Add a new resource to allow updating all rules in firewall policy at once

[mihhalj]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

Add a new resource to allow updating all rules in firewall policy at once (network, regional or hierarchical firewall policy).
For example, currently you can specify the rules using [google_compute_network_firewall_policy_rule] (https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_network_firewall_policy_rule) resources but they are updated individually. The new terraform resource will allow to update/replace all the rules in one operations - either all rules are updated or none of them.

New or Affected Resource(s)

• google_compute_firewall_policy_with_rules
• google_compute_network_firewall_policy_with_rules
• google_compute_region_network_firewall_policy_with_rules

Potential Terraform Configuration

resource "google_compute_network_firewall_policy_with_rules" "fw-policy-with-rules-1" {
  name        = "fw-policy-with-rules-1"
  description = "Network Firewall Policy with rules"

  rule {
    description    = "rule 1"
    priority       = 1000
    enable_logging = true
    action         = "allow"
    direction      = "EGRESS"
    match {
      layer4_config {
        ip_protocol = "tcp"
        ports       = [8080, 7070]
      }
      dest_ip_ranges = ["11.100.0.1/32"]
    }
  }
  rule {
    description    = "rule 2"
    priority       = 2000
    enable_logging = false
    action         = "deny"
    direction      = "INGRESS"
    match {
      layer4_config {
        ip_protocol = "tcp"
      }
      src_ip_ranges = ["11.100.0.1/32"]
    }
  }
}

References

b/359747616

b/362277941