aws_superseded_instances.pt

name "AWS Superseded EC2 Instances"
rs_pt_ver 20180301
type "policy"
short_description "Checks for AWS EC2 instance types that have been superseded and, optionally, updates the instance type. See the [README](https://github.com/flexera-public/policy_templates/tree/master/cost/aws/superseded_instances) and [docs.flexera.com/flexera/EN/Automation](https://docs.flexera.com/flexera/EN/Automation/AutomationGS.htm) to learn more."
long_description ""
severity "low"
category "Cost"
default_frequency "weekly"
info(
  version: "2.3.2",
  provider: "AWS",
  service: "Compute",
  policy_set: "Superseded Compute Instances",
  recommendation_type: "Usage Reduction"
)

###############################################################################
# Parameters
###############################################################################

parameter "param_email" do
  type "list"
  category "Policy Settings"
  label "Email Addresses"
  description "Email addresses of the recipients you wish to notify when new incidents are created"
  default []
end

parameter "param_aws_account_number" do
  type "string"
  category "Policy Settings"
  label "Account Number"
  description "Leave blank; this is for automated use with Meta Policies. See README for more details."
  default ""
end

parameter "param_instance_type" do
  type "string"
  category "Policy Settings"
  label "Instance Type Category"
  description "Instance Type Category to pick from for recommended instance types. See README for more information."
  allowed_values "Regular", "Next Gen", "Burstable", "AMD"
  default "Regular"
end

parameter "param_fallback_instance_type" do
  type "string"
  category "Policy Settings"
  label "Fallback Instance Type Category"
  description "Instance Type Category to pick from for recommended instance types if there are no valid recommendations for the primary category. Set to 'None' to have no fallback. See README for more information."
  allowed_values "Regular", "Next Gen", "Burstable", "AMD", "None"
  default "None"
end

parameter "param_min_savings" do
  type "number"
  category "Policy Settings"
  label "Minimum Savings Threshold"
  description "Minimum potential savings required to generate a recommendation"
  min_value 0
  default 0
end

parameter "param_exclusion_tags" do
  type "list"
  category "Filters"
  label "Exclusion Tags"
  description "Cloud native tags to ignore resources that you don't want to produce recommendations for. Enter the Key name to filter resources with a specific Key, regardless of Value, and enter Key==Value to filter resources with a specific Key:Value pair. Other operators and regex are supported; please see the README for more details."
  default []
end

parameter "param_exclusion_tags_boolean" do
  type "string"
  category "Filters"
  label "Exclusion Tags: Any / All"
  description "Whether to filter instances containing any of the specified tags or only those that contain all of them. Only applicable if more than one value is entered in the 'Exclusion Tags' field."
  allowed_values "Any", "All"
  default "Any"
end

parameter "param_regions_allow_or_deny" do
  type "string"
  category "Filters"
  label "Allow/Deny Regions"
  description "Allow or Deny entered regions. See the README for more details"
  allowed_values "Allow", "Deny"
  default "Allow"
end

parameter "param_regions_list" do
  type "list"
  category "Filters"
  label "Allow/Deny Regions List"
  description "A list of allowed or denied regions. See the README for more details"
  allowed_pattern /^([a-zA-Z-_]+-[a-zA-Z0-9-_]+-[0-9-_]+,*|)+$/
  default []
end

parameter "param_automatic_action" do
  type "list"
  category "Actions"
  label "Automatic Actions"
  description "When this value is set, this policy will automatically take the selected action(s)"
  allowed_values ["Change Instance Type"]
  default []
end

###############################################################################
# Authentication
###############################################################################

credentials "auth_aws" do
  schemes "aws", "aws_sts"
  label "AWS"
  description "Select the AWS Credential from the list"
  tags "provider=aws"
  aws_account_number $param_aws_account_number
end

credentials "auth_flexera" do
  schemes "oauth2"
  label "Flexera"
  description "Select Flexera One OAuth2 credentials"
  tags "provider=flexera"
end

###############################################################################
# Datasources & Scripts
###############################################################################

# Various data tables needed for later in the policy
datasource "ds_aws_instance_size_map" do
  request do
    host "raw.githubusercontent.com"
    path "/flexera-public/policy_templates/master/data/aws/instance_types.json"
    header "User-Agent", "RS Policies"
  end
end

datasource "ds_aws_instance_cost_map" do
  request do
    host "raw.githubusercontent.com"
    path "/flexera-public/policy_templates/master/data/aws/aws_ec2_pricing.json"
    header "User-Agent", "RS Policies"
  end
end

# Get applied policy metadata for use later
datasource "ds_applied_policy" do
  request do
    auth $auth_flexera
    host rs_governance_host
    path join(["/api/governance/projects/", rs_project_id, "/applied_policies/", policy_id])
    header "Api-Version", "1.0"
  end
end

# Get region-specific Flexera API endpoints
datasource "ds_flexera_api_hosts" do
  run_script $js_flexera_api_hosts, rs_optima_host
end

script "js_flexera_api_hosts", type: "javascript" do
  parameters "rs_optima_host"
  result "result"
  code <<-EOS
  host_table = {
    "api.optima.flexeraeng.com": {
      flexera: "api.flexera.com",
      fsm: "api.fsm.flexeraeng.com"
    },
    "api.optima-eu.flexeraeng.com": {
      flexera: "api.flexera.eu",
      fsm: "api.fsm-eu.flexeraeng.com"
    },
    "api.optima-apac.flexeraeng.com": {
      flexera: "api.flexera.au",
      fsm: "api.fsm-apac.flexeraeng.com"
    }
  }

  result = host_table[rs_optima_host]
EOS
end

# Get AWS account info
datasource "ds_cloud_vendor_accounts" do
  request do
    auth $auth_flexera
    host val($ds_flexera_api_hosts, 'flexera')
    path join(["/finops-analytics/v1/orgs/", rs_org_id, "/cloud-vendor-accounts"])
    header "Api-Version", "1.0"
  end
  result do
    encoding "json"
    collect jmes_path(response, "values[*]") do
      field "id", jmes_path(col_item, "aws.accountId")
      field "name", jmes_path(col_item, "name")
      field "tags", jmes_path(col_item, "tags")
    end
  end
end

datasource "ds_get_caller_identity" do
  request do
    auth $auth_aws
    host "sts.amazonaws.com"
    path "/"
    query "Action", "GetCallerIdentity"
    query "Version", "2011-06-15"
    header "User-Agent", "RS Policies"
  end
  result do
    encoding "xml"
    collect xpath(response, "//GetCallerIdentityResponse/GetCallerIdentityResult") do
      field "account", xpath(col_item, "Account")
    end
  end
end

datasource "ds_aws_account" do
  run_script $js_aws_account, $ds_cloud_vendor_accounts, $ds_get_caller_identity
end

script "js_aws_account", type:"javascript" do
  parameters "ds_cloud_vendor_accounts", "ds_get_caller_identity"
  result "result"
  code <<-EOS
  result = _.find(ds_cloud_vendor_accounts, function(account) {
    return account['id'] == ds_get_caller_identity[0]['account']
  })

  // This is in case the API does not return the relevant account info
  if (result == undefined) {
    result = {
      id: ds_get_caller_identity[0]['account'],
      name: "",
      tags: {}
    }
  }
EOS
end

datasource "ds_billing_centers" do
  request do
    auth $auth_flexera
    host rs_optima_host
    path join(["/analytics/orgs/", rs_org_id, "/billing_centers"])
    query "view", "allocation_table"
    header "Api-Version", "1.0"
    header "User-Agent", "RS Policies"
    ignore_status [403]
  end
  result do
    encoding "json"
    collect jmes_path(response, "[*]") do
      field "href", jmes_path(col_item, "href")
      field "id", jmes_path(col_item, "id")
      field "name", jmes_path(col_item, "name")
      field "parent_id", jmes_path(col_item, "parent_id")
    end
  end
end

# Gather top level billing center IDs for when we pull cost data
datasource "ds_top_level_bcs" do
  run_script $js_top_level_bcs, $ds_billing_centers
end

script "js_top_level_bcs", type: "javascript" do
  parameters "ds_billing_centers"
  result "result"
  code <<-EOS
  filtered_bcs = _.filter(ds_billing_centers, function(bc) {
    return bc['parent_id'] == null || bc['parent_id'] == undefined
  })

  result = _.compact(_.pluck(filtered_bcs, 'id'))
EOS
end

# Gather local currency info
datasource "ds_currency_reference" do
  request do
    host "raw.githubusercontent.com"
    path "/flexera-public/policy_templates/master/data/currency/currency_reference.json"
    header "User-Agent", "RS Policies"
  end
end

datasource "ds_currency_code" do
  request do
    auth $auth_flexera
    host rs_optima_host
    path join(["/bill-analysis/orgs/", rs_org_id, "/settings/currency_code"])
    header "Api-Version", "0.1"
    header "User-Agent", "RS Policies"
    ignore_status [403]
  end
  result do
    encoding "json"
    field "id", jmes_path(response, "id")
    field "value", jmes_path(response, "value")
  end
end

datasource "ds_currency_target" do
  run_script $js_currency_target, $ds_currency_reference, $ds_currency_code
end

script "js_currency_target", type:"javascript" do
  parameters "ds_currency_reference", "ds_currency_code"
  result "result"
  code <<-EOS
  // Default to USD if currency is not found
  result = ds_currency_reference['USD']

  if (ds_currency_code['value'] != undefined && ds_currency_reference[ds_currency_code['value']] != undefined) {
    result = ds_currency_reference[ds_currency_code['value']]
  }
EOS
end

# Branching logic:
# This datasource returns an empty array if the target currency is USD.
# This prevents ds_currency_conversion from running if it's not needed.
datasource "ds_conditional_currency_conversion" do
  run_script $js_conditional_currency_conversion, $ds_currency_target
end

script "js_conditional_currency_conversion", type: "javascript" do
  parameters "ds_currency_target"
  result "result"
  code <<-EOS
  result = []
  // Make the request only if the target currency is not USD
  if (ds_currency_target['code'] != 'USD') {
    result = [1]
  }
EOS
end

datasource "ds_currency_conversion" do
  # Only make a request if the target currency is not USD
  iterate $ds_conditional_currency_conversion
  request do
    host "api.xe-auth.flexeraeng.com"
    path "/prod/{proxy+}"
    query "from", "USD"
    query "to", val($ds_currency_target, 'code')
    query "amount", "1"
    # Ignore currency conversion if API has issues
    ignore_status [400, 404, 502]
  end
  result do
    encoding "json"
    field "from", jmes_path(response, "from")
    field "to", jmes_path(response, "to")
    field "amount", jmes_path(response, "amount")
    field "year", jmes_path(response, "year")
  end
end

datasource "ds_currency" do
  run_script $js_currency, $ds_currency_target, $ds_currency_conversion
end

script "js_currency", type:"javascript" do
  parameters "ds_currency_target", "ds_currency_conversion"
  result "result"
  code <<-EOS
  result = ds_currency_target
  result['exchange_rate'] = 1

  if (ds_currency_conversion.length > 0) {
    currency_code = ds_currency_target['code']
    current_month = parseInt(new Date().toISOString().split('-')[1])

    conversion_block = _.find(ds_currency_conversion[0]['to'][currency_code], function(item) {
      return item['month'] == current_month
    })

    if (conversion_block != undefined) {
      result['exchange_rate'] = conversion_block['monthlyAverage']
    }
  }
EOS
end

datasource "ds_describe_regions" do
  request do
    auth $auth_aws
    host "ec2.amazonaws.com"
    path "/"
    query "Action", "DescribeRegions"
    query "Version", "2016-11-15"
    query "Filter.1.Name", "opt-in-status"
    query "Filter.1.Value.1", "opt-in-not-required"
    query "Filter.1.Value.2", "opted-in"
    # Header X-Meta-Flexera has no affect on datasource query, but is required for Meta Policies
    # Forces `ds_is_deleted` datasource to run first during policy execution
    header "Meta-Flexera", val($ds_is_deleted, "path")
  end
  result do
    encoding "xml"
    collect xpath(response, "//DescribeRegionsResponse/regionInfo/item", "array") do
      field "region", xpath(col_item, "regionName")
    end
  end
end

datasource "ds_regions" do
  run_script $js_regions, $ds_describe_regions, $param_regions_list, $param_regions_allow_or_deny
end

script "js_regions", type:"javascript" do
  parameters "ds_describe_regions", "param_regions_list", "param_regions_allow_or_deny"
  result "result"
  code <<-EOS
  allow_deny_test = { "Allow": true, "Deny": false }

  if (param_regions_list.length > 0) {
    result = _.filter(ds_describe_regions, function(item) {
      return _.contains(param_regions_list, item['region']) == allow_deny_test[param_regions_allow_or_deny]
    })
  } else {
    result = ds_describe_regions
  }
EOS
end

datasource "ds_instance_sets" do
  iterate $ds_regions
  request do
    auth $auth_aws
    host join(['ec2.', val(iter_item, 'region'), '.amazonaws.com'])
    path '/'
    query 'Action', 'DescribeInstances'
    query 'Version', '2016-11-15'
    header 'User-Agent', 'RS Policies'
    header 'Content-Type', 'text/xml'
  end
  result do
    encoding "xml"
    collect xpath(response, "//DescribeInstancesResponse/reservationSet/item", "array") do
      field "instances_set" do
        collect xpath(col_item, "instancesSet/item", "array") do
          field "region", val(iter_item, "region")
          field "instanceId", xpath(col_item, "instanceId")
          field "ipAddress", xpath(col_item, "ipAddress")
          field "ipv6Address", xpath(col_item, "ipv6Address")
          field "imageId", xpath(col_item, "imageId")
          field "resourceType", xpath(col_item, "instanceType")
          field "platform", xpath(col_item, "platformDetails")
          field "privateDnsName", xpath(col_item, "privateDnsName")
          field "launchTime", xpath(col_item, "launchTime")
          field "tags" do
            collect xpath(col_item, "tagSet/item", "array") do
              field "key", xpath(col_item, "key")
              field "value", xpath(col_item, "value")
            end
          end
        end
      end
    end
  end
end

datasource "ds_instances" do
  run_script $js_instances, $ds_instance_sets, $param_exclusion_tags, $param_exclusion_tags_boolean
end

script "js_instances", type: "javascript" do
  parameters "ds_instance_sets", "param_exclusion_tags", "param_exclusion_tags_boolean"
  result "result"
  code <<-EOS
  comparators = _.map(param_exclusion_tags, function(item) {
    if (item.indexOf('==') != -1) {
      return { comparison: '==', key: item.split('==')[0], value: item.split('==')[1], string: item }
    }

    if (item.indexOf('!=') != -1) {
      return { comparison: '!=', key: item.split('!=')[0], value: item.split('!=')[1], string: item }
    }

    if (item.indexOf('=~') != -1) {
      value = item.split('=~')[1]
      regex = new RegExp(value.slice(1, value.length - 1))
      return { comparison: '=~', key: item.split('=~')[0], value: regex, string: item }
    }

    if (item.indexOf('!~') != -1) {
      value = item.split('!~')[1]
      regex = new RegExp(value.slice(1, value.length - 1))
      return { comparison: '!~', key: item.split('!~')[0], value: regex, string: item }
    }

    // If = is present but none of the above are, assume user error and that the user intended ==
    if (item.indexOf('=') != -1) {
      return { comparison: '==', key: item.split('=')[0], value: item.split('=')[1], string: item }
    }

    // Assume we're just testing for a key if none of the comparators are found
    return { comparison: 'key', key: item, value: null, string: item }
  })

  result = []

  _.each(ds_instance_sets, function(item) {
    if (param_exclusion_tags.length > 0) {
      filtered_instances = _.reject(item['instances_set'], function(resource) {
        resource_tags = {}

        if (typeof(resource['tags']) == 'object') {
          _.each(resource['tags'], function(tag) {
            resource_tags[tag['key']] = tag['value']
          })
        }

        // Store a list of found tags
        found_tags = []

        _.each(comparators, function(comparator) {
          comparison = comparator['comparison']
          value = comparator['value']
          string = comparator['string']
          resource_tag = resource_tags[comparator['key']]

          if (comparison == 'key' && resource_tag != undefined) { found_tags.push(string) }
          if (comparison == '==' && resource_tag == value) { found_tags.push(string) }
          if (comparison == '!=' && resource_tag != value) { found_tags.push(string) }

          if (comparison == '=~') {
            if (resource_tag != undefined && value.test(resource_tag)) { found_tags.push(string) }
          }

          if (comparison == '!~') {
            if (resource_tag == undefined) { found_tags.push(string) }
            if (resource_tag != undefined && value.test(resource_tag)) { found_tags.push(string) }
          }
        })

        all_tags_found = found_tags.length == comparators.length
        any_tags_found = found_tags.length > 0 && param_exclusion_tags_boolean == 'Any'

        return all_tags_found || any_tags_found
      })

      result = result.concat(filtered_instances)
    } else {
      result = result.concat(item['instances_set'])
    }
  })
EOS
end

datasource "ds_instance_costs" do
  request do
    run_script $js_instance_costs, $ds_aws_account, $ds_top_level_bcs, rs_org_id, rs_optima_host
  end
  result do
    encoding "json"
    collect jmes_path(response, "rows[*]") do
      field "resourceId", jmes_path(col_item, "dimensions.resource_id")
      field "billing_center_id", jmes_path(col_item, "dimensions.billing_center_id")
      field "operating_system", jmes_path(col_item, "dimensions.operating_system")
      field "purchase_option", jmes_path(col_item, "dimensions.purchase_option")
      field "service", jmes_path(col_item, "dimensions.service")
      field "cost", jmes_path(col_item, "metrics.cost_amortized_unblended_adj")
    end
  end
end

script "js_instance_costs", type: "javascript" do
  parameters "ds_aws_account", "ds_top_level_bcs", "rs_org_id", "rs_optima_host"
  result "request"
  code <<-EOS
  end_date = new Date()
  end_date.setDate(end_date.getDate() - 2)
  end_date = end_date.toISOString().split('T')[0]

  start_date = new Date()
  start_date.setDate(start_date.getDate() - 3)
  start_date = start_date.toISOString().split('T')[0]

  var request = {
    auth: "auth_flexera",
    host: rs_optima_host,
    verb: "POST",
    path: "/bill-analysis/orgs/" + rs_org_id + "/costs/select",
    body_fields: {
      dimensions: ["resource_id", "billing_center_id", "operating_system", "purchase_option", "service"],
      granularity: "day",
      start_at: start_date,
      end_at: end_date,
      metrics: ["cost_amortized_unblended_adj"],
      billing_center_ids: ds_top_level_bcs,
      limit: 100000,
      filter: {
        type: "and",
        expressions: [
          {
            dimension: "service",
            type: "equal",
            value: "AmazonEC2"
          },
          {
            dimension: "resource_type",
            type: "equal",
            value: "Compute Instance"
          },
          {
            dimension: "vendor_account",
            type: "equal",
            value: ds_aws_account['id']
          },
          {
            type: "not",
            expression: {
              dimension: "adjustment_name",
              type: "substring",
              substring: "Shared"
            }
          }
        ]
      }
    },
    headers: {
      'User-Agent': "RS Policies",
      'Api-Version': "1.0"
    },
    ignore_status: [400]
  }
EOS
end

datasource "ds_instance_costs_grouped" do
  run_script $js_instance_costs_grouped, $ds_instance_costs, $ds_billing_centers
end

script "js_instance_costs_grouped", type: "javascript" do
  parameters "ds_instance_costs", "ds_billing_centers"
  result "result"
  code <<-EOS
  bc_object = {}

  _.each(ds_billing_centers, function(bc) {
    bc_object[bc['id']] = bc['name']
  })

  // Multiple a single day's cost by the average number of days in a month.
  // The 0.25 is to account for leap years for extra precision.
  cost_multiplier = 365.25 / 12

  // Group cost data by resourceId for later use
  result = {}

  _.each(ds_instance_costs, function(item) {
    id = item['resourceId'].toLowerCase()

    if (result[id] == undefined) { result[id] = { cost: 0 } }

    result[id]['cost'] += item['cost'] * cost_multiplier
    result[id]['operating_system'] = item['operating_system']
    result[id]['billing_center'] = bc_object[item['billing_center_id']]
    result[id]['purchase_option'] = item['purchase_option']
  })
EOS
end

datasource "ds_superseded_instances" do
  run_script $js_superseded_instances, $ds_instances, $ds_instance_costs_grouped, $ds_aws_instance_size_map, $ds_aws_instance_cost_map, $ds_currency_conversion, $ds_currency, $ds_aws_account, $ds_applied_policy, $param_instance_type, $param_fallback_instance_type, $param_min_savings
end

script "js_superseded_instances", type: "javascript" do
  parameters "ds_instances", "ds_instance_costs_grouped", "ds_aws_instance_size_map", "ds_aws_instance_cost_map", "ds_currency_conversion", "ds_currency", "ds_aws_account", "ds_applied_policy", "param_instance_type", "param_fallback_instance_type", "param_min_savings"
  result "result"
  code <<-'EOS'
  // Used for formatting numbers to look pretty
  function formatNumber(number, separator) {
    formatted_number = "0"

    if (number) {
      formatted_number = (Math.round(number * 100) / 100).toString().split(".")[0]

      if (separator) {
        withSeparator = ""

        for (var i = 0; i < formatted_number.length; i++) {
          if (i > 0 && (formatted_number.length - i) % 3 == 0) { withSeparator += separator }
          withSeparator += formatted_number[i]
        }

        formatted_number = withSeparator
      }

      decimal = (Math.round(number * 100) / 100).toString().split(".")[1]
      if (decimal) { formatted_number += "." + decimal }
    }

    return formatted_number
  }

  result = []
  total_savings = 0.0

  _.each(ds_instances, function(instance) {
    id = instance['instanceId'].toLowerCase()
    instance_type = instance['resourceType']
    superseded_type = null
    instance_type_price = null
    superseded_type_price = null
    savings = 0.0
    hourly_cost_multiplier = 365.25 / 12 * 24

    cost = null
    operating_system = null
    billing_center = null
    purchase_option = null

    if (ds_instance_costs_grouped[id] != undefined) {
      cost = ds_instance_costs_grouped[id]['cost']
      operating_system = ds_instance_costs_grouped[id]['operating_system']
      billing_center = ds_instance_costs_grouped[id]['billing_center']
      purchase_option = ds_instance_costs_grouped[id]['purchase_option']
    }

    type_table = {
      "Regular": "regular",
      "Next Gen": "next_gen",
      "Burstable": "burstable",
      "AMD": "amd"
    }

    superseded_parameter = type_table[param_instance_type]

    if (ds_aws_instance_size_map[instance_type] != undefined) {
      superseded_table = ds_aws_instance_size_map[instance_type]['superseded']

      if (typeof(superseded_table) == 'object') {
        superseded_type = superseded_table[superseded_parameter]
        recommendationType = param_instance_type
      }
    }

    if ((typeof(superseded_type) != 'string' || superseded_type != '') && param_fallback_instance_type != "None") {
      superseded_parameter = type_table[param_fallback_instance_type]

      if (ds_aws_instance_size_map[instance_type] != undefined) {
        superseded_table = ds_aws_instance_size_map[instance_type]['superseded']

        if (typeof(superseded_table) == 'object') {
          superseded_type = superseded_table[superseded_parameter]
          recommendationType = param_fallback_instance_type
        }
      }
    }

    if (typeof(superseded_type) == 'string' && superseded_type != '') {
      if (typeof(operating_system) == 'string') {
        if (ds_aws_instance_cost_map[instance['region']] != undefined) {
          instance_type_cost_map = ds_aws_instance_cost_map[instance['region']][instance_type]

          if (instance_type_cost_map != undefined) {
            instance_type_price_map = instance_type_cost_map[operating_system]
          }

          if (instance_type_price_map != undefined) {
            instance_type_price = instance_type_price_map['pricePerUnit']
          }

          superseded_type_cost_map = ds_aws_instance_cost_map[instance['region']][superseded_type]

          if (superseded_type_cost_map != undefined) {
            superseded_type_price_map = superseded_type_cost_map[operating_system]
          }

          if (superseded_type_price_map != undefined) {
            superseded_type_price = superseded_type_price_map['pricePerUnit']
          }
        }
      }

      if (typeof(instance_type_price) == 'number' && typeof(superseded_type_price) == 'number') {
        instance_type_price *= ds_currency['exchange_rate'] * hourly_cost_multiplier
        superseded_type_price *= ds_currency['exchange_rate'] * hourly_cost_multiplier
        savings = instance_type_price - superseded_type_price
      }

      if (savings >= param_min_savings) {
        total_savings += savings

        tags = []
        resourceName = ""

        if (instance['tags'] != null && instance['tags'] != undefined) {
          _.each(instance['tags'], function(tag) {
            tags.push([tag['key'], tag['value']].join('='))

            if (tag['key'].toLowerCase() == 'name') {
              resourceName = tag['value']
            }
          })
        }

        savings = parseFloat(savings.toFixed(3))

        if (typeof(cost) == 'number') {
          cost = parseFloat(cost.toFixed(3))
        }

        if (typeof(instance_type_price) == 'number') {
          instance_type_price = parseFloat(instance_type_price.toFixed(3))
        }

        if (typeof(superseded_type_price) == 'number') {
          superseded_type_price = parseFloat(superseded_type_price.toFixed(3))
        }

        recommendationDetails = [
          "Change instance type of EC2 instance ", instance["instanceId"], " ",
          "in AWS Account ", ds_aws_account['name'], " ",
          "(", ds_aws_account['id'], ") ",
          "from ", instance["resourceType"], " ",
          "to ", superseded_type
        ].join('')

        hostname = null

        if (typeof(instance['privateDnsName']) == 'string') {
          hostname = instance['privateDnsName'].split('.')[0]
        }

        resourceARN = "arn:aws:ec2:" + instance['region'] + ":" + ds_aws_account['id'] + ":instance/" + instance['instanceId']

        result.push({
          region: instance['region'],
          resourceID: instance['instanceId'],
          resourceARN: resourceARN,
          ipAddress: instance['ipAddress'],
          ipv6Address: instance['ipv6Address'],
          imageId: instance['imageId'],
          resourceType: instance['resourceType'],
          platform: instance['platform'],
          privateDnsName: instance['privateDnsName'],
          launchTime: instance['launchTime'],
          osType: operating_system,
          billing_center: billing_center,
          purchase_option: purchase_option,
          service: "AmazonEC2",
          tags: tags.join(', '),
          accountID: ds_aws_account['id'],
          accountName: ds_aws_account['name'],
          hostname: hostname,
          recommendationDetails: recommendationDetails,
          newResourceType: superseded_type,
          resourceName: resourceName,
          cost: cost,
          instance_type_price: instance_type_price,
          superseded_type_price: superseded_type_price,
          savings: savings,
          savingsCurrency: ds_currency['symbol'],
          recommendationType: recommendationType,
          policy_name: ds_applied_policy['name'],
          total_savings: "",
          message: ""
        })
      }
    }
  })

  // Sort by descending order of savings value
  result = _.sortBy(result, function(item) { return item['savings'] * -1 })

  // Message for incident detailed template
  savings_message = [
    ds_currency['symbol'], ' ',
    formatNumber(parseFloat(total_savings).toFixed(2), ds_currency['t_separator'])
  ].join('')

  total_instances = ds_instances.length.toString()
  total_superseded = result.length.toString()
  superseded_percentage = (total_superseded / total_instances * 100).toFixed(2).toString() + '%'

  instance_noun = "instance"
  if (Number(total_instances) > 1) { instance_noun = "instances" }

  superseded_verb = "is"
  if (Number(total_superseded) > 1) { superseded_verb = "are" }

  findings = [
    "Out of ", total_instances, " EC2 ", instance_noun, " analyzed, ",
    total_superseded, " (", superseded_percentage,
    ") ", superseded_verb, " superseded and recommended for an instance type change. "
  ].join('')

  if (param_fallback_instance_type == "None") {
    findings += "All recommendations are for '", param_instance_type, "' instance types.\n\n"
  } else {
    findings += "All recommendations are for '", param_instance_type, "' instance types when available with '", param_fallback_instance_type, "' as a fallback instance type when the primary type is not an option.\n\n"
  }

  disclaimer = "The above settings can be modified by editing the applied policy and changing the appropriate parameters.\n\n"

  api_disclaimer = ""

  if (ds_currency_conversion['to'] == undefined && ds_currency['code'] != 'USD') {
    api_disclaimer = "\n\nSavings values are in USD due to a malfunction with Flexera's internal currency conversion API. Please contact Flexera support to report this issue."
  }

  savings_disclaimer = "Savings are estimated based on list price and may not reflect credits or discounts. "

  if (ds_currency['code'] != "USD" && api_disclaimer == "") {
    savings_disclaimer += "List prices were converted from USD using current exchange rates."
  }

  // Dummy entry to ensure the check statement in validation always runs at least once
  result.push({
    region: "",
    resourceID: "",
    ipAddress: "",
    ipv6Address: "",
    imageId: "",
    resourceType: "",
    platform: "",
    privateDnsName: "",
    launchTime: "",
    osType: "",
    billing_center: "",
    purchase_option: "",
    service: "",
    tags: "",
    accountID: "",
    accountName: "",
    hostname: "",
    recommendationDetails: "",
    newResourceType: "",
    resourceName: "",
    cost: "",
    instance_type_price: "",
    superseded_type_price: "",
    savings: "",
    savingsCurrency: "",
    recommendationType: "",
    policy_name: "",
    total_savings: "",
    message: ""
  })

  result[0]['total_savings'] = savings_message
  result[0]['message'] = findings + disclaimer + savings_disclaimer + api_disclaimer
EOS
end

###############################################################################
# Policy
###############################################################################

policy "pol_superseded_instances" do
  validate_each $ds_superseded_instances do
    summary_template "{{ with index data 0 }}{{ .policy_name }}{{ end }}: {{ len data }} AWS Potentially Superseded EC2 Instances Found"
    detail_template <<-'EOS'
    **Potential Monthly Savings:** {{ with index data 0 }}{{ .total_savings }}{{ end }}

    {{ with index data 0 }}{{ .message }}{{ end }}
    EOS
    check logic_or($ds_parent_policy_terminated, eq(val(item, "resourceID"), ""))
    escalate $esc_email
    escalate $esc_change_type
    hash_exclude "message", "total_savings", "resourceName", "tags", "cost", "instance_type_price", "superseded_type_price", "savings", "savingsCurrency"
    export do
      resource_level true
      field "accountID" do
        label "Account ID"
      end
      field "accountName" do
        label "Account Name"
      end
      field "resourceID" do
        label "Resource ID"
      end
      field "resourceName" do
        label "Resource Name"
      end
      field "tags" do
        label "Resource Tags"
      end
      field "recommendationDetails" do
        label "Recommendation"
      end
      field "resourceType" do
        label "Instance Size"
      end
      field "newResourceType" do
        label "Recommended Instance Size"
      end
      field "recommendationType" do
        label "Recommendation Type"
      end
      field "region" do
        label "Region"
      end
      field "platform" do
        label "Platform"
      end
      field "osType" do
        label "Operating System"
      end
      field "hostname" do
        label "Hostname"
      end
      field "cost" do
        label "Estimated Monthly Cost"
      end
      field "instance_type_price" do
        label "Current Monthly List Price"
      end
      field "superseded_type_price" do
        label "New Monthly List Price"
      end
      field "savings" do
        label "Estimated Monthly Savings"
      end
      field "savingsCurrency" do
        label "Savings Currency"
      end
      field "launchTime" do
        label "Launch Time"
      end
      field "service" do
        label "Service"
      end
      field "resourceARN" do
        label "Resource ARN"
      end
      field "id" do
        label "ID"
        path "resourceID"
      end
    end
  end
end

###############################################################################
# Escalations
###############################################################################

escalation "esc_email" do
  automatic true
  label "Send Email"
  description "Send incident email"
  email $param_email
end

escalation "esc_change_type" do
  automatic contains($param_automatic_action, "Change Instance Type")
  label "Change Instance Type"
  description "Approval to change instance type for all superseded EC2 instances"
  run "change_instances", data
end

###############################################################################
# Cloud Workflow
###############################################################################

# Core CWF function to downsize instances
define change_instances($data) return $all_responses do
  $$all_responses = []

  foreach $instance in $data do
    sub on_error: handle_error() do
      call get_instance_state($instance) retrieve $state_response, $initial_state
      $$all_responses << $state_response

      if $initial_state != "terminated" && $initial_state != "pending"
        if $initial_state != "stopped"
          call stop_instance($instance) retrieve $stop_response
          $$all_responses << $stop_response
        end

        call change_instance($instance) retrieve $change_response
        $$all_responses << $change_response

        if $initial_state == "running"
          call start_instance($instance) retrieve $start_response
          $$all_responses << $start_response
        end
      end
    end
  end

  if inspect($$errors) != "null"
    raise join($$errors, "\n")
  end
end

# CWF function to change an instance type
define change_instance($instance) return $response do
  $change_url = "https://" + "ec2." + $instance["region"] + ".amazonaws.com/?Action=ModifyInstanceAttribute&Version=2016-11-15&InstanceId=" + $instance["resourceID"] + "&InstanceType.Value=" + $instance["newResourceType"]
  task_label("POST " + $change_url)

  $response = http_request(
    auth: $$auth_aws,
    https: true,
    verb: "post",
    href: "/",
    host: "ec2." + $instance["region"] + ".amazonaws.com",
    query_strings: {
      "Action": "ModifyInstanceAttribute",
      "Version": "2016-11-15",
      "InstanceId": $instance["resourceID"],
      "InstanceType.Value": $instance["newResourceType"]
    }
  )

  task_label("Post AWS EC2 instance response: " + $instance["resourceID"] + " " + to_json($response))
  $$all_responses << to_json({"req": "POST " + $change_url, "resp": $response})

  if $response["code"] != 200 && $response["code"] != 202 && $response["code"] != 204
    raise "Unexpected response posting AWS EC2 instance: "+ $instance["resourceID"] + " " + to_json($response)
  else
    task_label("Post AWS EC2 instance request Accepted and the operation will complete asynchronously")

    call get_instance_state($instance) retrieve $state_response, $current_state
    sleep(5)

    while $current_state != "stopped" do
      task_label('Post AWS EC2 instance Status (waiting for "stopped" state): ' + $current_state) + ' ' + $instance["resourceID"]
      call get_instance_state($instance) retrieve $state_response, $current_state
      sleep(5)
    end

    task_label("Post AWS EC2 instance successful: " + $instance["resourceID"])
  end
end

# CWF function to start an instance
define start_instance($instance) return $response do
  $start_url = "https://" + "ec2." + $instance["region"] + ".amazonaws.com/?Action=StartInstances&Version=2016-11-15&InstanceId.1=" + $instance["resourceID"]
  task_label("POST " + $start_url)

  $response = http_request(
    auth: $$auth_aws,
    https: true,
    verb: "post",
    href: "/",
    host: "ec2." + $instance['region'] + ".amazonaws.com",
    query_strings: {
      "Action": "StartInstances",
      "Version": "2016-11-15",
      "InstanceId.1": $instance["resourceID"]
    }
  )

  task_label("Post AWS EC2 instance response: " + $instance["resourceID"] + " " + to_json($response))
  $$all_responses << to_json({"req": "POST " + $start_url, "resp": $response})

  if $response["code"] != 200 && $response["code"] != 202 && $response["code"] != 204
    raise "Unexpected response posting AWS EC2 instance: "+ $instance["resourceID"] + " " + to_json($response)
  else
    task_label("Post AWS EC2 instance successful: " + $instance["resourceID"])
  end
end

# CWF function to stop an instance
define stop_instance($instance) return $response do
  $stop_url = "https://" + "ec2." + $instance["region"] + ".amazonaws.com/?Action=StopInstances&Version=2016-11-15&InstanceId.1=" + $instance["resourceID"]
  task_label("POST " + $stop_url)

  $response = http_request(
    auth: $$auth_aws,
    https: true,
    verb: "post",
    href: "/",
    host: "ec2." + $instance['region'] + ".amazonaws.com",
    query_strings: {
      "Action": "StopInstances",
      "Version": "2016-11-15",
      "InstanceId.1": $instance["resourceID"]
    }
  )

  task_label("Post AWS EC2 instance response: " + $instance["resourceID"] + " " + to_json($response))
  $$all_responses << to_json({"req": "POST " + $stop_url, "resp": $response})

  if $response["code"] != 200 && $response["code"] != 202 && $response["code"] != 204
    raise "Unexpected response posting AWS EC2 instance: "+ $instance["resourceID"] + " " + to_json($response)
  else
    task_label("Post AWS EC2 instance request Accepted and the operation will complete asynchronously")

    call get_instance_state($instance) retrieve $state_response, $current_state
    sleep(5)

    while $current_state != "stopped" do
      task_label('Post AWS EC2 instance Status (waiting for "stopped" state): ' + $current_state) + ' ' + $instance["resourceID"]
      call get_instance_state($instance) retrieve $state_response, $current_state
      sleep(5)
    end

    task_label("Post AWS EC2 instance successful: " + $instance["resourceID"])
  end
end

# CWF function to get the current state of an instance
define get_instance_state($instance) return $response, $instance_state do
  $state_url = "https://" + "ec2." + $instance["region"] + ".amazonaws.com/?Action=DescribeInstanceStatus&Version=2016-11-15&IncludeAllInstances=true&InstanceId.1=" + $instance["resourceID"]
  task_label("POST " + $state_url)

  $response = http_request(
    auth: $$auth_aws,
    https: true,
    verb: "post",
    href: "/",
    host: "ec2." + $instance["region"] + ".amazonaws.com",
    query_strings: {
      "Action": "DescribeInstanceStatus",
      "Version": "2016-11-15",
      "IncludeAllInstances": "true",
      "InstanceId.1": $instance["resourceID"]
    }
  )

  task_label("Post AWS EC2 instance response: " + $instance["resourceID"] + " " + to_json($response))
  $$all_responses << to_json({"req": "POST " + $state_url, "resp": $response})

  if $response["code"] != 200 && $response["code"] != 202 && $response["code"] != 204
    raise "Unexpected response posting AWS EC2 instance: "+ $instance["resourceID"] + " " + to_json($response)
  else
    task_label("Post AWS EC2 instance successful: " + $instance["resourceID"])
    $instance_state = $response["body"]["DescribeInstanceStatusResponse"]["instanceStatusSet"]["item"]["instanceState"]["name"]
  end
end

define handle_error() do
  if !$$errors
    $$errors = []
  end
  $$errors << $_error["type"] + ": " + $_error["message"]
  # We check for errors at the end, and raise them all together
  # Skip errors handled by this definition
  $_error_behavior = "skip"
end

###############################################################################
# Meta Policy [alpha]
# Not intended to be modified or used by policy developers
###############################################################################

# If the meta_parent_policy_id is not set it will evaluate to an empty string and we will look for the policy itself,
# if it is set we will look for the parent policy.
datasource "ds_get_policy" do
  request do
    auth $auth_flexera
    host rs_governance_host
    ignore_status [404]
    path join(["/api/governance/projects/", rs_project_id, "/applied_policies/", switch(ne(meta_parent_policy_id, ""), meta_parent_policy_id, policy_id) ])
    header "Api-Version", "1.0"
  end
  result do
    encoding "json"
    field "id", jmes_path(response, "id")
  end
end

datasource "ds_parent_policy_terminated" do
  run_script $js_decide_if_self_terminate, $ds_get_policy, policy_id, meta_parent_policy_id
end

# If the policy was applied by a meta_parent_policy we confirm it exists if it doesn't we confirm we are deleting
# This information is used in two places:
# - determining whether or not we make a delete call
# - determining if we should create an incident (we don't want to create an incident on the run where we terminate)
script "js_decide_if_self_terminate", type: "javascript" do
  parameters "found", "self_policy_id", "meta_parent_policy_id"
  result "result"
  code <<-EOS
  var result
  if (meta_parent_policy_id != "" && found.id == undefined) {
    result = true
  } else {
    result = false
  }
  EOS
end

# Two potentials ways to set this up:
# - this way and make a unneeded 'get' request when not deleting
# - make the delete request an interate and have it iterate over an empty array when not deleting and an array with one item when deleting
script "js_make_terminate_request", type: "javascript" do
  parameters "should_delete", "policy_id", "rs_project_id", "rs_governance_host"
  result "request"
  code <<-EOS

  var request = {
    auth:  'auth_flexera',
    host: rs_governance_host,
    path: "/api/governance/projects/" + rs_project_id + "/applied_policies/" + policy_id,
    headers: {
      "API-Version": "1.0",
      "Content-Type":"application/json"
    },
  }

  if (should_delete) {
    request.verb = 'DELETE'
  }
  EOS
end

datasource "ds_terminate_self" do
  request do
    run_script $js_make_terminate_request, $ds_parent_policy_terminated, policy_id, rs_project_id, rs_governance_host
  end
end

datasource "ds_is_deleted" do
  run_script $js_check_deleted, $ds_terminate_self
end

# This is just a way to have the check delete request connect to the farthest leaf from policy.
# We want the delete check to the first thing the policy does to avoid the policy erroring before it can decide whether or not it needs to self terminate
# Example a customer deletes a credential and then terminates the parent policy. We still want the children to self terminate
# The only way I could see this not happening is if the user who applied the parent_meta_policy was offboarded or lost policy access, the policies who are impersonating the user
# would not have access to self-terminate
# It may be useful for the backend to enable a mass terminate at some point for all meta_child_policies associated with an id.
script "js_check_deleted", type: "javascript" do
  parameters "response"
  result "result"
  code <<-EOS
  result = {"path":"/"}
  EOS
end