fix(networkfirewall): fixed import for networkfirewall resources

[haarchri]

Description of your changes

1. fix import for the following networkfirewall resources:
   aws_networkfirewall_firewall_policy
aws_networkfirewall_rule_group

2)implement missing ref/selector for ruleGroup in aws_networkfirewall_firewall_policy
3)add more complex example for aws_networkfirewall_firewall_policy and aws_networkfirewall_rule_group

Fixes #658
Fixes #657

I have:

• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

kubectl apply -f firewallpolicy-complex.yaml
firewallpolicy.networkfirewall.aws.upbound.io/example-default-policy created
rulegroup.networkfirewall.aws.upbound.io/example-forward-all created
rulegroup.networkfirewall.aws.upbound.io/example-allow-domainlist created
rulegroup.networkfirewall.aws.upbound.io/example-deny created

NAME                                                                   READY   SYNCED   EXTERNAL-NAME            AGE
firewallpolicy.networkfirewall.aws.upbound.io/example-default-policy   True    True     example-default-policy   3m17s

NAME                                                                READY   SYNCED   EXTERNAL-NAME              AGE
rulegroup.networkfirewall.aws.upbound.io/example-allow-domainlist   True    True     example-allow-domainlist   3m17s
rulegroup.networkfirewall.aws.upbound.io/example-deny               True    True     example-deny               3m17s
rulegroup.networkfirewall.aws.upbound.io/example-forward-all        True    True     example-forward-all        3m17s

updated deletionPolicy: Orphan

kubectl delete -f firewallpolicy-complex.yaml 
firewallpolicy.networkfirewall.aws.upbound.io "example-default-policy" deleted
rulegroup.networkfirewall.aws.upbound.io "example-forward-all" deleted
rulegroup.networkfirewall.aws.upbound.io "example-allow-domainlist" deleted
rulegroup.networkfirewall.aws.upbound.io "example-deny" deleted

kubectl apply -f firewallpolicy-complex.yaml
firewallpolicy.networkfirewall.aws.upbound.io/example-default-policy created
rulegroup.networkfirewall.aws.upbound.io/example-forward-all created
rulegroup.networkfirewall.aws.upbound.io/example-allow-domainlist created
rulegroup.networkfirewall.aws.upbound.io/example-deny created

NAME                                                                   READY   SYNCED   EXTERNAL-NAME            AGE
firewallpolicy.networkfirewall.aws.upbound.io/example-default-policy   True    True     example-default-policy   1m12s

NAME                                                                READY   SYNCED   EXTERNAL-NAME              AGE
rulegroup.networkfirewall.aws.upbound.io/example-allow-domainlist   True    True     example-allow-domainlist   1m12s
rulegroup.networkfirewall.aws.upbound.io/example-deny               True    True     example-deny               1m12s
rulegroup.networkfirewall.aws.upbound.io/example-forward-all        True    True     example-forward-all        1m12s

[haarchri]

cannot add breaking change to this PR :/
checkout: https://github.com/upbound/provider-aws/actions/runs/4630635501/jobs/8192470088?pr=661#step:4:15

[haarchri]

/test-examples="examples/networkfirewall/firewall.yaml"

[haarchri]

/test-examples="examples/networkfirewall/firewallpolicy-complex.yaml"

[ytsarev]

Thanks a lot for the thorough testing. Left couple of comments regarding external name configuration

[haarchri]

@ulucinar any idea for the issue for import ? the only thing which helped was to switch the identifier - great to hear your feedback ;)

[ulucinar]

Hi @haarchri,
Thank you for addressing these issues. I'm posting some review comments to discuss.

I will also investigate why the old configuration is broken and leave a comment in the discussion.

[ulucinar]

Hi @haarchri,
After the root cause analysis, I'm leaving some more comments for us to discuss. If we do not switch to config.IdentifierFromProvider, then we will also need to change the extractors in the newly introduced referencer configuration. Currently, those new referencer configurations are relying on the rule group being configured with config.IdentifierFromProvider. We may use the common.PathARNExtractor to extract the ARN of a rule group resource.

[haarchri]

@ulucinar we can remove the breaking-change label then

[haarchri]

/test-examples="examples/networkfirewall/firewallpolicy-complex.yaml"

[ulucinar]

Thank you @haarchri, lgtm.