Added new resource "Security Policy Rule" #10434

matheusaleixo-cit · 2024-04-12T18:46:36Z

Adds a new resource "google_compute_security_policy_rule", allowing an alternative to handling rules in the security policy resource itself. Functionally similar to regional security policy rules.

FIxes: hashicorp/terraform-provider-google#5622

Release Note Template for Downstream PRs (will be copied)

`google_compute_security_policy_rule`

…tests; - Added "patchRule" test to "SecurityPolicy"; - Added default value for "adaptive_protection_config > layer_7_ddos_defense_config > enable";

…ionSecurityPolicy, still not fully implemented in terraform for global securityPolicy);

- Removed patchRule test from SecurityPolicy (created during discovery);

…ty-policy

github-actions · 2024-04-16T20:04:41Z

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@shuyama1, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

modular-magician · 2024-04-17T21:24:19Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 2 files changed, 360 insertions(+))
google-beta provider: Diff ( 6 files changed, 2063 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 360 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_compute_security_policy_rule (8 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_compute_security_policy_rule" "primary" {
  match = # value needed
  match {
    config = # value needed
    expr   = # value needed
    expr {
      description = # value needed
      location    = # value needed
      title       = # value needed
    }
  }
  network_match = # value needed
  network_match {
    dest_ip_ranges      = # value needed
    dest_ports          = # value needed
    ip_protocols        = # value needed
    src_asns            = # value needed
    src_ip_ranges       = # value needed
    src_ports           = # value needed
    src_region_codes    = # value needed
    user_defined_fields = # value needed
    user_defined_fields {
      name   = # value needed
      values = # value needed
    }
  }
  project = # value needed
}

modular-magician · 2024-04-17T21:46:18Z

Tests analytics

Total tests: 903
Passed tests: 826
Skipped tests: 72
Affected tests: 5

Click here to see the affected service packages

compute

Action taken

Found 5 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccComputeSecurityPolicyRule_basicUpdate|TestAccComputeSecurityPolicyRule_extendedUpdate|TestAccComputeSecurityPolicyRule_securityPolicyRuleBasicExample|TestAccComputeSecurityPolicyRule_securityPolicyRuleMultipleRulesExample|TestAccComputeSecurityPolicyRule_withRuleExpr

Get to know how VCR tests work

modular-magician · 2024-04-17T21:48:23Z

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccComputeSecurityPolicyRule_basicUpdate[Debug log]
TestAccComputeSecurityPolicyRule_extendedUpdate[Debug log]
TestAccComputeSecurityPolicyRule_securityPolicyRuleBasicExample[Debug log]
TestAccComputeSecurityPolicyRule_securityPolicyRuleMultipleRulesExample[Debug log]
TestAccComputeSecurityPolicyRule_withRuleExpr[Debug log]

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log or the debug log for each test

related tests;

shuyama1 · 2024-04-18T19:00:53Z

mmv1/templates/terraform/examples/security_policy_rule_basic.tf.erb

@@ -0,0 +1,23 @@
+resource "google_compute_security_policy" "default" {
+  provider    = google-beta


I'm still in the middle of reviewing this PR. A quick suggestion is removing provider = google-beta in the examples as this resource + its examples are no longer marked as beta-only in the latest commit

…ty-policy

modular-magician · 2024-04-18T19:42:27Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 6 files changed, 2871 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 6 files changed, 2871 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 598 insertions(+))
Open in Cloud Shell: Diff ( 8 files changed, 254 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_compute_security_policy_rule (11 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_compute_security_policy_rule" "primary" {
  match {
    expr {
      description = # value needed
      location    = # value needed
      title       = # value needed
    }
  }
  network_match {
    dest_ip_ranges   = # value needed
    dest_ports       = # value needed
    ip_protocols     = # value needed
    src_asns         = # value needed
    src_ip_ranges    = # value needed
    src_ports        = # value needed
    src_region_codes = # value needed
    user_defined_fields {
      name   = # value needed
      values = # value needed
    }
  }
  preconfigured_waf_config {
    exclusion {
      request_cookie {
        value = # value needed
      }
    }
  }
  project = # value needed
}

modular-magician · 2024-04-18T20:02:52Z

Tests analytics

Total tests: 904
Passed tests: 831
Skipped tests: 72
Affected tests: 1

Click here to see the affected service packages

compute

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccComputeSecurityPolicyRule_withPreconfiguredWafConfig

Get to know how VCR tests work

modular-magician · 2024-04-18T20:05:28Z

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccComputeSecurityPolicyRule_withPreconfiguredWafConfig[Debug log]

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log or the debug log for each test

modular-magician · 2024-04-18T23:07:31Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 6 files changed, 2871 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 6 files changed, 2871 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 598 insertions(+))
Open in Cloud Shell: Diff ( 8 files changed, 254 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_compute_security_policy_rule (11 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_compute_security_policy_rule" "primary" {
  match {
    expr {
      description = # value needed
      location    = # value needed
      title       = # value needed
    }
  }
  network_match {
    dest_ip_ranges   = # value needed
    dest_ports       = # value needed
    ip_protocols     = # value needed
    src_asns         = # value needed
    src_ip_ranges    = # value needed
    src_ports        = # value needed
    src_region_codes = # value needed
    user_defined_fields {
      name   = # value needed
      values = # value needed
    }
  }
  preconfigured_waf_config {
    exclusion {
      request_cookie {
        value = # value needed
      }
    }
  }
  project = # value needed
}

modular-magician · 2024-04-18T23:27:48Z

Tests analytics

Total tests: 904
Passed tests: 832
Skipped tests: 72
Affected tests: 0

Click here to see the affected service packages

compute

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log

matheusaleixo-cit · 2024-04-19T19:16:56Z

mmv1/templates/terraform/examples/security_policy_rule_default_rule.tf.erb

+  type        = "CLOUD_ARMOR"
+}
+
+# A default rule is generated when creating the security_policy resource, import is needed to patch it


The same issue exists in the regional security policy rule resource: hashicorp/terraform-provider-google#15687

matheusaleixo-cit · 2024-04-19T20:34:48Z

I commented out the fields inside the "network_match" block, and "title", "description" and "network" in the "expr" block.
Those fields are presented in the API docs, but doesn't seen to be supported. The "expr" fields don't update the values in the resource at all when testing the patchRule endpoint, and "network_match" is only used for policies of type CLOUD_ARMOR_NETWORK, which the global security policy resource does not support.

shuyama1 · 2024-04-18T19:24:41Z