rules:
  - id: azure-monitor-log-profile-retention-days
    message: >-
      Ensure that Activity Log Retention is set 365 days or greater
    patterns:
      - pattern: resource
      - pattern-not-inside: |
          resource "azurerm_monitor_log_profile" "..." {
          ...
          retention_policy {
            ...
            enabled = true
            days = 365
            ...
          }
          ...
          }
      - pattern-not-inside: |
          resource "azurerm_monitor_log_profile" "..." {
          ...
          retention_policy {
            ...
            enabled = false
            days = 0
            ...
          }
          ...
          }
      - pattern-inside: |
          resource "azurerm_monitor_log_profile" "..." {
          ...
          }
    metadata:
      category: best-practice
      technology:
        - terraform
        - azure
    languages: [hcl]
    severity: WARNING