docs(governance console): generate the available controls list

.gitignore

@@ -274,6 +274,7 @@ data/permissions.json
 data/agent_config.json
 data/workflow_bundles.json
 data/python_action_libs.json
+data/governance_controls.json
 
 agent_config_types_list.txt
 

content/en/account_management/governance_console/controls.md

@@ -50,81 +50,21 @@ Controls are organized by usage concern: security, cost optimization, and data h
 
 Security controls detect and correct configuration that could lead to increased risk of a security incident in your Datadog account.
 
-Unused API Keys 
-: Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials. The default threshold is 30 days of inactivity, and can be adjusted.<br/><br/> 
-
-  Enforcement automatically identifies and revokes inactive API keys to improve security and reduce potential attack surface.
-
-Unused Application Keys
-: Identifies application keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials. The default threshold is 30 days of inactivity, and can be adjusted. <br/><br/>
-
-  Enforcement automatically identifies and revokes inactive application keys to improve security and reduce potential attack surface.
-
-Roles Without Users
-: Identifies roles that have no active users assigned to them, indicating potential cleanup opportunities.<br/><br/>
-
-  _This control does not support enforcement. Manual removal of unused roles required._
-
-Users in No Teams
-: Identifies active users that are not in any teams, indicating potential cleanup opportunities.<br/><br/>
-
-  _This control does not support enforcement._
+{{< account_management/governance_controls usage_concern="Security" >}}
 {{% /collapse-content %}}
 
 {{% collapse-content title="Cost optimization" level="h3" expanded=false id="cost-optimization" %}}
 
 Cost optimization controls detect and correct configuration that could lead to increased spending on low value usage.
 
-Unqueried Metrics
-: Identifies metrics that are rarely or never queried and are not associated with any monitors, dashboards, SLOs, or notebooks, indicating potential cost savings opportunities.<br/><br/>
-
-  Enforcement automatically removes unused metric tags using Metrics without Limits™ to optimize cardinality and reduce costs.
-
-Inactive Metric Tag
-: Identifies metric tags that are rarely or never queried and are not associated with any monitors, dashboards, SLOs, or notebooks, presenting opportunities to reduce cardinality and costs.<br/><br/>
-
-  Enforcement automatically configures Metrics without Limits™ to allowlist only active tags on filtered metrics, optimizing cardinality and cost efficiency.
-
-Synthetic Tests with Muted Monitors
-: Identifies synthetic tests with muted monitors, which may indicate potential cost savings opportunities.<br/><br/>
-
-  _This control does not support enforcement._
+{{< account_management/governance_controls usage_concern="Cost Optimization" >}}
 {{% /collapse-content %}}
 
 {{% collapse-content title="Data hygiene" level="h3" expanded=false id="data-hygiene" %}}
 
 Data hygiene controls detect and correct configuration that could lead to increased assets that are low quality or have unclear ownership.
 
-Unused Dashboards
-: Identifies dashboards that have not been viewed within your specified time threshold, helping maintain a clean and organized workspace. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards. The default Dashboard Activity Lookback Period is 30 days of query activity, and can be adjusted.<br/><br/>
-
-  Enforcement automatically deletes dashboards to maintain a clean and organized workspace.
-
-Dashboards Owned by Disabled Users
-: Identifies dashboards whose owner is a disabled user, which may impact dashboard maintenance and updates. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards.<br/><br/>
-
-  _This control does not support enforcement._
-
-Dashboards Without Team Tags
-: Identifies dashboards that lack a team tag, making it difficult to track ownership and maintain accountability. The default Dashboard Query includes all dashboards, but can be adjusted to select a specific scope of dashboards. The default Dashboard Activity Lookback Period is 30 days of query activity, and can be adjusted.<br/><br/>
-
-  _This control does not support enforcement._
-
-Notebooks Without Team Tags
-: Identifies notebooks that lack a team tag, making it difficult to track ownership and maintain accountability. <br/><br/>
-
-  _This control does not support enforcement._
-
-Monitors Without Team Tags
-: Identifies monitors that lack a team tag, making it difficult to track ownership and maintain accountability.<br/><br/>
-
-  _This control does not support enforcement._
-
-Monitors with Broken Notification Handles
-: Identifies monitors that contain invalid or broken @-mention handles, which may prevent notifications from reaching the intended recipients.<br/><br/>
-
-  _This control does not support enforcement._
-
-  {{% /collapse-content %}}
+{{< account_management/governance_controls usage_concern="Data Hygiene" >}}
+{{% /collapse-content %}}
 
 [1]: https://app.datadoghq.com/governance/controls

layouts/shortcodes/account_management/governance_controls.html

@@ -0,0 +1,41 @@
+{{/*
+    Renders the Governance Console controls for a single usage concern as a
+    definition list, from data/governance_controls.json.
+
+    Note:
+    - json file mounted from websites-sources: https://github.com/ddoghq/websites-sources/tree/main/data/governance_controls.json
+    - the generator publishes only controls with release_status "prod", and only
+      mitigations that are not feature flagged, so everything here is available
+      to every org.
+    - call this once per section. The intro prose for each section stays in
+      controls.md; only the control entries are generated.
+
+    @param usage_concern: string - which group to render. One of "Security",
+                          "Cost Optimization" or "Data Hygiene". Must match a
+                          key in the data file.
+*/}}
+
+{{- $usage_concern := .Get "usage_concern" -}}
+{{- $controls := index $.Site.Data.governance_controls $usage_concern -}}
+
+{{- if not $controls -}}
+    {{- $groups := slice -}}
+    {{- range $group, $_ := $.Site.Data.governance_controls -}}
+        {{- $groups = $groups | append $group -}}
+    {{- end -}}
+    {{- errorf "governance_controls: no controls found for usage_concern %q in data/governance_controls.json. Available groups: %v" $usage_concern $groups -}}
+{{- end -}}
+
+{{/* Markup mirrors what a markdown definition list compiles to, so the
+     generated entries render identically to the hand-written ones they
+     replaced. */}}
+<dl>
+{{- range $controls }}
+<dt>{{ .name }}</dt>
+<dd>{{ .description }}<br/><br/>
+{{ if .enforcement }}{{ range .enforcement }}<p>Enforcement: {{ . }}</p>
+{{ end }}{{ else }}<p><em>This control does not support enforcement.</em></p>
+{{ end -}}
+</dd>
+{{- end }}
+</dl>