Skip to content

Commit 589d003

Browse files
matheusaleixo-citamanMahendroo
matheusaleixo-cit
authored and
amanMahendroo
committed
Fixed SecurityPolicyRule and RegionSecurityPolicyRule resources being unable to manage the policy default rule (GoogleCloudPlatform#12054)
1 parent 26b6b6f commit 589d003

9 files changed

+237
-8
lines changed

‎mmv1/products/compute/RegionSecurityPolicyRule.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ async:
5252
path: 'error/errors'
5353
message: 'message'
5454
custom_code:
55+
pre_create: 'templates/terraform/pre_create/region_security_policy_default_rule_update_on_create.go.tmpl'
56+
pre_delete: 'templates/terraform/pre_delete/security_policy_default_rule_delete.go.tmpl'
5557
examples:
5658
- name: 'region_security_policy_rule_basic'
5759
primary_resource_id: 'policy_rule'
@@ -63,6 +65,11 @@ examples:
6365
min_version: 'beta'
6466
vars:
6567
sec_policy_name: 'policywithmultiplerules'
68+
- name: 'region_security_policy_rule_default_rule'
69+
primary_resource_id: 'policy_rule'
70+
min_version: 'beta'
71+
vars:
72+
sec_policy_name: 'policywithdefaultrule'
6673
- name: 'region_security_policy_rule_with_preconfigured_waf_config'
6774
primary_resource_id: 'policy_rule'
6875
min_version: 'beta'

‎mmv1/products/compute/SecurityPolicyRule.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ async:
5151
path: 'error/errors'
5252
message: 'message'
5353
custom_code:
54+
pre_create: 'templates/terraform/pre_create/security_policy_default_rule_update_on_create.go.tmpl'
55+
pre_delete: 'templates/terraform/pre_delete/security_policy_default_rule_delete.go.tmpl'
5456
examples:
5557
- name: 'security_policy_rule_basic'
5658
primary_resource_id: 'policy_rule'
@@ -60,8 +62,6 @@ examples:
6062
primary_resource_id: 'policy_rule'
6163
vars:
6264
sec_policy_name: 'policyruletest'
63-
project_id: 'PROJECT_NAME'
64-
exclude_test: true
6565
- name: 'security_policy_rule_multiple_rules'
6666
primary_resource_id: 'policy_rule_one'
6767
vars:

‎mmv1/templates/terraform/examples/region_security_policy_rule_default_rule.tf.tmpl

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
resource "google_compute_region_security_policy" "default" {
2+
provider = google-beta
3+
region = "us-west2"
4+
name = "{{index $.Vars "sec_policy_name"}}"
5+
description = "basic region security policy"
6+
type = "CLOUD_ARMOR"
7+
}
8+
9+
resource "google_compute_region_security_policy_rule" "default_rule" {
10+
provider = google-beta
11+
region = "us-west2"
12+
security_policy = google_compute_region_security_policy.default.name
13+
description = "new rule"
14+
action = "deny"
15+
priority = "2147483647"
16+
match {
17+
versioned_expr = "SRC_IPS_V1"
18+
config {
19+
src_ip_ranges = ["*"]
20+
}
21+
}
22+
}
23+
24+
resource "google_compute_region_security_policy_rule" "{{$.PrimaryResourceId}}" {
25+
provider = google-beta
26+
region = "us-west2"
27+
security_policy = google_compute_region_security_policy.default.name
28+
description = "new rule"
29+
priority = 100
30+
match {
31+
versioned_expr = "SRC_IPS_V1"
32+
config {
33+
src_ip_ranges = ["10.10.0.0/16"]
34+
}
35+
}
36+
action = "allow"
37+
preview = true
38+
}

‎mmv1/templates/terraform/examples/security_policy_rule_default_rule.tf.tmpl

+1-6
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,10 @@ resource "google_compute_security_policy" "default" {
44
type = "CLOUD_ARMOR"
55
}
66

7-
# A default rule is generated when creating the security_policy resource, import is needed to patch it
8-
# import {
9-
# id = "projects/{{index $.TestEnvVars "project_id"}}/global/securityPolicies/{{index $.Vars "sec_policy_name"}}/priority/2147483647"
10-
# to = google_compute_security_policy_rule.default_rule
11-
# }
127
resource "google_compute_security_policy_rule" "default_rule" {
138
security_policy = google_compute_security_policy.default.name
149
description = "default rule"
15-
action = "allow"
10+
action = "deny"
1611
priority = "2147483647"
1712
match {
1813
versioned_expr = "SRC_IPS_V1"

‎mmv1/templates/terraform/pre_create/region_security_policy_default_rule_update_on_create.go.tmpl

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// We can't Create a default rule since one is automatically created with the policy
2+
rulePriority, ok := d.GetOk("priority")
3+
4+
if ok && rulePriority.(int) == 2147483647 {
5+
log.Printf("[WARN] {{$.Name}} represents a default rule, will attempt an Update instead")
6+
newUrl, err := tpgresource.ReplaceVars(d, config, "{{"{{"}}ComputeBasePath{{"}}"}}projects/{{"{{"}}project{{"}}"}}/regions/{{"{{"}}region{{"}}"}}/securityPolicies/{{"{{"}}security_policy{{"}}"}}/patchRule?priority={{"{{"}}priority{{"}}"}}")
7+
if err != nil {
8+
return err
9+
}
10+
url = newUrl
11+
}

‎mmv1/templates/terraform/pre_create/security_policy_default_rule_update_on_create.go.tmpl

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// We can't Create a default rule since one is automatically created with the policy
2+
rulePriority, ok := d.GetOk("priority")
3+
4+
if ok && rulePriority.(int) == 2147483647 {
5+
log.Printf("[WARN] {{$.Name}} represents a default rule, will attempt an Update instead")
6+
newUrl, err := tpgresource.ReplaceVars(d, config, "{{"{{"}}ComputeBasePath{{"}}"}}projects/{{"{{"}}project{{"}}"}}/global/securityPolicies/{{"{{"}}security_policy{{"}}"}}/patchRule?priority={{"{{"}}priority{{"}}"}}")
7+
if err != nil {
8+
return err
9+
}
10+
url = newUrl
11+
}

‎mmv1/templates/terraform/pre_delete/security_policy_default_rule_delete.go.tmpl

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// The default rule of a Security Policy cannot be removed
2+
rulePriority, ok := d.GetOk("priority")
3+
4+
if ok && rulePriority.(int) == 2147483647 {
5+
log.Printf("[WARN] {{$.Name}} represents a default rule, skipping Delete request")
6+
return nil
7+
}

‎mmv1/third_party/terraform/services/compute/resource_compute_region_security_policy_rule_test.go.tmpl

+82
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,88 @@ resource "google_compute_region_security_policy_rule" "policy_rule" {
6767
`, context)
6868
}
6969

70+
func TestAccComputeRegionSecurityPolicyRule_securityPolicyDefaultRule(t *testing.T) {
71+
t.Parallel()
72+
73+
context := map[string]interface{}{
74+
"random_suffix": acctest.RandString(t, 10),
75+
}
76+
77+
acctest.VcrTest(t, resource.TestCase{
78+
PreCheck: func() { acctest.AccTestPreCheck(t) },
79+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
80+
CheckDestroy: testAccCheckComputeRegionSecurityPolicyRuleDestroyProducer(t),
81+
Steps: []resource.TestStep{
82+
{
83+
Config: testAccComputeRegionSecurityPolicyRule_securityPolicyDefaultRuleDeny(context),
84+
},
85+
{
86+
ResourceName: "google_compute_region_security_policy_rule.policy_rule_default",
87+
ImportState: true,
88+
ImportStateVerify: true,
89+
},
90+
{
91+
Config: testAccComputeRegionSecurityPolicyRule_securityPolicyDefaultRuleAllow(context),
92+
},
93+
{
94+
ResourceName: "google_compute_region_security_policy_rule.policy_rule_default",
95+
ImportState: true,
96+
ImportStateVerify: true,
97+
},
98+
},
99+
})
100+
}
101+
102+
func testAccComputeRegionSecurityPolicyRule_securityPolicyDefaultRuleDeny(context map[string]interface{}) string {
103+
return acctest.Nprintf(`
104+
resource "google_compute_region_security_policy" "default" {
105+
region = "us-west2"
106+
name = "tf-test%{random_suffix}"
107+
description = "basic region security policy"
108+
type = "CLOUD_ARMOR"
109+
}
110+
111+
resource "google_compute_region_security_policy_rule" "policy_rule_default" {
112+
security_policy = google_compute_region_security_policy.default.name
113+
region = "us-west2"
114+
description = "default rule"
115+
action = "deny"
116+
priority = "2147483647"
117+
match {
118+
versioned_expr = "SRC_IPS_V1"
119+
config {
120+
src_ip_ranges = ["*"]
121+
}
122+
}
123+
}
124+
`, context)
125+
}
126+
127+
func testAccComputeRegionSecurityPolicyRule_securityPolicyDefaultRuleAllow(context map[string]interface{}) string {
128+
return acctest.Nprintf(`
129+
resource "google_compute_region_security_policy" "default" {
130+
region = "us-west2"
131+
name = "tf-test%{random_suffix}"
132+
description = "basic region security policy"
133+
type = "CLOUD_ARMOR"
134+
}
135+
136+
resource "google_compute_region_security_policy_rule" "policy_rule_default" {
137+
security_policy = google_compute_region_security_policy.default.name
138+
region = "us-west2"
139+
description = "default rule"
140+
action = "allow"
141+
priority = "2147483647"
142+
match {
143+
versioned_expr = "SRC_IPS_V1"
144+
config {
145+
src_ip_ranges = ["*"]
146+
}
147+
}
148+
}
149+
`, context)
150+
}
151+
70152
func testAccComputeRegionSecurityPolicyRule_regionSecurityPolicyRulePostUpdate(context map[string]interface{}) string {
71153
return acctest.Nprintf(`
72154
resource "google_compute_region_security_policy" "default" {

‎mmv1/third_party/terraform/services/compute/resource_compute_security_policy_test.go.tmpl

+78
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,38 @@ func TestAccComputeSecurityPolicy_update(t *testing.T) {
162162
})
163163
}
164164

165+
func TestAccComputeSecurityPolicyRule_securityPolicyDefaultRule(t *testing.T) {
166+
t.Parallel()
167+
168+
context := map[string]interface{}{
169+
"random_suffix": acctest.RandString(t, 10),
170+
}
171+
172+
acctest.VcrTest(t, resource.TestCase{
173+
PreCheck: func() { acctest.AccTestPreCheck(t) },
174+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
175+
CheckDestroy: testAccCheckComputeSecurityPolicyRuleDestroyProducer(t),
176+
Steps: []resource.TestStep{
177+
{
178+
Config: testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleDeny(context),
179+
},
180+
{
181+
ResourceName: "google_compute_security_policy_rule.policy_rule_default",
182+
ImportState: true,
183+
ImportStateVerify: true,
184+
},
185+
{
186+
Config: testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleAllow(context),
187+
},
188+
{
189+
ResourceName: "google_compute_security_policy_rule.policy_rule_default",
190+
ImportState: true,
191+
ImportStateVerify: true,
192+
},
193+
},
194+
})
195+
}
196+
165197
func TestAccComputeSecurityPolicy_withAdvancedOptionsConfig(t *testing.T) {
166198
t.Parallel()
167199

@@ -879,6 +911,52 @@ resource "google_compute_security_policy" "policy" {
879911
`, spName)
880912
}
881913

914+
func testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleDeny(context map[string]interface{}) string {
915+
return acctest.Nprintf(`
916+
resource "google_compute_security_policy" "default" {
917+
name = "tf-test%{random_suffix}"
918+
description = "basic global security policy"
919+
type = "CLOUD_ARMOR"
920+
}
921+
922+
resource "google_compute_security_policy_rule" "policy_rule_default" {
923+
security_policy = google_compute_security_policy.default.name
924+
description = "default rule"
925+
action = "deny"
926+
priority = "2147483647"
927+
match {
928+
versioned_expr = "SRC_IPS_V1"
929+
config {
930+
src_ip_ranges = ["*"]
931+
}
932+
}
933+
}
934+
`, context)
935+
}
936+
937+
func testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleAllow(context map[string]interface{}) string {
938+
return acctest.Nprintf(`
939+
resource "google_compute_security_policy" "default" {
940+
name = "tf-test%{random_suffix}"
941+
description = "basic global security policy"
942+
type = "CLOUD_ARMOR"
943+
}
944+
945+
resource "google_compute_security_policy_rule" "policy_rule_default" {
946+
security_policy = google_compute_security_policy.default.name
947+
description = "default rule"
948+
action = "allow"
949+
priority = "2147483647"
950+
match {
951+
versioned_expr = "SRC_IPS_V1"
952+
config {
953+
src_ip_ranges = ["*"]
954+
}
955+
}
956+
}
957+
`, context)
958+
}
959+
882960
func testAccComputeSecurityPolicy_withRuleExpr(spName string) string {
883961
return fmt.Sprintf(`
884962
resource "google_compute_security_policy" "policy" {

0 commit comments

Comments
 (0)