Skip to content

Commit ba527d5

Browse files
Samir-Cittrodge
authored and
akshat-jindal-nit
committed
Migrate google_compute_firewall_policy_rule resource from DCL to MMv1 (GoogleCloudPlatform#11360)
Co-authored-by: Thomas Rodgers <[email protected]>
1 parent bb5acea commit ba527d5

File tree

9 files changed

+434
-23
lines changed

9 files changed

+434
-23
lines changed

‎mmv1/products/compute/FirewallPolicyRule.yaml

+245
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,245 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'FirewallPolicyRule'
16+
kind: 'compute#firewallPolicyRule'
17+
description: |
18+
Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).
19+
min_version: 'beta'
20+
references:
21+
guides:
22+
api: 'https://cloud.google.com/compute/docs/reference/rest/v1/firewallPolicies/addRule'
23+
docs:
24+
id_format: 'locations/global/firewallPolicies/{{firewall_policy}}/rules/{{priority}}'
25+
base_url: 'locations/global/firewallPolicies/{{firewall_policy}}'
26+
self_link: 'locations/global/firewallPolicies/{{firewall_policy}}/getRule?priority={{priority}}'
27+
create_url: 'locations/global/firewallPolicies/{{firewall_policy}}/addRule'
28+
update_url: 'locations/global/firewallPolicies/{{firewall_policy}}/patchRule?priority={{priority}}'
29+
update_verb: 'POST'
30+
delete_url: 'locations/global/firewallPolicies/{{firewall_policy}}/removeRule?priority={{priority}}'
31+
delete_verb: 'POST'
32+
import_format:
33+
- 'locations/global/firewallPolicies/{{firewall_policy}}/rules/{{priority}}'
34+
- '{{firewall_policy}}/{{priority}}'
35+
timeouts:
36+
insert_minutes: 20
37+
update_minutes: 20
38+
delete_minutes: 20
39+
custom_diff:
40+
- 'tpgresource.DefaultProviderProject'
41+
custom_code:
42+
post_create: 'templates/terraform/post_create/compute_firewall_policy_rule.go.tmpl'
43+
post_delete: 'templates/terraform/post_delete/compute_firewall_policy_rule.go.tmpl'
44+
post_update: 'templates/terraform/post_update/compute_firewall_policy_rule.go.tmpl'
45+
examples:
46+
- name: 'firewall_policy_rule'
47+
primary_resource_id: 'policy_rule'
48+
vars:
49+
fw_policy: 'policy'
50+
address: 'address'
51+
folder: 'folder'
52+
test_env_vars:
53+
org_id: 'ORG_ID'
54+
service_account: 'SERVICE_ACCT'
55+
parameters:
56+
- name: 'firewallPolicy'
57+
type: ResourceRef
58+
description: |
59+
The firewall policy of the resource.
60+
ignore_read: true
61+
required: true
62+
immutable: true
63+
diff_suppress_func: 'tpgresource.CompareResourceNames'
64+
custom_expand: 'templates/terraform/custom_expand/compute_firewall_policy_rule.go.tmpl'
65+
resource: 'FirewallPolicy'
66+
imports: 'name'
67+
properties:
68+
- name: 'creationTimestamp'
69+
type: String
70+
description: |
71+
Creation timestamp in RFC3339 text format.
72+
output: true
73+
- name: 'kind'
74+
type: String
75+
description: |
76+
Type of the resource. Always `compute#firewallPolicyRule` for firewall policy rules
77+
output: true
78+
- name: 'description'
79+
type: String
80+
description: 'An optional description for this resource.'
81+
- name: 'priority'
82+
type: Integer
83+
immutable: true
84+
description: |
85+
An integer indicating the priority of a rule in the list.
86+
The priority must be a positive value between 0 and 2147483647.
87+
Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.
88+
required: true
89+
- name: 'match'
90+
type: NestedObject
91+
description: |
92+
A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
93+
required: true
94+
properties:
95+
- name: 'srcIpRanges'
96+
type: Array
97+
send_empty_value: true
98+
description: |
99+
CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 5000.
100+
item_type:
101+
type: String
102+
- name: 'destIpRanges'
103+
type: Array
104+
send_empty_value: true
105+
description: |
106+
CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 5000.
107+
item_type:
108+
type: String
109+
- name: 'layer4Configs'
110+
type: Array
111+
send_empty_value: true
112+
description: |
113+
Pairs of IP protocols and ports that the rule should match.
114+
required: true
115+
item_type:
116+
type: NestedObject
117+
properties:
118+
- name: 'ipProtocol'
119+
type: String
120+
description: |
121+
The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule.
122+
This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
123+
required: true
124+
- name: 'ports'
125+
type: Array
126+
description: |
127+
An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port.
128+
Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
129+
item_type:
130+
type: String
131+
- name: 'destAddressGroups'
132+
type: Array
133+
send_empty_value: true
134+
description: |
135+
Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
136+
item_type:
137+
type: String
138+
- name: 'srcAddressGroups'
139+
type: Array
140+
send_empty_value: true
141+
description: |
142+
Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
143+
item_type:
144+
type: String
145+
- name: 'srcFqdns'
146+
type: Array
147+
send_empty_value: true
148+
description: |
149+
Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
150+
item_type:
151+
type: String
152+
- name: 'destFqdns'
153+
type: Array
154+
send_empty_value: true
155+
description: |
156+
Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
157+
item_type:
158+
type: String
159+
- name: 'srcRegionCodes'
160+
type: Array
161+
send_empty_value: true
162+
description: |
163+
Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
164+
item_type:
165+
type: String
166+
- name: 'destRegionCodes'
167+
type: Array
168+
send_empty_value: true
169+
description: |
170+
Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of dest region codes allowed is 5000.
171+
item_type:
172+
type: String
173+
- name: 'destThreatIntelligences'
174+
type: Array
175+
send_empty_value: true
176+
description: |
177+
Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
178+
item_type:
179+
type: String
180+
- name: 'srcThreatIntelligences'
181+
type: Array
182+
send_empty_value: true
183+
description: |
184+
Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
185+
item_type:
186+
type: String
187+
- name: 'action'
188+
type: String
189+
description: 'The Action to perform when the client connection triggers the rule. Valid actions are "allow", "deny", "goto_next" and "apply_security_profile_group".'
190+
required: true
191+
- name: 'securityProfileGroup'
192+
type: String
193+
description: |
194+
A fully-qualified URL of a SecurityProfile resource instance.
195+
Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group
196+
Must be specified if action = 'apply_security_profile_group' and cannot be specified for other actions.
197+
- name: 'tlsInspect'
198+
type: Boolean
199+
description: |
200+
Boolean flag indicating if the traffic should be TLS decrypted.
201+
Can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
202+
- name: 'direction'
203+
type: Enum
204+
description: |
205+
The direction in which this rule applies.
206+
required: true
207+
enum_values:
208+
- 'INGRESS'
209+
- 'EGRESS'
210+
- name: 'targetResources'
211+
type: Array
212+
send_empty_value: true
213+
description: |
214+
A list of network resource URLs to which this rule applies.
215+
This field allows you to control which network's VMs get this rule.
216+
If this field is left blank, all VMs within the organization will receive the rule.
217+
diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
218+
item_type:
219+
type: String
220+
- name: 'enableLogging'
221+
type: Boolean
222+
send_empty_value: true
223+
description: |
224+
Denotes whether to enable logging for a particular rule.
225+
If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
226+
Logs may be exported to BigQuery or Pub/Sub.
227+
Note: you cannot enable logging on "goto_next" rules.
228+
- name: 'ruleTupleCount'
229+
type: Integer
230+
description: |
231+
Calculation of the complexity of a single firewall policy rule.
232+
output: true
233+
- name: 'targetServiceAccounts'
234+
type: Array
235+
send_empty_value: true
236+
description: |
237+
A list of service accounts indicating the sets of instances that are applied with this rule.
238+
item_type:
239+
type: String
240+
- name: 'disabled'
241+
type: Boolean
242+
description: |
243+
Denotes whether the firewall policy rule is disabled.
244+
When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist.
245+
If this is unspecified, the firewall policy rule will be enabled.

‎mmv1/templates/terraform/custom_expand/compute_firewall_policy_rule.go.tmpl

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
func expand{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
2+
firewallPolicyId := tpgresource.GetResourceNameFromSelfLink(v.(string))
3+
if err := d.Set("firewall_policy", firewallPolicyId); err != nil {
4+
return nil, fmt.Errorf("Error setting firewall_policy: %s", err)
5+
}
6+
return firewallPolicyId, nil
7+
}

‎mmv1/templates/terraform/examples/firewall_policy_rule.tf.tmpl

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
resource "google_network_security_address_group" "basic_global_networksecurity_address_group" {
2+
provider = google-beta
3+
4+
name = "{{index $.Vars "address"}}"
5+
parent = "organizations/{{index $.TestEnvVars "org_id"}}"
6+
description = "Sample global networksecurity_address_group"
7+
location = "global"
8+
items = ["208.80.154.224/32"]
9+
type = "IPV4"
10+
capacity = 100
11+
}
12+
13+
resource "google_folder" "folder" {
14+
provider = google-beta
15+
16+
display_name = "{{index $.Vars "folder"}}"
17+
parent = "organizations/{{index $.TestEnvVars "org_id"}}"
18+
deletion_protection = false
19+
}
20+
21+
resource "google_compute_firewall_policy" "default" {
22+
provider = google-beta
23+
24+
parent = google_folder.folder.id
25+
short_name = "{{index $.Vars "fw_policy"}}"
26+
description = "Resource created for Terraform acceptance testing"
27+
}
28+
29+
resource "google_compute_firewall_policy_rule" "{{$.PrimaryResourceId}}" {
30+
provider = google-beta
31+
32+
firewall_policy = google_compute_firewall_policy.default.name
33+
description = "Resource created for Terraform acceptance testing"
34+
priority = 9000
35+
enable_logging = true
36+
action = "allow"
37+
direction = "EGRESS"
38+
disabled = false
39+
40+
match {
41+
layer4_configs {
42+
ip_protocol = "tcp"
43+
ports = [8080]
44+
}
45+
layer4_configs {
46+
ip_protocol = "udp"
47+
ports = [22]
48+
}
49+
dest_ip_ranges = ["11.100.0.1/32"]
50+
dest_fqdns = []
51+
dest_region_codes = ["US"]
52+
dest_threat_intelligences = ["iplist-known-malicious-ips"]
53+
src_address_groups = []
54+
dest_address_groups = [google_network_security_address_group.basic_global_networksecurity_address_group.id]
55+
}
56+
target_service_accounts = ["{{index $.TestEnvVars "service_account"}}"]
57+
}

‎mmv1/templates/terraform/post_create/compute_firewall_policy_rule.go.tmpl

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
parent := d.Get("firewall_policy").(string)
2+
var opRes map[string]interface{}
3+
err = ComputeOrgOperationWaitTimeWithResponse(
4+
config, res, &opRes, parent, "Creating FirewallPolicyRule", userAgent,
5+
d.Timeout(schema.TimeoutCreate))
6+
7+
if err != nil {
8+
// The resource didn't actually create
9+
d.SetId("")
10+
return fmt.Errorf("Error waiting to create FirewallPolicyRule: %s", err)
11+
}

‎mmv1/templates/terraform/post_delete/compute_firewall_policy_rule.go.tmpl

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
parent := d.Get("firewall_policy").(string)
2+
var opRes map[string]interface{}
3+
err = ComputeOrgOperationWaitTimeWithResponse(
4+
config, res, &opRes, parent, "Deleting FirewallPolicyRule", userAgent,
5+
d.Timeout(schema.TimeoutCreate))
6+
7+
if err != nil {
8+
// The resource didn't actually create
9+
d.SetId("")
10+
return fmt.Errorf("Error waiting to delete FirewallPolicyRule: %s", err)
11+
}

‎mmv1/templates/terraform/post_update/compute_firewall_policy_rule.go.tmpl

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
parent := d.Get("firewall_policy").(string)
2+
var opRes map[string]interface{}
3+
err = ComputeOrgOperationWaitTimeWithResponse(
4+
config, res, &opRes, parent, "Updating FirewallPolicyRule", userAgent,
5+
d.Timeout(schema.TimeoutCreate))
6+
7+
if err != nil {
8+
// The resource didn't actually create
9+
d.SetId("")
10+
return fmt.Errorf("Error waiting to update FirewallPolicyRule: %s", err)
11+
}

0 commit comments

Comments
 (0)