refactor(checks): migrate Oracle to Rego

Signed-off-by: Nikita Pivkin <[email protected]>

avd_docs/oracle/compute/AVD-OCI-0001/docs.md

@@ -3,8 +3,9 @@ Compute instance requests an IP reservation from a public pool
 
 The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
 
+
 ### Impact
-The compute instance has the ability to be reached from outside
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}

checks/cloud/oracle/compute/no_public_ip.go

@@ -27,7 +27,8 @@ The compute instance has the ability to be reached from outside, you might want
 			Links:               terraformNoPublicIpLinks,
 			RemediationMarkdown: terraformNoPublicIpRemediationMarkdown,
 		},
-		Severity: severity.Critical,
+		Severity:   severity.Critical,
+		Deprecated: true,
 	},
 	func(s *state.State) (results scan.Results) {
 		for _, reservation := range s.Oracle.Compute.AddressReservations {

checks/cloud/oracle/compute/no_public_ip.rego

@@ -0,0 +1,41 @@
+# METADATA
+# title: Compute instance requests an IP reservation from a public pool
+# description: |
+#   Compute instance requests an IP reservation from a public pool
+#
+#   The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
+# scope: package
+# schemas:
+#   - input: schema["cloud"]
+# custom:
+#   id: AVD-OCI-0001
+#   avd_id: AVD-OCI-0001
+#   provider: oracle
+#   service: compute
+#   severity: CRITICAL
+#   short_code: no-public-ip
+#   recommended_action: Reconsider the use of an public IP
+#   input:
+#     selector:
+#       - type: cloud
+#         subtypes:
+#           - service: compute
+#             provider: oracle
+#   terraform:
+#     links:
+#       - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_ip_address_reservation
+#       - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_instance
+#     good_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
+#     bad_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
+package builtin.oracle.compute.oracle0001
+
+import rego.v1
+
+deny contains res if {
+	some reservation in input.oracle.compute.addressreservations
+
+	# TODO: future improvement: we need to see what this IP is used for before flagging
+	reservation.pool.value == "public-ippool"
+
+	res := result.new("Reservation made for public IP address.", reservation.pool)
+}

checks/cloud/oracle/compute/no_public_ip_test.rego

@@ -0,0 +1,20 @@
+package builtin.oracle.compute.oracle0001_test
+
+import rego.v1
+
+import data.builtin.oracle.compute.oracle0001 as check
+import data.lib.test
+
+test_deny_pool_is_public if {
+	inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "public-ippool"}}]}}}
+
+	res := check.deny with input as inp
+	count(res) == 1
+}
+
+test_allow_pool_is_cloud if {
+	inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "cloud-ippool"}}]}}}
+
+	res := check.deny with input as inp
+	res == set()
+}