Add Terraform support for antivirus threat override

.changelog/13444.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+networksecurity: added `antivirus_overrides` field to `google_network_security_security_profile.threat_prevention_profile` resource
+```

google-beta/services/networksecurity/resource_network_security_security_profile.go

@@ -143,6 +143,13 @@ Format: organizations/{organization_id}.`,
 				MaxItems:    1,
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
+						"antivirus_overrides": {
+							Type:        schema.TypeSet,
+							Optional:    true,
+							Description: `Defines what action to take for antivirus threats per protocol.`,
+							Elem:        networksecuritySecurityProfileThreatPreventionProfileAntivirusOverridesSchema(),
+							// Default schema.HashSchema is used.
+						},
 						"severity_overrides": {
 							Type:        schema.TypeSet,
 							Optional:    true,
@@ -245,6 +252,25 @@ func networksecuritySecurityProfileThreatPreventionProfileThreatOverridesSchema(
 	}
 }
 
+func networksecuritySecurityProfileThreatPreventionProfileAntivirusOverridesSchema() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"action": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"ALERT", "ALLOW", "DEFAULT_ACTION", "DENY"}),
+				Description:  `Threat action override. For some threat types, only a subset of actions applies. Possible values: ["ALERT", "ALLOW", "DEFAULT_ACTION", "DENY"]`,
+			},
+			"protocol": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"SMTP", "SMB", "POP3", "IMAP", "HTTP2", "HTTP", "FTP"}),
+				Description:  `Required protocol to match. Possible values: ["SMTP", "SMB", "POP3", "IMAP", "HTTP2", "HTTP", "FTP"]`,
+			},
+		},
+	}
+}
+
 func resourceNetworkSecuritySecurityProfileCreate(d *schema.ResourceData, meta interface{}) error {
 	var project string
 	config := meta.(*transport_tpg.Config)
@@ -643,6 +669,8 @@ func flattenNetworkSecuritySecurityProfileThreatPreventionProfile(v interface{},
 		flattenNetworkSecuritySecurityProfileThreatPreventionProfileSeverityOverrides(original["severityOverrides"], d, config)
 	transformed["threat_overrides"] =
 		flattenNetworkSecuritySecurityProfileThreatPreventionProfileThreatOverrides(original["threatOverrides"], d, config)
+	transformed["antivirus_overrides"] =
+		flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverrides(original["antivirusOverrides"], d, config)
 	return []interface{}{transformed}
 }
 func flattenNetworkSecuritySecurityProfileThreatPreventionProfileSeverityOverrides(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -704,6 +732,33 @@ func flattenNetworkSecuritySecurityProfileThreatPreventionProfileThreatOverrides
 	return v
 }
 
+func flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverrides(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return v
+	}
+	l := v.([]interface{})
+	transformed := schema.NewSet(schema.HashResource(networksecuritySecurityProfileThreatPreventionProfileAntivirusOverridesSchema()), []interface{}{})
+	for _, raw := range l {
+		original := raw.(map[string]interface{})
+		if len(original) < 1 {
+			// Do not include empty json objects coming back from the api
+			continue
+		}
+		transformed.Add(map[string]interface{}{
+			"protocol": flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesProtocol(original["protocol"], d, config),
+			"action":   flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesAction(original["action"], d, config),
+		})
+	}
+	return transformed
+}
+func flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesProtocol(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesAction(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenNetworkSecuritySecurityProfileCustomMirroringProfile(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	if v == nil {
 		return nil
@@ -788,6 +843,13 @@ func expandNetworkSecuritySecurityProfileThreatPreventionProfile(v interface{},
 		transformed["threatOverrides"] = transformedThreatOverrides
 	}
 
+	transformedAntivirusOverrides, err := expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverrides(original["antivirus_overrides"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedAntivirusOverrides); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["antivirusOverrides"] = transformedAntivirusOverrides
+	}
+
 	return transformed, nil
 }
 
@@ -878,6 +940,44 @@ func expandNetworkSecuritySecurityProfileThreatPreventionProfileThreatOverridesT
 	return v, nil
 }
 
+func expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverrides(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	v = v.(*schema.Set).List()
+	l := v.([]interface{})
+	req := make([]interface{}, 0, len(l))
+	for _, raw := range l {
+		if raw == nil {
+			continue
+		}
+		original := raw.(map[string]interface{})
+		transformed := make(map[string]interface{})
+
+		transformedProtocol, err := expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesProtocol(original["protocol"], d, config)
+		if err != nil {
+			return nil, err
+		} else if val := reflect.ValueOf(transformedProtocol); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+			transformed["protocol"] = transformedProtocol
+		}
+
+		transformedAction, err := expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesAction(original["action"], d, config)
+		if err != nil {
+			return nil, err
+		} else if val := reflect.ValueOf(transformedAction); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+			transformed["action"] = transformedAction
+		}
+
+		req = append(req, transformed)
+	}
+	return req, nil
+}
+
+func expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesProtocol(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandNetworkSecuritySecurityProfileThreatPreventionProfileAntivirusOverridesAction(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandNetworkSecuritySecurityProfileCustomMirroringProfile(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	l := v.([]interface{})
 	if len(l) == 0 || l[0] == nil {

google-beta/services/networksecurity/resource_network_security_security_profile_generated_meta.yaml

@@ -22,6 +22,8 @@ fields:
   - field: 'self_link'
   - field: 'terraform_labels'
     provider_only: true
+  - field: 'threat_prevention_profile.antivirus_overrides.action'
+  - field: 'threat_prevention_profile.antivirus_overrides.protocol'
   - field: 'threat_prevention_profile.severity_overrides.action'
   - field: 'threat_prevention_profile.severity_overrides.severity'
   - field: 'threat_prevention_profile.threat_overrides.action'

google-beta/services/networksecurity/resource_network_security_security_profile_generated_test.go

@@ -121,6 +121,11 @@ resource "google_network_security_security_profile" "default" {
       action    = "ALLOW"
       threat_id = "280647"
     }
+
+    antivirus_overrides {
+      protocol = "SMTP"
+      action   = "ALLOW"
+    }
   }
 }
 `, context)

google-beta/services/networksecurity/resource_network_security_security_profile_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
 	"github.com/hashicorp/terraform-provider-google-beta/google-beta/acctest"
 	"github.com/hashicorp/terraform-provider-google-beta/google-beta/envvar"
 )
@@ -44,6 +45,58 @@ func TestAccNetworkSecuritySecurityProfiles_update(t *testing.T) {
 	})
 }
 
+func TestAccNetworkSecuritySecurityProfiles_antivirusOverrides(t *testing.T) {
+	t.Parallel()
+
+	orgId := envvar.GetTestOrgFromEnv(t)
+	randomSuffix := acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckNetworkSecuritySecurityProfileDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNetworkSecuritySecurityProfiles_basic(orgId, randomSuffix),
+			},
+			{
+				ResourceName:            "google_network_security_security_profile.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccNetworkSecuritySecurityProfiles_antivirusOverrides(orgId, randomSuffix),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("google_network_security_security_profile.foobar", plancheck.ResourceActionUpdate),
+					},
+				},
+			},
+			{
+				ResourceName:            "google_network_security_security_profile.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccNetworkSecuritySecurityProfiles_basic(orgId, randomSuffix),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("google_network_security_security_profile.foobar", plancheck.ResourceActionUpdate),
+					},
+				},
+			},
+			{
+				ResourceName:            "google_network_security_security_profile.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func testAccNetworkSecuritySecurityProfiles_basic(orgId string, randomSuffix string) string {
 	return fmt.Sprintf(`
 resource "google_network_security_security_profile" "foobar" {
@@ -87,3 +140,36 @@ resource "google_network_security_security_profile" "foobar" {
 }
 `, randomSuffix, orgId)
 }
+
+func testAccNetworkSecuritySecurityProfiles_antivirusOverrides(orgId string, randomSuffix string) string {
+	return fmt.Sprintf(`
+resource "google_network_security_security_profile" "foobar" {
+    name        = "tf-test-my-security-profile%s"
+    parent      = "organizations/%s"
+    location    = "global"
+    description = "My security profile. Update"
+    type        = "THREAT_PREVENTION"
+
+    labels = {
+        foo = "foo"
+    }
+
+    threat_prevention_profile {
+        antivirus_overrides {
+            action   = "ALLOW"
+            protocol = "FTP"
+        }
+
+        antivirus_overrides {
+            action   = "DENY"
+            protocol = "HTTP"
+        }
+
+        antivirus_overrides {
+            action   = "ALERT"
+            protocol = "HTTP2"
+        }
+    }
+}
+`, randomSuffix, orgId)
+}

website/docs/r/network_security_security_profile.html.markdown

@@ -70,6 +70,11 @@ resource "google_network_security_security_profile" "default" {
       action    = "ALLOW"
       threat_id = "280647"
     }
+
+    antivirus_overrides {
+      protocol = "SMTP"
+      action   = "ALLOW"
+    }
   }
 }
 ```
@@ -217,6 +222,11 @@ The following arguments are supported:
   and threat overrides, the threat overrides action is applied.
   Structure is [documented below](#nested_threat_prevention_profile_threat_overrides).
 
+* `antivirus_overrides` -
+  (Optional)
+  Defines what action to take for antivirus threats per protocol.
+  Structure is [documented below](#nested_threat_prevention_profile_antivirus_overrides).
+
 
 <a name="nested_threat_prevention_profile_severity_overrides"></a>The `severity_overrides` block supports:
 
@@ -245,6 +255,18 @@ The following arguments are supported:
   (Output)
   Type of threat.
 
+<a name="nested_threat_prevention_profile_antivirus_overrides"></a>The `antivirus_overrides` block supports:
+
+* `protocol` -
+  (Required)
+  Required protocol to match.
+  Possible values are: `SMTP`, `SMB`, `POP3`, `IMAP`, `HTTP2`, `HTTP`, `FTP`.
+
+* `action` -
+  (Required)
+  Threat action override. For some threat types, only a subset of actions applies.
+  Possible values are: `ALERT`, `ALLOW`, `DEFAULT_ACTION`, `DENY`.
+
 <a name="nested_custom_mirroring_profile"></a>The `custom_mirroring_profile` block supports:
 
 * `mirroring_endpoint_group` -