Skip to content

Commit 8937594

Browse files
mihhaljNickElliot
authored and
entertvl
committed
Add new compute-network-firewall-policy-with-rules resource (GoogleCloudPlatform#11524)
Co-authored-by: Nick Elliot <[email protected]>
1 parent 2196561 commit 8937594

8 files changed

+1068
-0
lines changed

‎mmv1/products/compute/NetworkFirewallPolicyWithRules.yaml

+569
Large diffs are not rendered by default.

‎mmv1/templates/terraform/constants/resource_compute_network_firewall_policy_with_rules.go.erb

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
func networkFirewallPolicyWithRulesConvertPriorityToInt(v interface {}) (int64, error) {
2+
if strVal, ok := v.(string); ok {
3+
if intVal, err := tpgresource.StringToFixed64(strVal); err == nil {
4+
return intVal, nil
5+
}
6+
}
7+
8+
if intVal, ok := v.(int64); ok {
9+
return intVal, nil
10+
}
11+
12+
if floatVal, ok := v.(float64); ok {
13+
intVal := int64(floatVal)
14+
return intVal, nil
15+
}
16+
17+
return 0, fmt.Errorf("Incorrect rule priority: %s. Priority must be a number", v)
18+
}
19+
20+
func networkFirewallPolicyWithRulesIsPredefinedRule(rule map[string]interface{}) (bool, error) {
21+
// Priorities from 2147483548 to 2147483647 are reserved and cannot be modified by the user.
22+
const ReservedPriorityStart = 2147483548
23+
24+
priority := rule["priority"]
25+
priorityInt, err := networkFirewallPolicyWithRulesConvertPriorityToInt(priority)
26+
27+
if err != nil {
28+
return false, err
29+
}
30+
31+
return priorityInt >= ReservedPriorityStart, nil
32+
33+
}
34+
35+
func networkFirewallPolicyWithRulesSplitPredefinedRules(allRules []interface{}) ([]interface{}, []interface{}, error) {
36+
predefinedRules := make([]interface{}, 0)
37+
rules := make([]interface{}, 0)
38+
39+
for _, rule := range allRules {
40+
isPredefined, err := networkFirewallPolicyWithRulesIsPredefinedRule(rule.(map[string]interface{}))
41+
if err != nil {
42+
return nil, nil, err
43+
}
44+
45+
if isPredefined {
46+
predefinedRules = append(predefinedRules, rule)
47+
} else {
48+
rules = append(rules, rule)
49+
}
50+
}
51+
52+
return rules, predefinedRules, nil
53+
}
54+

‎mmv1/templates/terraform/decoders/resource_compute_network_firewall_policy_with_rules.go.erb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rules, predefinedRules, err := networkFirewallPolicyWithRulesSplitPredefinedRules(res["rules"].([]interface{}))
2+
3+
if err != nil {
4+
return nil, fmt.Errorf("Error occurred while splitting pre-defined rules: %s", err)
5+
}
6+
7+
res["rules"] = rules
8+
res["predefinedRules"] = predefinedRules
9+
10+
config := meta.(*transport_tpg.Config)
11+
12+
if err := d.Set("predefined_rules", flattenComputeNetworkFirewallPolicyWithRulesPredefinedRules(predefinedRules, d, config)); err != nil {
13+
return nil, fmt.Errorf("Error occurred while setting pre-defined rules: %s", err)
14+
}
15+
16+
return res, nil

‎mmv1/templates/terraform/encoders/resource_compute_network_firewall_policy_with_rules.go.erb

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
delete(obj, "rules") // Rules are not supported in the create API
2+
return obj, nil
3+

‎mmv1/templates/terraform/examples/compute_network_firewall_policy_with_rules_full.tf.erb

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
data "google_project" "project" {
2+
provider = google-beta
3+
}
4+
5+
resource "google_compute_network_firewall_policy_with_rules" "<%= ctx[:primary_resource_id] %>" {
6+
name = "<%= ctx[:vars]['policy_name'] %>"
7+
description = "Terraform test"
8+
provider = google-beta
9+
10+
rule {
11+
description = "tcp rule"
12+
priority = 1000
13+
enable_logging = true
14+
action = "allow"
15+
direction = "EGRESS"
16+
match {
17+
layer4_config {
18+
ip_protocol = "tcp"
19+
ports = [8080, 7070]
20+
}
21+
dest_ip_ranges = ["11.100.0.1/32"]
22+
dest_fqdns = ["www.yyy.com", "www.zzz.com"]
23+
dest_region_codes = ["HK", "IN"]
24+
dest_threat_intelligences = ["iplist-search-engines-crawlers", "iplist-tor-exit-nodes"]
25+
dest_address_groups = [google_network_security_address_group.address_group_1.id]
26+
}
27+
target_secure_tag {
28+
name = "tagValues/${google_tags_tag_value.secure_tag_value_1.name}"
29+
}
30+
}
31+
rule {
32+
description = "udp rule"
33+
priority = 2000
34+
enable_logging = false
35+
action = "deny"
36+
direction = "INGRESS"
37+
match {
38+
layer4_config {
39+
ip_protocol = "udp"
40+
}
41+
src_ip_ranges = ["0.0.0.0/0"]
42+
src_fqdns = ["www.abc.com", "www.def.com"]
43+
src_region_codes = ["US", "CA"]
44+
src_threat_intelligences = ["iplist-known-malicious-ips", "iplist-public-clouds"]
45+
src_address_groups = [google_network_security_address_group.address_group_1.id]
46+
src_secure_tag {
47+
name = "tagValues/${google_tags_tag_value.secure_tag_value_1.name}"
48+
}
49+
}
50+
disabled = true
51+
}
52+
53+
rule {
54+
description = "security profile group rule"
55+
rule_name = "tcp rule"
56+
priority = 3000
57+
enable_logging = false
58+
action = "apply_security_profile_group"
59+
direction = "INGRESS"
60+
match {
61+
layer4_config {
62+
ip_protocol = "tcp"
63+
}
64+
src_ip_ranges = ["0.0.0.0/0"]
65+
}
66+
target_service_accounts = ["[email protected]"]
67+
security_profile_group = "//networksecurity.googleapis.com/${google_network_security_security_profile_group.security_profile_group_1.id}"
68+
tls_inspect = true
69+
}
70+
}
71+
72+
resource "google_network_security_address_group" "address_group_1" {
73+
provider = google-beta
74+
name = "<%= ctx[:vars]['address_group_name'] %>"
75+
parent = "projects/${data.google_project.project.name}"
76+
description = "Global address group"
77+
location = "global"
78+
items = ["208.80.154.224/32"]
79+
type = "IPV4"
80+
capacity = 100
81+
}
82+
83+
resource "google_tags_tag_key" "secure_tag_key_1" {
84+
provider = google-beta
85+
description = "Tag key"
86+
parent = "projects/${data.google_project.project.name}"
87+
purpose = "GCE_FIREWALL"
88+
short_name = "<%= ctx[:vars]['tag_key_name'] %>"
89+
purpose_data = {
90+
network = "${data.google_project.project.name}/default"
91+
}
92+
}
93+
94+
resource "google_tags_tag_value" "secure_tag_value_1" {
95+
provider = google-beta
96+
description = "Tag value"
97+
parent = "tagKeys/${google_tags_tag_key.secure_tag_key_1.name}"
98+
short_name = "<%= ctx[:vars]['tag_value_name'] %>"
99+
}
100+
101+
resource "google_network_security_security_profile_group" "security_profile_group_1" {
102+
provider = google-beta
103+
name = "<%= ctx[:vars]['security_profile_group_name'] %>"
104+
parent = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
105+
description = "my description"
106+
threat_prevention_profile = google_network_security_security_profile.security_profile_1.id
107+
}
108+
109+
resource "google_network_security_security_profile" "security_profile_1" {
110+
provider = google-beta
111+
name = "<%= ctx[:vars]['security_profile_name'] %>"
112+
type = "THREAT_PREVENTION"
113+
parent = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
114+
location = "global"
115+
}
116+

‎mmv1/templates/terraform/post_create/resource_compute_network_firewall_policy_with_rules.go.erb

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
log.Printf("[DEBUG] Post-create for NetworkFirewallPolicyWithRules %q", d.Id())
2+
3+
url, err = tpgresource.ReplaceVarsForId(d, config, "{{ComputeBasePath}}projects/{{project}}/global/firewallPolicies/{{name}}")
4+
if err != nil {
5+
return err
6+
}
7+
8+
headers = make(http.Header)
9+
res, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
10+
Config: config,
11+
Method: "GET",
12+
Project: billingProject,
13+
RawURL: url,
14+
UserAgent: userAgent,
15+
Headers: headers,
16+
})
17+
if err != nil {
18+
return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("ComputeNetworkFirewallPolicyWithRules %q", d.Id()))
19+
}
20+
21+
if err := d.Set("fingerprint", flattenComputeNetworkFirewallPolicyWithRulesFingerprint(res["fingerprint"], d, config)); err != nil {
22+
return fmt.Errorf("Error reading NetworkFirewallPolicyWithRules: %s", err)
23+
}
24+
25+
res, err = resourceComputeNetworkFirewallPolicyWithRulesDecoder(d, meta, res)
26+
if err != nil {
27+
return err
28+
}
29+
30+
log.Printf("[DEBUG] Updating NetworkFirewallPolicyWithRules %q", d.Id())
31+
return resourceComputeNetworkFirewallPolicyWithRulesUpdate(d, meta)

‎mmv1/templates/terraform/update_encoder/resource_compute_network_firewall_policy_with_rules.go.erb

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
config := meta.(*transport_tpg.Config)
2+
3+
predefinedRulesProp, err := expandComputeNetworkFirewallPolicyWithRulesRule(d.Get("predefined_rules"), d, config)
4+
if err != nil {
5+
return nil, err
6+
}
7+
8+
rules := obj["rules"].([]interface{})
9+
obj["rules"] = append(rules, predefinedRulesProp)
10+
11+
return obj, nil
12+
13+
14+
15+

0 commit comments

Comments
 (0)