Skip to content

Commit 86a61cf

Browse files
nickjacquesdanawillow
nickjacques
authored and
danawillow
committed
New resource/datasource: SSL Policy (hashicorp#1247)
* Add SSL Policy to provider * Add resource for SSL Policy * Add SSL Policy data source * Add tests for SSL Policy resource * Add documentation for SSL Policy resource * Add SSL Policy datasource docs * Add test for SSL Policy datasource * Update SSL Policy datasource docs * Make full update for SSL Policy resource * SSL Policy resource test multi-attrib update * Clean up SSL Policy datasource * Set-ify custom_features in SSL Policy resource * Document description ForceNew rationale * Remove refs to TLS_1_3 * Update docs: plural -> singular * Remove extraneous attrs from datasource * Fix update logic for custom_features and add enabled_features * Update docs to include enabled_features * Add test for updating to/from custom_features * Add TLS 1.3 bug link * Add import between multi-step test configs * Move Profile and minTlsVersion back into sslPolicy struct
1 parent e3dad70 commit 86a61cf

File tree

3 files changed

+142
-0
lines changed

3 files changed

+142
-0
lines changed

‎docs/d/datasource_compute_ssl_policy.html.markdown

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
layout: "google"
3+
page_title: "Google: google_compute_ssl_policy"
4+
sidebar_current: "docs-google-datasource-compute-ssl-policy"
5+
description: |-
6+
Gets an SSL Policy within GCE, for use with Target HTTPS and Target SSL Proxies.
7+
---
8+
9+
# google\_compute\_ssl\_policy
10+
11+
Gets an SSL Policy within GCE from its name, for use with Target HTTPS and Target SSL Proxies.
12+
For more information see [the official documentation](https://cloud.google.com/compute/docs/load-balancing/ssl-policies).
13+
14+
## Example Usage
15+
16+
```tf
17+
data "google_compute_ssl_policy" "my-ssl-policy" {
18+
name = "production-ssl-policy"
19+
}
20+
```
21+
22+
## Argument Reference
23+
24+
The following arguments are supported:
25+
26+
* `name` - (Required) The name of the SSL Policy.
27+
28+
- - -
29+
30+
* `project` - (Optional) The ID of the project in which the resource belongs. If it
31+
is not provided, the provider project is used.
32+
33+
## Attributes Reference
34+
35+
In addition to the arguments listed above, the following attributes are exported:
36+
37+
* `enabled_features` - The set of enabled encryption ciphers as a result of the policy config
38+
39+
* `description` - Description of this SSL Policy.
40+
41+
* `min_tls_version` - The minimum supported TLS version of this policy.
42+
43+
* `profile` - The Google-curated or custom profile used by this policy.
44+
45+
* `custom_features` - If the `profile` is `CUSTOM`, these are the custom encryption
46+
ciphers supported by the profile. If the `profile` is *not* `CUSTOM`, this
47+
attribute will be empty.
48+
49+
* `fingerprint` - Fingerprint of this resource.
50+
51+
* `self_link` - The URI of the created resource.

‎docs/r/compute_ssl_policy.html.markdown

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
layout: "google"
3+
page_title: "Google: google_compute_ssl_policy"
4+
sidebar_current: "docs-google-compute-ssl-policy"
5+
description: |-
6+
Manages an SSL Policy within GCE, for use with Target HTTPS and Target SSL Proxies.
7+
---
8+
9+
# google\_compute\_ssl\_policy
10+
11+
Manages an SSL Policy within GCE, for use with Target HTTPS and Target SSL Proxies. For more information see
12+
[the official documentation](https://cloud.google.com/compute/docs/load-balancing/ssl-policies)
13+
and
14+
[API](https://cloud.google.com/compute/docs/reference/rest/beta/sslPolicies).
15+
16+
## Example Usage
17+
18+
```hcl
19+
resource "google_compute_ssl_policy" "prod-ssl-policy" {
20+
name = "production-ssl-policy"
21+
profile = "MODERN"
22+
}
23+
24+
resource "google_compute_ssl_policy" "nonprod-ssl-policy" {
25+
name = "nonprod-ssl-policy"
26+
profile = "MODERN"
27+
min_tls_version = "TLS_1_2"
28+
}
29+
30+
resource "google_compute_ssl_policy" "custom-ssl-policy" {
31+
name = "custom-ssl-policy"
32+
min_tls_version = "TLS_1_2"
33+
profile = "CUSTOM"
34+
custom_features = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"]
35+
}
36+
```
37+
38+
## Argument Reference
39+
40+
The following arguments are supported:
41+
42+
* `name` - (Required) A unique name for the resource, required by GCE.
43+
Changing this forces a new resource to be created.
44+
45+
- - -
46+
47+
* `description` - (Optional) Description of this subnetwork. Changing this forces a new resource to be created.
48+
49+
* `project` - (Optional) The ID of the project in which the resource belongs. If it
50+
is not provided, the provider project is used.
51+
52+
* `min_tls_version` - (Optional) The minimum TLS version to support. Must be one of `TLS_1_0`, `TLS_1_1`, or `TLS_1_2`.
53+
Default is `TLS_1_0`.
54+
55+
* `profile` - (Optional) The Google-curated SSL profile to use. Must be one of `COMPATIBLE`, `MODERN`,
56+
`RESTRICTED`, or `CUSTOM`. See the
57+
[official documentation](https://cloud.google.com/compute/docs/load-balancing/ssl-policies#profilefeaturesupport)
58+
for information on what cipher suites each profile provides. If `CUSTOM` is used, the `custom_features` attribute
59+
**must be set**. Default is `COMPATIBLE`.
60+
61+
* `custom_features` - (Required with `CUSTOM` profile) The specific encryption ciphers to use. See the
62+
[official documentation](https://cloud.google.com/compute/docs/load-balancing/ssl-policies#profilefeaturesupport)
63+
for which ciphers are available to use. **Note**: this argument *must* be present when using the `CUSTOM` profile.
64+
This argument *must not* be present when using any other profile.
65+
66+
## Attributes Reference
67+
68+
In addition to the arguments listed above, the following computed attributes are
69+
exported:
70+
71+
* `enabled_features` - The set of enabled encryption ciphers as a result of the policy config
72+
73+
* `fingerprint` - Fingerprint of this resource.
74+
75+
* `self_link` - The URI of the created resource.
76+
77+
## Import
78+
79+
SSL Policies can be imported using the GCP canonical `name` of the Policy. For example, an SSL Policy named `production-ssl-policy`
80+
would be imported by running:
81+
82+
```bash
83+
$ terraform import google_compute_ssl_policy.my-policy production-ssl-policy
84+
```

‎google.erb

+7
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@
4444
<li<%= sidebar_current("docs-google-datasource-project") %>>
4545
<a href="/docs/providers/google/d/google_project.html">google_project</a>
4646
</li>
47+
<li<%= sidebar_current("docs-google-datasource-compute-ssl-policy") %>>
48+
<a href="/docs/providers/google/d/datasource_compute_ssl_policy.html">google_compute_ssl_policy</a>
49+
</li>
4750
<li<%= sidebar_current("docs-google-datasource-compute-subnetwork") %>>
4851
<a href="/docs/providers/google/d/datasource_compute_subnetwork.html">google_compute_subnetwork</a>
4952
</li>
@@ -346,6 +349,10 @@
346349
<a href="/docs/providers/google/r/compute_ssl_certificate.html">google_compute_ssl_certificate</a>
347350
</li>
348351

352+
<li<%= sidebar_current("docs-google-compute-ssl-policy") %>>
353+
<a href="/docs/providers/google/r/compute_ssl_policy.html">google_compute_ssl_policy</a>
354+
</li>
355+
349356
<li<%= sidebar_current("docs-google-compute-subnetwork") %>>
350357
<a href="/docs/providers/google/r/compute_subnetwork.html">google_compute_subnetwork</a>
351358
</li>

0 commit comments

Comments
 (0)