resource "cyral_repository" "repo" {
  type = "mysql"
  name = "GABRIEL_MYSQL_REGO"

  repo_node {
    host = "mysql.cyral.com"
    port = 3306
  }
}

# Creates pg data repository
resource "cyral_repository" "repo2" {
  type = "postgresql"
  name = "my_pg"

  repo_node {
    host = "pg.cyral.com"
    port = 5432
  }
}

# create policy instance from template
resource "cyral_rego_policy_instance" "policy0" {
  name        = "data-firewall-policy"
  category    = "SECURITY"
  description = "Filter 'finance.cards' when someone (except 'Admin' group) reads it"
  template_id = "data-firewall"
  parameters  = "{ \"dataSet\": \"finance.cards\", \"dataFilter\": \" finance.cards.country = 'US' \", \"labels\": [\"CCN\"], \"excludedIdentities\": { \"groups\": [\"Admin\"] } }"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo2.id]
  }
  tags = ["tag1", "tag2"]
}

# create policy instance from template
resource "cyral_rego_policy_instance" "policy1" {
  name        = "data-masking-policy"
  category    = "SECURITY"
  description = "Masks label CCN for identities in Marketing group"
  template_id = "data-masking"
  parameters  = "{ \"maskType\": \"NULL_MASK\", \"labels\": [\"CCN\"], \"identities\": { \"included\": { \"groups\": [\"Marketing\"] } }}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo.id]
  }
  tags = ["tag1", "tag2"]
}

# create policy instance from template
resource "cyral_rego_policy_instance" "policy2" {
  name        = "data-protection-policy"
  category    = "SECURITY"
  description = "Protect label CCN for update and delete queries"
  template_id = "data-protection"
  parameters  = "{ \"block\": true, \"alertSeverity\": \"high\", \"monitorUpdates\": true, \"monitorDeletes\": true, \"labels\": [\"CCN\"]}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo.id]
  }
  tags = ["tag1", "tag2"]
}

 create policy instance from template
 resource "cyral_rego_policy_instance" "policy3" {
   name        = "dataset-protection"
   category    = "SECURITY"
   description = "Blocks reads and updates over schema 'finance' and dataset 'cyral.customers'."
   template_id = "dataset-protection"
   parameters  = "{ \"block\": true, \"alertSeverity\": \"high\", \"monitorUpdates\": true, \"monitorReads\": true, \"datasets\": {\"disallowed\": [\"finance.*\", \"cyral.customers\"]}}"
   enabled     = true
   scope {
     repo_ids = [cyral_repository.repo2.id]
   }
 }

# create policy instance from template
resource "cyral_rego_policy_instance" "policy4" {
  name        = "rate-limit-policy"
  category    = "SECURITY"
  description = "Implement a threshold on label CCN for group Marketing of 500 rows per hour"
  template_id = "rate-limit"
  parameters  = "{ \"rateLimit\": 500, \"block\": true, \"alertSeverity\": \"high\", \"labels\": [\"CCN\"], \"identities\": { \"included\": { \"groups\": [\"Marketing\"] } }}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo2.id]
  }
  tags = ["tag1", "tag2"]
}

# create policy instance from template
resource "cyral_rego_policy_instance" "policy5" {
  name        = "read-limit-policy"
  category    = "SECURITY"
  description = "Limits to 100 the amount of rows that can be read per query on all repository data for group 'Devs'"
  template_id = "read-limit"
  parameters  = "{ \"rowLimit\": 100, \"block\": true, \"alertSeverity\": \"high\", \"appliesToAllData\": true, \"identities\": { \"included\": { \"groups\": [\"Devs\"] } }}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo2.id]
  }
}


resource "cyral_rego_policy_instance" "policy6" {
  name        = "repository-protection-policy"
  category    = "SECURITY"
  description = "Limits to 100 the amount of rows that can be updated or deleted per query on all repository data for anyone except group 'Admin'"
  template_id = "repository-protection"
  parameters  = "{ \"rowLimit\": 100, \"block\": true, \"alertSeverity\": \"high\", \"monitorUpdates\": true, \"monitorDeletes\": true, \"identities\": { \"excluded\": { \"groups\": [\"Admin\"] } }}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo.id]
  }
}

resource "cyral_rego_policy_instance" "policy7" {
  name        = "service account abuse policy"
  category    = "SECURITY"
  description = "Always require user attribution for service acount 'john'"
  template_id = "service-account-abuse"
  parameters  = "{ \"block\": true, \"alertSeverity\": \"high\", \"serviceAccounts\": [\"john\"]}"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo2.id]
  }
}

resource "cyral_rego_policy_instance" "policy8" {
  name        = "user-segmentation-policy"
  category    = "SECURITY"
  description = "Applies a data filter in 'finance.cards' when someone from group 'Marketing' reads data labeled as 'CCN'"
  template_id = "user-segmentation"
  parameters  = "{ \"dataSet\": \"finance.cards\", \"dataFilter\": \" finance.cards.country = 'US' \", \"labels\": [\"CCN\"], \"includedIdentities\": { \"groups\": [\"Marketing\"] } }"
  enabled     = true
  scope {
    repo_ids = [cyral_repository.repo.id]
  }
  tags = ["tag1", "tag2"]
}