# ###################################
##       Rule Specification        ##
#####################################
# 
# Rule Identifier:
#    ecr_private_lifecycle_policy_configured_check
# 
# Description:
#   This control checks whether a private Amazon Elastic Container Registry (ECR) repository has at least one lifecycle policy configured.
# 
# Reports on:
#    AWS::ECR::Repository
# 
# Evaluates:
#    AWS CloudFormation, AWS CloudFormation hook
# 
# Rule Parameters:
#    None
# 
# Scenarios:
#  Scenario: 1
#    Given: The input document is an AWS CloudFormation or CloudFormation hook document
#      And: The input document does not contain any ECR repository resources
#     Then: SKIP
#  Scenario: 2
#    Given: The input document is an AWS CloudFormation or CloudFormation hook document
#      And: The input document contains an ECR repository resource
#      And: 'LifecyclePolicy' is not present
#     Then: FAIL
#  Scenario: 3
#    Given: The input document is an AWS CloudFormation or CloudFormation hook document
#      And: The input document contains an ECR repository resource
#      And: 'LifecyclePolicy' is present
#      And: 'LifecyclePolicyText' has not been provided in the 'LifecyclePolicy' configuration or has been provided as
#            an empty string
#     Then: FAIL
#  Scenario: 4
#    Given: The input document is an AWS CloudFormation or CloudFormation hook document
#      And: The input document contains an ECR repository resource
#      And: 'LifecyclePolicy' is present
#      And: 'LifecyclePolicyText' has been provided in the 'LifecyclePolicy' configuration with a non-empty string
#     Then: PASS

#
# Constants
#
let ECR_REPOSITORY_TYPE = "AWS::ECR::Repository"
let INPUT_DOCUMENT = this

#
# Assignments
#
let ecr_repositories = Resources.*[ Type == %ECR_REPOSITORY_TYPE ]

#
# Primary Rules
#
rule ecr_private_lifecycle_policy_configured_check when is_cfn_template(%INPUT_DOCUMENT)
                                                        %ecr_repositories not empty {
    check(%ecr_repositories.Properties)
        <<
        [CT.ECR.PR.1]: Require Amazon ECR repositories to have a lifecycle policy configured
        [FIX]: Provide a 'LifecyclePolicy' configuration and set 'LifecyclePolicyText' to an Amazon ECR repository lifecycle policy.
        >>
}

rule ecr_private_lifecycle_policy_configured_check when is_cfn_hook(%INPUT_DOCUMENT, %ECR_REPOSITORY_TYPE) {
    check(%INPUT_DOCUMENT.%ECR_REPOSITORY_TYPE.resourceProperties)
        <<
        [CT.ECR.PR.1]: Require Amazon ECR repositories to have a lifecycle policy configured
        [FIX]: Provide a 'LifecyclePolicy' configuration and set 'LifecyclePolicyText' to an Amazon ECR repository lifecycle policy.
        >>
}

#
# Parameterized Rules
#
rule check(ecr_repository) {
    %ecr_repository {
        #Scenario 3
        LifecyclePolicy exists
        LifecyclePolicy is_struct
        LifecyclePolicy {
            #Scenario 4
            LifecyclePolicyText exists
            check_is_string_and_not_empty(LifecyclePolicyText)
        }
    }
}

#
# Utility Rules
#
rule check_is_string_and_not_empty(value) {
     %value {
         this is_string
         this != /\A\s*\z/
     }
}

rule is_cfn_template(doc) {
    %doc {
        AWSTemplateFormatVersion exists  or
        Resources exists
    }
}

rule is_cfn_hook(doc, RESOURCE_TYPE) {
    %doc.%RESOURCE_TYPE.resourceProperties exists
}