Add Slack support to Execution Policy API

.generator/schemas/v2/openapi.yaml

@@ -42088,12 +42088,14 @@ components:
         - INTEGRATION_KUBERNETES
         - INTEGRATION_SCRIPT
         - INTEGRATION_REMOTE_ACTION
+        - INTEGRATION_SLACK
       example: INTEGRATION_SCRIPT
       type: string
       x-enum-varnames:
         - INTEGRATION_KUBERNETES
         - INTEGRATION_SCRIPT
         - INTEGRATION_REMOTE_ACTION
+        - INTEGRATION_SLACK
     ExecutionPolicyKubernetesScope:
       description: Restricts the policy to specific Kubernetes namespaces.
       properties:
@@ -42216,16 +42218,18 @@ components:
       type: object
     ExecutionPolicyScope:
       description: |-
-        Restricts where the policy applies. At most one of `kubernetes`, `scripts`,
-        or `remote_action_rshell` can be set. An empty object means the policy has
-        no scope restriction.
+        Restricts where the policy applies. At most one scope type can be set,
+        and it must match the action pattern's integration. An empty object means
+        the policy has no scope restriction.
       properties:
         kubernetes:
           $ref: "#/components/schemas/ExecutionPolicyKubernetesScope"
         remote_action_rshell:
           $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScope"
         scripts:
           $ref: "#/components/schemas/ExecutionPolicyScriptScope"
+        slack:
+          $ref: "#/components/schemas/ExecutionPolicySlackScope"
       type: object
     ExecutionPolicyScriptScope:
       description: Restricts the policy to specific scripts.
@@ -42251,11 +42255,43 @@ components:
       required:
         - target_script_names
       type: object
+    ExecutionPolicySlackScope:
+      description: Restricts the policy to specific Slack private channel names.
+      properties:
+        rules:
+          description: The Slack scope rules.
+          items:
+            $ref: "#/components/schemas/ExecutionPolicySlackScopeRule"
+          minItems: 1
+          type: array
+      required:
+        - rules
+      type: object
+    ExecutionPolicySlackScopeRule:
+      description: A rule restricting a Slack scope to specific private channel names.
+      properties:
+        channel_name_selectors:
+          description: |-
+            The private channel name selectors this rule applies to. Selectors are lowercase private channel names
+            without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name.
+          example:
+            - "incident-*"
+          items:
+            maxLength: 80
+            minLength: 1
+            type: string
+          maxItems: 100
+          minItems: 1
+          type: array
+          uniqueItems: true
+      required:
+        - channel_name_selectors
+      type: object
     ExecutionPolicyTarget:
-      description: A target this policy is scoped to, expressed as a set of Agent tags.
+      description: A target this policy is scoped to, expressed as a set of tags.
       properties:
         agent_tags:
-          description: The Agent tags identifying the target.
+          description: The tags identifying the target.
           example:
             - "env:prod"
           items:
@@ -255987,9 +256023,8 @@ tags:
     name: Events
   - description: |-
       Execution policies control which actions Datadog Action Platform is allowed to run
-      against your infrastructure, and where. Each policy pairs an effect (allow or deny)
-      with a pattern of actions, and can scope that decision to specific Kubernetes
-      namespaces, scripts, or remote shell paths.
+      and where. Each policy pairs an effect (allow or deny) with a pattern of actions,
+      and can scope that decision to specific resources.
     name: Execution Policy
   - description: Create and manage experiments, metrics, subject types, SQL models, and protocols.
     name: Experiments

examples/v2/execution-policy/CreateExecutionPolicy_1868371302.py

@@ -0,0 +1,39 @@
+"""
+Create a Slack execution policy returns "Created" response
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi
+from datadog_api_client.v2.model.execution_policy_action_pattern import ExecutionPolicyActionPattern
+from datadog_api_client.v2.model.execution_policy_create_request import ExecutionPolicyCreateRequest
+from datadog_api_client.v2.model.execution_policy_create_request_data import ExecutionPolicyCreateRequestData
+from datadog_api_client.v2.model.execution_policy_effect import ExecutionPolicyEffect
+from datadog_api_client.v2.model.execution_policy_integration import ExecutionPolicyIntegration
+from datadog_api_client.v2.model.execution_policy_type import ExecutionPolicyType
+from datadog_api_client.v2.model.execution_policy_write_attributes import ExecutionPolicyWriteAttributes
+
+body = ExecutionPolicyCreateRequest(
+    data=ExecutionPolicyCreateRequestData(
+        type=ExecutionPolicyType.EXECUTION_POLICY,
+        attributes=ExecutionPolicyWriteAttributes(
+            name="Cassette Execution Policy exampleexecutionpolicy",
+            effect=ExecutionPolicyEffect.ALLOW,
+            action_pattern=ExecutionPolicyActionPattern(
+                integration=ExecutionPolicyIntegration.INTEGRATION_SLACK,
+                action_fqns=[
+                    "com.datadoghq.slack.*",
+                ],
+            ),
+        ),
+    ),
+)
+
+configuration = Configuration()
+configuration.access_token = environ["DD_BEARER_TOKEN"]
+configuration.unstable_operations["create_execution_policy"] = True
+with ApiClient(configuration) as api_client:
+    api_instance = ExecutionPolicyApi(api_client)
+    response = api_instance.create_execution_policy(body=body)
+
+    print(response)

examples/v2/execution-policy/CreateExecutionPolicy_3240435177.py

@@ -0,0 +1,62 @@
+"""
+Create a Slack execution policy with scope and targets returns "Created" response
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi
+from datadog_api_client.v2.model.execution_policy_action_pattern import ExecutionPolicyActionPattern
+from datadog_api_client.v2.model.execution_policy_create_request import ExecutionPolicyCreateRequest
+from datadog_api_client.v2.model.execution_policy_create_request_data import ExecutionPolicyCreateRequestData
+from datadog_api_client.v2.model.execution_policy_effect import ExecutionPolicyEffect
+from datadog_api_client.v2.model.execution_policy_integration import ExecutionPolicyIntegration
+from datadog_api_client.v2.model.execution_policy_scope import ExecutionPolicyScope
+from datadog_api_client.v2.model.execution_policy_slack_scope import ExecutionPolicySlackScope
+from datadog_api_client.v2.model.execution_policy_slack_scope_rule import ExecutionPolicySlackScopeRule
+from datadog_api_client.v2.model.execution_policy_target import ExecutionPolicyTarget
+from datadog_api_client.v2.model.execution_policy_type import ExecutionPolicyType
+from datadog_api_client.v2.model.execution_policy_write_attributes import ExecutionPolicyWriteAttributes
+
+body = ExecutionPolicyCreateRequest(
+    data=ExecutionPolicyCreateRequestData(
+        type=ExecutionPolicyType.EXECUTION_POLICY,
+        attributes=ExecutionPolicyWriteAttributes(
+            name="Cassette Execution Policy exampleexecutionpolicy",
+            effect=ExecutionPolicyEffect.ALLOW,
+            action_pattern=ExecutionPolicyActionPattern(
+                integration=ExecutionPolicyIntegration.INTEGRATION_SLACK,
+                action_fqns=[
+                    "com.datadoghq.slack.*",
+                ],
+            ),
+            scope=ExecutionPolicyScope(
+                slack=ExecutionPolicySlackScope(
+                    rules=[
+                        ExecutionPolicySlackScopeRule(
+                            channel_name_selectors=[
+                                "incident-*",
+                            ],
+                        ),
+                    ],
+                ),
+            ),
+            targets=[
+                ExecutionPolicyTarget(
+                    name="Incident workspace",
+                    agent_tags=[
+                        "slack_workspace_id:T01234567",
+                    ],
+                ),
+            ],
+        ),
+    ),
+)
+
+configuration = Configuration()
+configuration.access_token = environ["DD_BEARER_TOKEN"]
+configuration.unstable_operations["create_execution_policy"] = True
+with ApiClient(configuration) as api_client:
+    api_instance = ExecutionPolicyApi(api_client)
+    response = api_instance.create_execution_policy(body=body)
+
+    print(response)

examples/v2/execution-policy/ListExecutionPolicies_4120778561.py

@@ -0,0 +1,21 @@
+"""
+List execution policies filtered by Slack returns "OK" response
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi
+from datadog_api_client.v2.model.execution_policy_integration import ExecutionPolicyIntegration
+
+configuration = Configuration()
+configuration.access_token = environ["DD_BEARER_TOKEN"]
+configuration.unstable_operations["list_execution_policies"] = True
+with ApiClient(configuration) as api_client:
+    api_instance = ExecutionPolicyApi(api_client)
+    response = api_instance.list_execution_policies(
+        filter_integration=[
+            ExecutionPolicyIntegration.INTEGRATION_SLACK,
+        ],
+    )
+
+    print(response)

examples/v2/execution-policy/UpdateExecutionPolicy_2851872075.py

@@ -0,0 +1,66 @@
+"""
+Update an execution policy to Slack with scope and targets returns "OK" response
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.execution_policy_api import ExecutionPolicyApi
+from datadog_api_client.v2.model.execution_policy_action_pattern import ExecutionPolicyActionPattern
+from datadog_api_client.v2.model.execution_policy_effect import ExecutionPolicyEffect
+from datadog_api_client.v2.model.execution_policy_integration import ExecutionPolicyIntegration
+from datadog_api_client.v2.model.execution_policy_scope import ExecutionPolicyScope
+from datadog_api_client.v2.model.execution_policy_slack_scope import ExecutionPolicySlackScope
+from datadog_api_client.v2.model.execution_policy_slack_scope_rule import ExecutionPolicySlackScopeRule
+from datadog_api_client.v2.model.execution_policy_target import ExecutionPolicyTarget
+from datadog_api_client.v2.model.execution_policy_type import ExecutionPolicyType
+from datadog_api_client.v2.model.execution_policy_update_request import ExecutionPolicyUpdateRequest
+from datadog_api_client.v2.model.execution_policy_update_request_data import ExecutionPolicyUpdateRequestData
+from datadog_api_client.v2.model.execution_policy_write_attributes import ExecutionPolicyWriteAttributes
+
+# there is a valid "execution_policy" in the system
+EXECUTION_POLICY_DATA_ID = environ["EXECUTION_POLICY_DATA_ID"]
+
+body = ExecutionPolicyUpdateRequest(
+    data=ExecutionPolicyUpdateRequestData(
+        id=EXECUTION_POLICY_DATA_ID,
+        type=ExecutionPolicyType.EXECUTION_POLICY,
+        attributes=ExecutionPolicyWriteAttributes(
+            name="Cassette Execution Policy Updated",
+            effect=ExecutionPolicyEffect.DENY,
+            action_pattern=ExecutionPolicyActionPattern(
+                integration=ExecutionPolicyIntegration.INTEGRATION_SLACK,
+                action_fqns=[
+                    "*",
+                ],
+            ),
+            scope=ExecutionPolicyScope(
+                slack=ExecutionPolicySlackScope(
+                    rules=[
+                        ExecutionPolicySlackScopeRule(
+                            channel_name_selectors=[
+                                "incident-denied",
+                            ],
+                        ),
+                    ],
+                ),
+            ),
+            targets=[
+                ExecutionPolicyTarget(
+                    name="Incident workspace",
+                    agent_tags=[
+                        "slack_workspace_id:T01234567",
+                    ],
+                ),
+            ],
+        ),
+    ),
+)
+
+configuration = Configuration()
+configuration.access_token = environ["DD_BEARER_TOKEN"]
+configuration.unstable_operations["update_execution_policy"] = True
+with ApiClient(configuration) as api_client:
+    api_instance = ExecutionPolicyApi(api_client)
+    response = api_instance.update_execution_policy(policy_id=EXECUTION_POLICY_DATA_ID, body=body)
+
+    print(response)

src/datadog_api_client/v2/api/execution_policy_api.py

@@ -22,9 +22,8 @@
 class ExecutionPolicyApi:
     """
     Execution policies control which actions Datadog Action Platform is allowed to run
-    against your infrastructure, and where. Each policy pairs an effect (allow or deny)
-    with a pattern of actions, and can scope that decision to specific Kubernetes
-    namespaces, scripts, or remote shell paths.
+    and where. Each policy pairs an effect (allow or deny) with a pattern of actions,
+    and can scope that decision to specific resources.
     """
 
     def __init__(self, api_client=None):

src/datadog_api_client/v2/model/execution_policy_attributes.py

@@ -93,9 +93,9 @@ def __init__(
         :param name: The name of the execution policy.
         :type name: str
 
-        :param scope: Restricts where the policy applies. At most one of ``kubernetes`` , ``scripts`` ,
-            or ``remote_action_rshell`` can be set. An empty object means the policy has
-            no scope restriction.
+        :param scope: Restricts where the policy applies. At most one scope type can be set,
+            and it must match the action pattern's integration. An empty object means
+            the policy has no scope restriction.
         :type scope: ExecutionPolicyScope, optional
 
         :param targets: The targets this policy applies to.

src/datadog_api_client/v2/model/execution_policy_integration.py

@@ -16,18 +16,20 @@ class ExecutionPolicyIntegration(ModelSimple):
     """
     The integration the action pattern applies to.
 
-    :param value: Must be one of ["INTEGRATION_KUBERNETES", "INTEGRATION_SCRIPT", "INTEGRATION_REMOTE_ACTION"].
+    :param value: Must be one of ["INTEGRATION_KUBERNETES", "INTEGRATION_SCRIPT", "INTEGRATION_REMOTE_ACTION", "INTEGRATION_SLACK"].
     :type value: str
     """
 
     allowed_values = {
         "INTEGRATION_KUBERNETES",
         "INTEGRATION_SCRIPT",
         "INTEGRATION_REMOTE_ACTION",
+        "INTEGRATION_SLACK",
     }
     INTEGRATION_KUBERNETES: ClassVar["ExecutionPolicyIntegration"]
     INTEGRATION_SCRIPT: ClassVar["ExecutionPolicyIntegration"]
     INTEGRATION_REMOTE_ACTION: ClassVar["ExecutionPolicyIntegration"]
+    INTEGRATION_SLACK: ClassVar["ExecutionPolicyIntegration"]
 
     @cached_property
     def openapi_types(_):
@@ -39,3 +41,4 @@ def openapi_types(_):
 ExecutionPolicyIntegration.INTEGRATION_KUBERNETES = ExecutionPolicyIntegration("INTEGRATION_KUBERNETES")
 ExecutionPolicyIntegration.INTEGRATION_SCRIPT = ExecutionPolicyIntegration("INTEGRATION_SCRIPT")
 ExecutionPolicyIntegration.INTEGRATION_REMOTE_ACTION = ExecutionPolicyIntegration("INTEGRATION_REMOTE_ACTION")
+ExecutionPolicyIntegration.INTEGRATION_SLACK = ExecutionPolicyIntegration("INTEGRATION_SLACK")