PC-10567 AWS accountId for cloudwatch

manifest/v1alpha/metrics.go

@@ -119,6 +119,7 @@ type ElasticsearchMetric struct {
 
 // CloudWatchMetric represents metric from CloudWatch.
 type CloudWatchMetric struct {
+	AccountID  *string                     `json:"accountId,omitempty"`
 	Region     *string                     `json:"region" validate:"required,max=255"`
 	Namespace  *string                     `json:"namespace,omitempty"`
 	MetricName *string                     `json:"metricName,omitempty"`

manifest/v1alpha/validator.go

@@ -2720,19 +2720,43 @@ func cloudWatchMetricStructValidation(sl v.StructLevel) {
 		sl.ReportError(cloudWatchMetric.JSON, "json", "JSON", "exactlyOneConfigType", "")
 		return
 	}
-	regions := AWSRegions()
 
 	switch {
 	case isJSON:
 		validateCloudWatchJSONQuery(sl, cloudWatchMetric)
 	case isConfiguration:
 		validateCloudWatchConfiguration(sl, cloudWatchMetric)
 	}
-	if !isValidRegion(*cloudWatchMetric.Region, regions) {
+
+	if isJSON && cloudWatchMetric.AccountID != nil && len(*cloudWatchMetric.AccountID) > 0 {
+		sl.ReportError(cloudWatchMetric.AccountID, "accountId", "AccountID", "accountIdMustBeEmpty", "")
+	}
+
+	if isSQL && cloudWatchMetric.AccountID != nil && len(*cloudWatchMetric.AccountID) > 0 {
+		sl.ReportError(cloudWatchMetric.AccountID, "accountId", "AccountID", "accountIdForSQLNotSupported", "")
+	}
+
+	if isConfiguration && cloudWatchMetric.AccountID != nil && !isValidAWSAccountID(*cloudWatchMetric.AccountID) {
+		sl.ReportError(cloudWatchMetric.AccountID, "accountId", "AccountID", "accountIdInvalid", "")
+	}
+
+	if cloudWatchMetric.Region != nil && !isValidRegion(*cloudWatchMetric.Region, AWSRegions()) {
 		sl.ReportError(cloudWatchMetric.Region, "region", "Region", "regionNotAvailable", "")
 	}
 }
 
+// isValidAWSAccountID checks if the provided string is a valid AWS account ID.
+// An AWS account ID is a 12-digit number, or it can be an empty string.
+func isValidAWSAccountID(accountID string) bool {
+	if len(accountID) == 0 {
+		return true
+	}
+	if match, _ := regexp.MatchString(`^[0-9]{12}$`, accountID); match {
+		return true
+	}
+	return false
+}
+
 func redshiftCountMetricsSpecValidation(sl v.StructLevel) {
 	countMetrics, ok := sl.Current().Interface().(CountMetricsSpec)
 	if !ok {
@@ -3076,6 +3100,9 @@ func validateCloudWatchJSONQuery(sl v.StructLevel, cloudWatchMetric CloudWatchMe
 		if metricData.ReturnData != nil && !*metricData.ReturnData {
 			returnedValues--
 		}
+		if metricData.AccountId != nil && metricData.Expression != nil {
+			sl.ReportError(cloudWatchMetric.AccountID, "json", "JSON", "accountIdForSQLNotSupported", "")
+		}
 		if metricData.MetricStat != nil {
 			if metricData.MetricStat.Period == nil {
 				sl.ReportError(cloudWatchMetric.JSON, "json", "JSON", "requiredPeriod", "")
@@ -3089,6 +3116,9 @@ func validateCloudWatchJSONQuery(sl v.StructLevel, cloudWatchMetric CloudWatchMe
 				sl.ReportError(cloudWatchMetric.JSON, "json", "JSON", "invalidPeriodValue", "")
 			}
 		}
+		if metricData.AccountId != nil && !isValidAWSAccountID(*metricData.AccountId) {
+			sl.ReportError(cloudWatchMetric.AccountID, "accountId", "AccountID", "accountIdInvalid", "")
+		}
 	}
 	if returnedValues != 1 {
 		sl.ReportError(cloudWatchMetric.JSON, "json", "JSON", "onlyOneReturnValueRequired", "")

manifest/v1alpha/validator_test.go

@@ -5,6 +5,7 @@ import (
 	"sort"
 	"testing"
 
+	"github.com/aws/aws-sdk-go/aws"
 	v "github.com/go-playground/validator/v10"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/exp/slices"
@@ -1173,3 +1174,267 @@ func TestAzureMonitorSloSpecValidation(t *testing.T) {
 		})
 	}
 }
+
+func Test_isValidAWSAccountID(t *testing.T) {
+	tests := []struct {
+		name      string
+		accountID string
+		want      bool
+	}{
+		{
+			name:      "allow empty accountID",
+			accountID: "",
+			want:      true,
+		},
+		{
+			name:      "allow proper accountID",
+			accountID: "123456789012",
+			want:      true,
+		},
+		{
+			name:      "deny too short numeric accountID",
+			accountID: "1234",
+			want:      false,
+		},
+		{
+			name:      "deny too long numeric accountID",
+			accountID: "1234567890121",
+			want:      false,
+		},
+		{
+			name:      "deny too short alfa-numeric accountID",
+			accountID: "1234avb",
+			want:      false,
+		},
+		{
+			name:      "deny 12 char alfa-numeric accountID",
+			accountID: "1234avb12345",
+			want:      false,
+		},
+		{
+			name:      "deny 12 char alfa accountID",
+			accountID: "abcerjasdyja",
+			want:      false,
+		},
+		{
+			name:      "deny short char alfa accountID",
+			accountID: "abcasdyja",
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, isValidAWSAccountID(tt.accountID), "isValidCloudWatchAccountID(%v)", tt.accountID)
+		})
+	}
+}
+
+func Test_cloudWatchMetricStructValidation(t *testing.T) {
+	validator := v.New()
+	validator.RegisterStructValidation(cloudWatchMetricStructValidation, CloudWatchMetric{})
+	_ = validator.RegisterValidation("uniqueDimensionNames", areDimensionNamesUnique)
+
+	type fieldError struct {
+		field string
+		tag   string
+	}
+
+	tests := []struct {
+		name          string
+		metric        CloudWatchMetric
+		wantErrorTags []fieldError
+	}{
+		{
+			name: "exact one config type",
+			metric: CloudWatchMetric{
+				SQL:  aws.String("test"),
+				JSON: aws.String("test"),
+			},
+			wantErrorTags: []fieldError{
+				{"Region", "required"},
+				{"stat", "exactlyOneConfigType"},
+				{"sql", "exactlyOneConfigType"},
+				{"json", "exactlyOneConfigType"},
+			},
+		},
+		{
+			name: "invalid region",
+			metric: CloudWatchMetric{
+				SQL:    aws.String("test"),
+				Region: aws.String("test"),
+			},
+			wantErrorTags: []fieldError{
+				{"region", "regionNotAvailable"},
+			},
+		},
+		{
+			name: "invalid accountId",
+			metric: CloudWatchMetric{
+				Namespace:  aws.String("namespace"),
+				Region:     aws.String("us-east-2"),
+				MetricName: aws.String("metric"),
+				Stat:       aws.String("Average"),
+				Dimensions: []CloudWatchMetricDimension{},
+				AccountID:  aws.String("1234"),
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdInvalid"},
+			},
+		},
+		{
+			name: "accountId for json config must be empty",
+			metric: CloudWatchMetric{
+				JSON:      aws.String(`[{"id":"1","period":60}]`),
+				Region:    aws.String("us-east-2"),
+				AccountID: aws.String("1234"),
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdMustBeEmpty"},
+			},
+		},
+		{
+			name: "empty region will not throw panic",
+			metric: CloudWatchMetric{
+				JSON:      aws.String(`[{"id":"1","period":60}]`),
+				AccountID: aws.String("1234"),
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdMustBeEmpty"},
+				{"Region", "required"},
+			},
+		},
+		{
+			name: "AccountId must be empty for JSON",
+			metric: CloudWatchMetric{
+				JSON:   aws.String(`[{"id":"1","period":60}]`),
+				Region: aws.String("us-east-2"),
+			},
+			wantErrorTags: []fieldError{},
+		},
+		{
+			name: "accountId for configuration config is optional",
+			metric: CloudWatchMetric{
+				Namespace:  aws.String("namespace"),
+				Region:     aws.String("us-east-2"),
+				MetricName: aws.String("metric"),
+				Stat:       aws.String("Average"),
+				Dimensions: []CloudWatchMetricDimension{},
+			},
+			wantErrorTags: []fieldError{},
+		},
+		{
+			name: "accountId for configuration config is validated",
+			metric: CloudWatchMetric{
+				AccountID:  aws.String("1234"),
+				Namespace:  aws.String("namespace"),
+				Region:     aws.String("us-east-2"),
+				MetricName: aws.String("metric"),
+				Stat:       aws.String("Average"),
+				Dimensions: []CloudWatchMetricDimension{},
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdInvalid"},
+			},
+		},
+		{
+			name: "accountId for sql not supported",
+			metric: CloudWatchMetric{
+				AccountID: aws.String("1234"),
+				SQL:       aws.String("test sql"),
+				Region:    aws.String("us-east-2"),
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdForSQLNotSupported"},
+			},
+		},
+		{
+			name: "accountId for json with sql is not supported",
+			metric: CloudWatchMetric{
+				JSON:   aws.String(`[{"Id": "m1","AccountId":"123456789012", "Expression": "SQL TEST","Period": 60}]`),
+				Region: aws.String("us-east-2"),
+			},
+			wantErrorTags: []fieldError{
+				{"json", "accountIdForSQLNotSupported"},
+			},
+		},
+		{
+			name: "accountId for supported json query",
+			metric: CloudWatchMetric{
+				JSON: aws.String(`[
+					{
+						"Id": "m1",
+						"AccountId": "123456789012",
+						"MetricStat": {
+							"Metric": {
+								"Namespace": "AWS/ApplicationELB",
+								"MetricName": "HTTPCode_Target_2XX_Count",
+								"Dimensions": [
+									{
+										"Name": "LoadBalancer",
+										"Value": "app/main-default-appingress-350b/904311bedb964754"
+									}
+								]
+							},
+							"Period": 60,
+							"Stat": "SampleCount"
+						}
+					}
+				]`),
+				Region: aws.String("us-east-2"),
+			},
+			wantErrorTags: []fieldError{},
+		},
+		{
+			name: "validate accountId in json query",
+			metric: CloudWatchMetric{
+				JSON: aws.String(`[
+					{
+						"Id": "m1",
+						"AccountId": "12345678",
+						"MetricStat": {
+							"Metric": {
+								"Namespace": "AWS/ApplicationELB",
+								"MetricName": "HTTPCode_Target_2XX_Count",
+								"Dimensions": [
+									{
+										"Name": "LoadBalancer",
+										"Value": "app/main-default-appingress-350b/904311bedb964754"
+									}
+								]
+							},
+							"Period": 60,
+							"Stat": "SampleCount"
+						}
+					}
+				]`),
+				Region: aws.String("us-east-2"),
+			},
+			wantErrorTags: []fieldError{
+				{"accountId", "accountIdInvalid"},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validator.Struct(tt.metric)
+			if len(tt.wantErrorTags) == 0 {
+				assert.Nil(t, err)
+				return
+			}
+
+			validationErrors, ok := err.(v.ValidationErrors)
+			if !ok {
+				t.Error("Expected a validation error, but got a different error type")
+			}
+
+			var tags []fieldError
+			for _, err := range validationErrors {
+				tags = append(tags, fieldError{tag: err.Tag(), field: err.Field()})
+			}
+
+			assert.ElementsMatch(t, tags, tt.wantErrorTags)
+		})
+	}
+}