Merge pull request #2 from asomensari-es/feat/cleanup-nrql-query

feat: add nrql_query CSV column, cleanup mode for deleting unused assets

Author: asomensari-es

README.md

@@ -18,6 +18,7 @@ import (
 	"github.com/newrelic/newrelic-client-go/v2/newrelic"
 
 	"github.com/asomensari-es/nr-tf-util/internal/audit"
+	"github.com/asomensari-es/nr-tf-util/internal/cleanup"
 	"github.com/asomensari-es/nr-tf-util/internal/config"
 	"github.com/asomensari-es/nr-tf-util/internal/generator"
 	"github.com/asomensari-es/nr-tf-util/internal/ratelimit"
@@ -55,8 +56,10 @@ func main() {
 	)
 	var accountIDs multiString
 	var skipList multiString
+	var assetTypes multiString
 	flag.Var(&accountIDs, "account-id", "Account ID to scan (repeat for multiple; default: auto-discover)")
 	flag.Var(&skipList, "skip", "Fetcher/asset type to skip (repeat for multiple)")
+	flag.Var(&assetTypes, "asset-type", "Asset type to clean up (repeat for multiple; cleanup mode only)")
 
 	flag.Usage = func() {
 		fmt.Fprintf(os.Stderr, `nr-tf-util %s — New Relic Terraform utility
@@ -65,11 +68,14 @@ USAGE
   nr-tf-util [options]
 
 MODES
+  --mode audit    Scan accounts for hardcoded entity IDs and GUIDs that will
+                  break during an account migration, and flag alert configuration
+                  health issues (disabled conditions, empty policies, etc.).
+                  Optionally export findings to CSV with --csv.
+  --mode cleanup  Read an audit CSV (--csv) and permanently delete the matched
+                  assets. Requires --asset-type. Supports --dry-run.
   --mode import   (default) Scan accounts and generate Terraform import blocks
                   ready for: terraform plan -generate-config-out=resources.tf
-  --mode audit    Scan accounts for hardcoded entity IDs and GUIDs that will
-                  break during an account migration, and print a report with
-                  migration suggestions.
 
 AUTHENTICATION
   --api-key <key>       New Relic User API key (NRAK-...)
@@ -78,6 +84,7 @@ AUTHENTICATION
 ACCOUNT SELECTION
   --account-id <id>     Account ID to scan (repeat for multiple accounts)
                         Omit to auto-discover all accessible accounts
+                        (not used in cleanup mode — accounts come from CSV)
 
 REGION
   --region <name>       US (default) | EU | FedRAMP | JP
@@ -97,21 +104,52 @@ FILTERING
     workloads                service_levels
     workflows
 
+AUDIT MODE FLAGS
+  --csv <file>          Write findings to a CSV file (e.g. --csv findings.csv)
+
+CLEANUP MODE FLAGS
+  --csv <file>          Input CSV file produced by audit mode (required)
+  --asset-type <type>   Asset type to delete (repeat for multiple; required)
+                        Supported values: nrql_condition  alert_policy
+  --dry-run             Print what would be deleted without deleting anything
+
 IMPORT MODE FLAGS
   --out <dir>           Root output directory (default: ./output)
                         One subdirectory per account: <out>/<accountId>-<slug>/
   --dry-run             Show what would be written without writing any files
 
-AUDIT MODE FLAGS
-  (no additional flags — uses the same filtering, rate-limit, and timeout options)
-
 BEHAVIOUR
   --verbose             Show additional detail in progress output
   --quiet               Suppress all non-error output
   --rate-limit <n>      Max API requests per second (default: 25)
   --max-retries <n>     Max retries on API failure (default: 3)
   --timeout <duration>  Per-account timeout, e.g. 2m30s (default: 5m)
 
+EXAMPLES — audit mode
+  export NEW_RELIC_API_KEY=NRAK-...
+
+  # Audit all accessible accounts
+  nr-tf-util --mode audit
+
+  # Audit a single account and export findings to CSV
+  nr-tf-util --mode audit --account-id 2883194 --csv findings.csv
+
+  # Skip legacy-condition and uncovered-policy checks
+  nr-tf-util --mode audit --skip legacy_conditions --skip uncovered_alert_policies
+
+EXAMPLES — cleanup mode
+  # Dry-run: see what would be deleted from the CSV
+  nr-tf-util --mode cleanup --csv findings.csv \
+    --asset-type nrql_condition --dry-run
+
+  # Delete disabled NRQL conditions
+  nr-tf-util --mode cleanup --csv findings.csv \
+    --asset-type nrql_condition
+
+  # Delete both empty policies and disabled conditions
+  nr-tf-util --mode cleanup --csv findings.csv \
+    --asset-type alert_policy --asset-type nrql_condition
+
 EXAMPLES — import mode
   # Generate import blocks for all accessible accounts
   nr-tf-util --api-key NRAK-...
@@ -123,21 +161,6 @@ EXAMPLES — import mode
   # Skip dashboards and workloads
   nr-tf-util --api-key NRAK-... --skip dashboards --skip workloads
 
-EXAMPLES — audit mode
-  # Audit all accessible accounts for hardcoded IDs
-  nr-tf-util --mode audit --api-key NRAK-...
-
-  # Audit a specific account
-  nr-tf-util --mode audit --api-key NRAK-... --account-id 2883194
-
-  # Audit only dashboards and NRQL conditions
-  nr-tf-util --mode audit --api-key NRAK-... \
-    --skip workloads --skip service_levels --skip workflows
-
-  # Use an environment variable for the key
-  export NEW_RELIC_API_KEY=NRAK-...
-  nr-tf-util --mode audit --account-id 2883194
-
 NEXT STEPS (after import mode)
   cd output/<account-dir>/
   terraform init
@@ -157,9 +180,9 @@ NEXT STEPS (after import mode)
 
 	// ── Validate mode ──────────────────────────────────────────────────────────
 	switch *mode {
-	case "import", "audit":
+	case "import", "audit", "cleanup":
 	default:
-		fmt.Fprintf(os.Stderr, "error: unknown --mode %q (valid: import, audit)\n\n", *mode)
+		fmt.Fprintf(os.Stderr, "error: unknown --mode %q (valid: audit, cleanup, import)\n\n", *mode)
 		flag.Usage()
 		os.Exit(1)
 	}
@@ -198,11 +221,20 @@ NEXT STEPS (after import mode)
 	printf("\nnr-tf-util %s   [mode: %s]\n\n", Version, *mode)
 	printf("  Region   ..... %s\n", reg.Name)
 	printf("  Endpoint ..... %s\n", reg.NerdGraphURL)
-	if *mode == "import" {
+	switch *mode {
+	case "import":
 		printf("  Output   ..... %s\n", *outDir)
 		if *dryRun {
 			printf("  [DRY-RUN — no files will be written]\n")
 		}
+	case "cleanup":
+		printf("  CSV input .... %s\n", *csvOut)
+		if *dryRun {
+			printf("  [DRY-RUN — no assets will be deleted]\n")
+		}
+		if len(assetTypes) > 0 {
+			printf("  Asset types .. %s\n", strings.Join(assetTypes, ", "))
+		}
 	}
 	printf("  Rate limit ... %d req/s\n", *rateLimit)
 	if len(skipList) > 0 {
@@ -228,10 +260,17 @@ NEXT STEPS (after import mode)
 
 	ng := &nrClient.NerdGraph
 
-	// ── Resolve accounts ───────────────────────────────────────────────────────
+	// ── Resolve accounts (not needed for cleanup — accounts come from the CSV) ──
 	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
 	defer cancel()
 
+	limiter := ratelimit.New(*rateLimit)
+
+	if *mode == "cleanup" {
+		runCleanup(ctx, ng, *csvOut, assetTypes, *dryRun)
+		return
+	}
+
 	var accounts []resources.Account
 
 	if len(accountIDs) > 0 {
@@ -276,7 +315,6 @@ NEXT STEPS (after import mode)
 	for _, s := range skipList {
 		skipSet[s] = true
 	}
-	limiter := ratelimit.New(*rateLimit)
 
 	// ── Mode branch ────────────────────────────────────────────────────────────
 	switch *mode {
@@ -459,6 +497,48 @@ func runAudit(
 	printf("Duration: %s\n\n", elapsed)
 }
 
+// ── Cleanup mode ─────────────────────────────────────────────────────────────
+
+func runCleanup(ctx context.Context, ng resources.NerdGrapher, csvPath string, assetTypes []string, dryRun bool) {
+	if csvPath == "" {
+		fmt.Fprintln(os.Stderr, "error: --csv <file> is required for cleanup mode")
+		os.Exit(1)
+	}
+	if len(assetTypes) == 0 {
+		fmt.Fprintln(os.Stderr, "error: --asset-type is required for cleanup mode (supported: nrql_condition, alert_policy)")
+		os.Exit(1)
+	}
+	supported := make([]string, 0, len(cleanup.SupportedAssetTypes))
+	for k := range cleanup.SupportedAssetTypes {
+		supported = append(supported, k)
+	}
+	sort.Strings(supported)
+	for _, at := range assetTypes {
+		if !cleanup.SupportedAssetTypes[at] {
+			fmt.Fprintf(os.Stderr, "error: unknown --asset-type %q (supported: %s)\n", at, strings.Join(supported, ", "))
+			os.Exit(1)
+		}
+	}
+
+	f, err := os.Open(csvPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: cannot open CSV file %q: %v\n", csvPath, err)
+		os.Exit(1)
+	}
+	defer f.Close()
+
+	targets, err := cleanup.ParseCSV(f, assetTypes)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: parsing CSV: %v\n", err)
+		os.Exit(1)
+	}
+
+	if err := cleanup.Run(ctx, ng, targets, dryRun, os.Stdout, os.Stdin); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
 var nonAlnum = regexp.MustCompile(`[^a-z0-9]+`)

cmd/main.go

@@ -19,11 +19,12 @@ type AuditFetcher interface {
 	Fetch(ctx context.Context, ng resources.NerdGrapher, accountID int) ([]Finding, error)
 }
 
-// Finding is a single hardcoded ID reference found within a New Relic asset.
+// Finding is a single hardcoded ID reference or configuration issue found within a New Relic asset.
 type Finding struct {
 	AssetType  string // "dashboard", "nrql_condition", "workload", "service_level", "workflow"
 	AssetName  string // human-readable asset name
 	AssetID    string // GUID or numeric ID of the containing asset
+	NRQLQuery  string // NRQL query where the issue was found; empty for non-query assets
 	Location   string // e.g. "widget: Error Rate", "condition query", "static entity list"
 	IDType     string // "entityGuid", "appId", "hostId", "entityId", "monitorId"
 	IDValue    string // the raw hardcoded value found in the asset

internal/audit/auditor.go

@@ -9,6 +9,7 @@ import (
 var csvHeaders = []string{
 	"account_id", "account_name",
 	"asset_type", "asset_id", "asset_name",
+	"nrql_query",
 	"location", "id_type", "id_value",
 	"resolved", "entity_name", "entity_type",
 	"suggestion",
@@ -31,6 +32,7 @@ func WriteCSV(w io.Writer, results []*AuditResult) error {
 			row := []string{
 				accountID, r.Account.Name,
 				f.AssetType, f.AssetID, f.AssetName,
+				f.NRQLQuery,
 				f.Location, f.IDType, f.IDValue,
 				resolved, f.EntityName, f.EntityType,
 				f.Suggestion,

internal/audit/csv.go

@@ -30,6 +30,7 @@ func TestWriteCSV_Headers(t *testing.T) {
 	want := []string{
 		"account_id", "account_name",
 		"asset_type", "asset_id", "asset_name",
+		"nrql_query",
 		"location", "id_type", "id_value",
 		"resolved", "entity_name", "entity_type",
 		"suggestion",
@@ -84,13 +85,14 @@ func TestWriteCSV_IDFinding(t *testing.T) {
 	assertEqual(t, row, 2, "nrql_condition")
 	assertEqual(t, row, 3, "1234:99")
 	assertEqual(t, row, 4, "High Error Rate")
-	assertEqual(t, row, 5, "condition query")
-	assertEqual(t, row, 6, "appId")
-	assertEqual(t, row, 7, "555")
-	assertEqual(t, row, 8, "true")
-	assertEqual(t, row, 9, "Checkout Service")
-	assertEqual(t, row, 10, "APPLICATION")
-	assertEqual(t, row, 11, "Replace with: appName = 'Checkout Service'")
+	assertEqual(t, row, 5, "")              // nrql_query (not set on this finding)
+	assertEqual(t, row, 6, "condition query")
+	assertEqual(t, row, 7, "appId")
+	assertEqual(t, row, 8, "555")
+	assertEqual(t, row, 9, "true")
+	assertEqual(t, row, 10, "Checkout Service")
+	assertEqual(t, row, 11, "APPLICATION")
+	assertEqual(t, row, 12, "Replace with: appName = 'Checkout Service'")
 }
 
 func TestWriteCSV_ConfigFinding(t *testing.T) {
@@ -118,12 +120,13 @@ func TestWriteCSV_ConfigFinding(t *testing.T) {
 		t.Fatalf("expected 2 rows, got %d", len(rows))
 	}
 	row := rows[1]
-	assertEqual(t, row, 6, "")  // id_type empty
-	assertEqual(t, row, 7, "")  // id_value empty
-	assertEqual(t, row, 8, "false") // resolved false
-	assertEqual(t, row, 9, "")  // entity_name empty
-	assertEqual(t, row, 10, "") // entity_type empty
-	assertEqual(t, row, 11, "Condition is disabled — enable it or remove it to reduce policy noise")
+	assertEqual(t, row, 5, "")      // nrql_query (not set)
+	assertEqual(t, row, 7, "")      // id_type empty
+	assertEqual(t, row, 8, "")      // id_value empty
+	assertEqual(t, row, 9, "false") // resolved false
+	assertEqual(t, row, 10, "")     // entity_name empty
+	assertEqual(t, row, 11, "")     // entity_type empty
+	assertEqual(t, row, 12, "Condition is disabled — enable it or remove it to reduce policy noise")
 }
 
 func TestWriteCSV_MultipleAccounts(t *testing.T) {

internal/audit/csv_test.go

@@ -65,6 +65,7 @@ query($accountId: Int!, $cursor: String) {
 					AssetType: "nrql_condition",
 					AssetName: c.Name,
 					AssetID:   fmt.Sprintf("%d:%s", accountID, c.ID),
+					NRQLQuery: c.NRQL.Query,
 					Location:  m.Location,
 					IDType:    m.IDType,
 					IDValue:   m.IDValue,

internal/audit/fetch_conditions.go

@@ -35,6 +35,10 @@ func TestConditionsAuditFetcher_HardcodedID(t *testing.T) {
 	if f.IDValue != "55555" {
 		t.Errorf("IDValue = %q, want 55555", f.IDValue)
 	}
+	wantQuery := "SELECT count(*) FROM Transaction WHERE appId = 55555"
+	if f.NRQLQuery != wantQuery {
+		t.Errorf("NRQLQuery = %q, want %q", f.NRQLQuery, wantQuery)
+	}
 }
 
 func TestConditionsAuditFetcher_NoHardcodedIDs(t *testing.T) {

internal/audit/fetch_conditions_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/asomensari-es/nr-tf-util/internal/resources"
 )
@@ -118,11 +119,13 @@ query($guid: EntityGuid!) {
 				if page.Name != "" {
 					location = fmt.Sprintf("page %q · widget: %s", page.Name, widget.Title)
 				}
+				nrqlQuery := extractWidgetNRQL(widget.RawConfiguration)
 				for _, m := range ScanText(string(widget.RawConfiguration), location) {
 					findings = append(findings, Finding{
 						AssetType: "dashboard",
 						AssetName: dash.name,
 						AssetID:   dash.guid,
+						NRQLQuery: nrqlQuery,
 						Location:  m.Location,
 						IDType:    m.IDType,
 						IDValue:   m.IDValue,
@@ -134,3 +137,23 @@ query($guid: EntityGuid!) {
 
 	return findings, nil
 }
+
+// extractWidgetNRQL parses a widget's rawConfiguration JSON and returns all
+// nrqlQueries[].query values joined with " | ". Returns "" if none are found.
+func extractWidgetNRQL(raw json.RawMessage) string {
+	var cfg struct {
+		NRQLQueries []struct {
+			Query string `json:"query"`
+		} `json:"nrqlQueries"`
+	}
+	if err := json.Unmarshal(raw, &cfg); err != nil || len(cfg.NRQLQueries) == 0 {
+		return ""
+	}
+	queries := make([]string, 0, len(cfg.NRQLQueries))
+	for _, q := range cfg.NRQLQueries {
+		if q.Query != "" {
+			queries = append(queries, q.Query)
+		}
+	}
+	return strings.Join(queries, " | ")
+}