filter instances containing any of the specified tags or only those that contain all of them. Only applicable if more than one value is entered in the `Exclusion Tags` field.
 - *Automatic Actions* - When this value is set, this policy will automatically take the selected action(s).
 
-Please note that the "*Automatic Actions*" parameter contains a list of action(s) that can be performed on the resources. When it is selected, the policy will automatically execute the corresponding action on the data that failed the checks, post incident generation. Please leave it blank for *manual* action. For example, if a user selects the "Hybrid use benefit for SQL" action while applying the policy, hybrid use benefit will be applied to the eligible instances.
+Please note that the "Automatic Actions" parameter contains a list of action(s) that can be performed on the resources. When it is selected, the policy will automatically execute the corresponding action on the data that failed the checks, post incident generation. Please leave it blank for *manual* action.
+For example if a user selects the "Apply Hybrid Use Benefit" action while applying the policy, all of the resources without AHUB that qualify will have AHUB enabled.
+
+## Policy Actions
+
+- Sends an email notification
+- Apply AHUB benefit to resource after approval
 
 ## Prerequisites
 
-This policy uses [credentials](https://docs.flexera.com/flexera/EN/Automation/ManagingCredentialsExternal.htm) for connecting to the cloud -- in order to apply this policy you must have a credential registered in the system that is compatible with this policy. If there are no credentials listed when you apply the policy, please contact your cloud admin and ask them to register a credential that is compatible with this policy. The information below should be consulted when creating the credential.
+This Policy Template uses [Credentials](https://docs.flexera.com/flexera/EN/Automation/ManagingCredentialsExternal.htm) for authenticating to datasources -- in order to apply this policy you must have a Credential registered in the system that is compatible with this policy. If there are no Credentials listed when you apply the policy, please contact your Flexera Org Admin and ask them to register a Credential that is compatible with this policy. The information below should be consulted when creating the credential(s).
 
 ### Credential configuration
 
@@ -41,10 +55,12 @@ For administrators [creating and managing credentials](https://docs.flexera.com/
 - [**Flexera Credential**](https://docs.flexera.com/flexera/EN/Automation/ProviderCredentials.htm) (*provider=flexera*) which has the following roles:
   - `billing_center_viewer`
 
+The [Provider-Specific Credentials](https://docs.flexera.com/flexera/EN/Automation/ProviderCredentials.htm) page in the docs has detailed instructions for setting up Credentials for the most common providers.
+
 ## Supported Clouds
 
-- Azure Resource Manager
+- Azure
 
 ## Cost
 
-This Policy Template does not incur any cloud costs.
+This Policy Template does not incur any cloud costs