Skip to content

Commit c23ce7f

Browse files
modular-magicianmodular-magician
authored
[#20905] Add network scope and src network fields to fw policy rules (#12762) (#9082)
[upstream:22ebcfbc1bce625abe2a1a382af8c6312fc8032e] Signed-off-by: Modular Magician <[email protected]>
1 parent 3c1cc7f commit c23ce7f

19 files changed

+1615
-275
lines changed

‎.changelog/12762.txt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
```release-note:enhancement
2+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_firewall_policy_rule` resource (beta)
3+
```
4+
```release-note:enhancement
5+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_firewall_policy_with_rules` resource (beta)
6+
```
7+
```release-note:enhancement
8+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_network_firewall_policy_rule` resource (beta)
9+
```
10+
```release-note:enhancement
11+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_network_firewall_policy_with_rules` resource (beta)
12+
```
13+
```release-note:enhancement
14+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_region_network_firewall_policy_rule` resource (beta)
15+
```
16+
```release-note:enhancement
17+
compute: added `dest_network_scope`, `src_network_scope` and `src_networks` fields to `google_compute_region_network_firewall_policy_with_rules` resource (beta)
18+
```

‎google-beta/services/compute/resource_compute_firewall_policy_rule.go

+71
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,12 @@ Example inputs include: ["22"], ["80","443"], and ["12345-12349"].`,
127127
Type: schema.TypeString,
128128
},
129129
},
130+
"dest_network_scope": {
131+
Type: schema.TypeString,
132+
Optional: true,
133+
ValidateFunc: verify.ValidateEnum([]string{"INTERNET", "INTRA_VPC", "NON_INTERNET", "VPC_NETWORKS", ""}),
134+
Description: `Network scope of the traffic destination. Possible values: ["INTERNET", "INTRA_VPC", "NON_INTERNET", "VPC_NETWORKS"]`,
135+
},
130136
"dest_region_codes": {
131137
Type: schema.TypeList,
132138
Optional: true,
@@ -167,6 +173,20 @@ Example inputs include: ["22"], ["80","443"], and ["12345-12349"].`,
167173
Type: schema.TypeString,
168174
},
169175
},
176+
"src_network_scope": {
177+
Type: schema.TypeString,
178+
Optional: true,
179+
ValidateFunc: verify.ValidateEnum([]string{"INTERNET", "INTRA_VPC", "NON_INTERNET", "VPC_NETWORKS", ""}),
180+
Description: `Network scope of the traffic source. Possible values: ["INTERNET", "INTRA_VPC", "NON_INTERNET", "VPC_NETWORKS"]`,
181+
},
182+
"src_networks": {
183+
Type: schema.TypeList,
184+
Optional: true,
185+
Description: `Networks of the traffic source. It can be either a full or partial url.`,
186+
Elem: &schema.Schema{
187+
Type: schema.TypeString,
188+
},
189+
},
170190
"src_region_codes": {
171191
Type: schema.TypeList,
172192
Optional: true,
@@ -719,6 +739,12 @@ func flattenComputeFirewallPolicyRuleMatch(v interface{}, d *schema.ResourceData
719739
flattenComputeFirewallPolicyRuleMatchSrcIpRanges(original["srcIpRanges"], d, config)
720740
transformed["dest_ip_ranges"] =
721741
flattenComputeFirewallPolicyRuleMatchDestIpRanges(original["destIpRanges"], d, config)
742+
transformed["src_network_scope"] =
743+
flattenComputeFirewallPolicyRuleMatchSrcNetworkScope(original["srcNetworkScope"], d, config)
744+
transformed["src_networks"] =
745+
flattenComputeFirewallPolicyRuleMatchSrcNetworks(original["srcNetworks"], d, config)
746+
transformed["dest_network_scope"] =
747+
flattenComputeFirewallPolicyRuleMatchDestNetworkScope(original["destNetworkScope"], d, config)
722748
transformed["layer4_configs"] =
723749
flattenComputeFirewallPolicyRuleMatchLayer4Configs(original["layer4Configs"], d, config)
724750
transformed["dest_address_groups"] =
@@ -747,6 +773,18 @@ func flattenComputeFirewallPolicyRuleMatchDestIpRanges(v interface{}, d *schema.
747773
return v
748774
}
749775

776+
func flattenComputeFirewallPolicyRuleMatchSrcNetworkScope(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
777+
return v
778+
}
779+
780+
func flattenComputeFirewallPolicyRuleMatchSrcNetworks(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
781+
return v
782+
}
783+
784+
func flattenComputeFirewallPolicyRuleMatchDestNetworkScope(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
785+
return v
786+
}
787+
750788
func flattenComputeFirewallPolicyRuleMatchLayer4Configs(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
751789
if v == nil {
752790
return v
@@ -886,6 +924,27 @@ func expandComputeFirewallPolicyRuleMatch(v interface{}, d tpgresource.Terraform
886924
transformed["destIpRanges"] = transformedDestIpRanges
887925
}
888926

927+
transformedSrcNetworkScope, err := expandComputeFirewallPolicyRuleMatchSrcNetworkScope(original["src_network_scope"], d, config)
928+
if err != nil {
929+
return nil, err
930+
} else if val := reflect.ValueOf(transformedSrcNetworkScope); val.IsValid() && !tpgresource.IsEmptyValue(val) {
931+
transformed["srcNetworkScope"] = transformedSrcNetworkScope
932+
}
933+
934+
transformedSrcNetworks, err := expandComputeFirewallPolicyRuleMatchSrcNetworks(original["src_networks"], d, config)
935+
if err != nil {
936+
return nil, err
937+
} else if val := reflect.ValueOf(transformedSrcNetworks); val.IsValid() && !tpgresource.IsEmptyValue(val) {
938+
transformed["srcNetworks"] = transformedSrcNetworks
939+
}
940+
941+
transformedDestNetworkScope, err := expandComputeFirewallPolicyRuleMatchDestNetworkScope(original["dest_network_scope"], d, config)
942+
if err != nil {
943+
return nil, err
944+
} else if val := reflect.ValueOf(transformedDestNetworkScope); val.IsValid() && !tpgresource.IsEmptyValue(val) {
945+
transformed["destNetworkScope"] = transformedDestNetworkScope
946+
}
947+
889948
transformedLayer4Configs, err := expandComputeFirewallPolicyRuleMatchLayer4Configs(original["layer4_configs"], d, config)
890949
if err != nil {
891950
return nil, err
@@ -960,6 +1019,18 @@ func expandComputeFirewallPolicyRuleMatchDestIpRanges(v interface{}, d tpgresour
9601019
return v, nil
9611020
}
9621021

1022+
func expandComputeFirewallPolicyRuleMatchSrcNetworkScope(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
1023+
return v, nil
1024+
}
1025+
1026+
func expandComputeFirewallPolicyRuleMatchSrcNetworks(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
1027+
return v, nil
1028+
}
1029+
1030+
func expandComputeFirewallPolicyRuleMatchDestNetworkScope(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
1031+
return v, nil
1032+
}
1033+
9631034
func expandComputeFirewallPolicyRuleMatchLayer4Configs(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
9641035
l := v.([]interface{})
9651036
req := make([]interface{}, 0, len(l))

‎google-beta/services/compute/resource_compute_firewall_policy_rule_generated_test.go

+94-19
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ func TestAccComputeFirewallPolicyRule_firewallPolicyRuleExample(t *testing.T) {
3535
t.Parallel()
3636

3737
context := map[string]interface{}{
38-
"org_id": envvar.GetTestOrgFromEnv(t),
39-
"service_account": envvar.GetTestServiceAccountFromEnv(t),
40-
"random_suffix": acctest.RandString(t, 10),
38+
"org_id": envvar.GetTestOrgFromEnv(t),
39+
"service_acct": envvar.GetTestServiceAccountFromEnv(t),
40+
"random_suffix": acctest.RandString(t, 10),
4141
}
4242

4343
acctest.VcrTest(t, resource.TestCase{
@@ -49,7 +49,7 @@ func TestAccComputeFirewallPolicyRule_firewallPolicyRuleExample(t *testing.T) {
4949
Config: testAccComputeFirewallPolicyRule_firewallPolicyRuleExample(context),
5050
},
5151
{
52-
ResourceName: "google_compute_firewall_policy_rule.policy_rule",
52+
ResourceName: "google_compute_firewall_policy_rule.primary",
5353
ImportState: true,
5454
ImportStateVerify: true,
5555
ImportStateVerifyIgnore: []string{"firewall_policy"},
@@ -61,7 +61,7 @@ func TestAccComputeFirewallPolicyRule_firewallPolicyRuleExample(t *testing.T) {
6161
func testAccComputeFirewallPolicyRule_firewallPolicyRuleExample(context map[string]interface{}) string {
6262
return acctest.Nprintf(`
6363
resource "google_network_security_address_group" "basic_global_networksecurity_address_group" {
64-
name = "address%{random_suffix}"
64+
name = "tf-test-address-group%{random_suffix}"
6565
parent = "organizations/%{org_id}"
6666
description = "Sample global networksecurity_address_group"
6767
location = "global"
@@ -78,36 +78,111 @@ resource "google_folder" "folder" {
7878
7979
resource "google_compute_firewall_policy" "default" {
8080
parent = google_folder.folder.id
81-
short_name = "policy%{random_suffix}"
81+
short_name = "tf-test-fw-policy%{random_suffix}"
8282
description = "Resource created for Terraform acceptance testing"
8383
}
8484
85-
resource "google_compute_firewall_policy_rule" "policy_rule" {
85+
resource "google_compute_firewall_policy_rule" "primary" {
86+
firewall_policy = google_compute_firewall_policy.default.name
87+
description = "Resource created for Terraform acceptance testing"
88+
priority = 9000
89+
enable_logging = true
90+
action = "allow"
91+
direction = "EGRESS"
92+
disabled = false
93+
target_service_accounts = ["%{service_acct}"]
94+
95+
match {
96+
dest_ip_ranges = ["11.100.0.1/32"]
97+
dest_fqdns = []
98+
dest_region_codes = ["US"]
99+
dest_threat_intelligences = ["iplist-known-malicious-ips"]
100+
src_address_groups = []
101+
dest_address_groups = [google_network_security_address_group.basic_global_networksecurity_address_group.id]
102+
dest_network_scope = "INTERNET"
103+
104+
layer4_configs {
105+
ip_protocol = "tcp"
106+
ports = [8080]
107+
}
108+
109+
layer4_configs {
110+
ip_protocol = "udp"
111+
ports = [22]
112+
}
113+
}
114+
}
115+
`, context)
116+
}
117+
118+
func TestAccComputeFirewallPolicyRule_firewallPolicyRuleNetworkScopeExample(t *testing.T) {
119+
t.Parallel()
120+
121+
context := map[string]interface{}{
122+
"org_id": envvar.GetTestOrgFromEnv(t),
123+
"random_suffix": acctest.RandString(t, 10),
124+
}
125+
126+
acctest.VcrTest(t, resource.TestCase{
127+
PreCheck: func() { acctest.AccTestPreCheck(t) },
128+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
129+
CheckDestroy: testAccCheckComputeFirewallPolicyRuleDestroyProducer(t),
130+
Steps: []resource.TestStep{
131+
{
132+
Config: testAccComputeFirewallPolicyRule_firewallPolicyRuleNetworkScopeExample(context),
133+
},
134+
{
135+
ResourceName: "google_compute_firewall_policy_rule.primary",
136+
ImportState: true,
137+
ImportStateVerify: true,
138+
ImportStateVerifyIgnore: []string{"firewall_policy"},
139+
},
140+
},
141+
})
142+
}
143+
144+
func testAccComputeFirewallPolicyRule_firewallPolicyRuleNetworkScopeExample(context map[string]interface{}) string {
145+
return acctest.Nprintf(`
146+
resource "google_folder" "folder" {
147+
display_name = "folder%{random_suffix}"
148+
parent = "organizations/%{org_id}"
149+
deletion_protection = false
150+
}
151+
152+
resource "google_compute_firewall_policy" "default" {
153+
parent = google_folder.folder.id
154+
short_name = "tf-test-fw-policy%{random_suffix}"
155+
description = "Firewall policy"
156+
}
157+
158+
resource "google_compute_firewall_policy_rule" "primary" {
86159
firewall_policy = google_compute_firewall_policy.default.name
87-
description = "Resource created for Terraform acceptance testing"
160+
description = "Firewall policy rule with network scope"
88161
priority = 9000
89-
enable_logging = true
90162
action = "allow"
91-
direction = "EGRESS"
163+
direction = "INGRESS"
92164
disabled = false
93165
94166
match {
167+
src_ip_ranges = ["11.100.0.1/32"]
168+
src_network_scope = "VPC_NETWORKS"
169+
src_networks = [google_compute_network.network.id]
170+
95171
layer4_configs {
96172
ip_protocol = "tcp"
97-
ports = [8080]
173+
ports = [8080]
98174
}
175+
99176
layer4_configs {
100177
ip_protocol = "udp"
101-
ports = [22]
178+
ports = [22]
102179
}
103-
dest_ip_ranges = ["11.100.0.1/32"]
104-
dest_fqdns = []
105-
dest_region_codes = ["US"]
106-
dest_threat_intelligences = ["iplist-known-malicious-ips"]
107-
src_address_groups = []
108-
dest_address_groups = [google_network_security_address_group.basic_global_networksecurity_address_group.id]
109180
}
110-
target_service_accounts = ["%{service_account}"]
181+
}
182+
183+
resource "google_compute_network" "network" {
184+
name = "network%{random_suffix}"
185+
auto_create_subnetworks = false
111186
}
112187
`, context)
113188
}

0 commit comments

Comments
 (0)