Skip to content

Commit 75b7aac

Browse files
modular-magicianmodular-magician
authored
Fixed SecurityPolicyRule and RegionSecurityPolicyRule resources being unable to manage the policy default rule (#12054) (#20066)
[upstream:3715cf5f9ec3acffbde4f9ce51fd18928a09696a] Signed-off-by: Modular Magician <magic-modules@google.com>
1 parent 0c453bc commit 75b7aac

7 files changed

+218
-145
lines changed

‎.changelog/12054.txt

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
```release-note:bug
2+
compute: fixed unable to create default rule when using `google_compute_region_security_policy_rule` resource (beta)
3+
```
4+
```release-note:bug
5+
compute: fixed unable to create default rule when using `google_compute_security_policy_rule` resource
6+
```

‎google/services/compute/resource_compute_security_policy_rule.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,17 @@ func resourceComputeSecurityPolicyRuleCreate(d *schema.ResourceData, meta interf
555555
}
556556

557557
headers := make(http.Header)
558+
// We can't Create a default rule since one is automatically created with the policy
559+
rulePriority, ok := d.GetOk("priority")
560+
561+
if ok && rulePriority.(int) == 2147483647 {
562+
log.Printf("[WARN] SecurityPolicyRule represents a default rule, will attempt an Update instead")
563+
newUrl, err := tpgresource.ReplaceVars(d, config, "{{ComputeBasePath}}projects/{{project}}/global/securityPolicies/{{security_policy}}/patchRule?priority={{priority}}")
564+
if err != nil {
565+
return err
566+
}
567+
url = newUrl
568+
}
558569
res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
559570
Config: config,
560571
Method: "POST",
@@ -832,6 +843,13 @@ func resourceComputeSecurityPolicyRuleDelete(d *schema.ResourceData, meta interf
832843
}
833844

834845
headers := make(http.Header)
846+
// The default rule of a Security Policy cannot be removed
847+
rulePriority, ok := d.GetOk("priority")
848+
849+
if ok && rulePriority.(int) == 2147483647 {
850+
log.Printf("[WARN] SecurityPolicyRule represents a default rule, skipping Delete request")
851+
return nil
852+
}
835853

836854
log.Printf("[DEBUG] Deleting SecurityPolicyRule %q", d.Id())
837855
res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{

‎google/services/compute/resource_compute_security_policy_rule_generated_test.go

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,68 @@ resource "google_compute_security_policy_rule" "policy_rule" {
7979
`, context)
8080
}
8181

82+
func TestAccComputeSecurityPolicyRule_securityPolicyRuleDefaultRuleExample(t *testing.T) {
83+
t.Parallel()
84+
85+
context := map[string]interface{}{
86+
"random_suffix": acctest.RandString(t, 10),
87+
}
88+
89+
acctest.VcrTest(t, resource.TestCase{
90+
PreCheck: func() { acctest.AccTestPreCheck(t) },
91+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
92+
CheckDestroy: testAccCheckComputeSecurityPolicyRuleDestroyProducer(t),
93+
Steps: []resource.TestStep{
94+
{
95+
Config: testAccComputeSecurityPolicyRule_securityPolicyRuleDefaultRuleExample(context),
96+
},
97+
{
98+
ResourceName: "google_compute_security_policy_rule.policy_rule",
99+
ImportState: true,
100+
ImportStateVerify: true,
101+
ImportStateVerifyIgnore: []string{"security_policy"},
102+
},
103+
},
104+
})
105+
}
106+
107+
func testAccComputeSecurityPolicyRule_securityPolicyRuleDefaultRuleExample(context map[string]interface{}) string {
108+
return acctest.Nprintf(`
109+
resource "google_compute_security_policy" "default" {
110+
name = "policyruletest%{random_suffix}"
111+
description = "basic global security policy"
112+
type = "CLOUD_ARMOR"
113+
}
114+
115+
resource "google_compute_security_policy_rule" "default_rule" {
116+
security_policy = google_compute_security_policy.default.name
117+
description = "default rule"
118+
action = "deny"
119+
priority = "2147483647"
120+
match {
121+
versioned_expr = "SRC_IPS_V1"
122+
config {
123+
src_ip_ranges = ["*"]
124+
}
125+
}
126+
}
127+
128+
resource "google_compute_security_policy_rule" "policy_rule" {
129+
security_policy = google_compute_security_policy.default.name
130+
description = "new rule"
131+
priority = 100
132+
match {
133+
versioned_expr = "SRC_IPS_V1"
134+
config {
135+
src_ip_ranges = ["10.10.0.0/16"]
136+
}
137+
}
138+
action = "allow"
139+
preview = true
140+
}
141+
`, context)
142+
}
143+
82144
func TestAccComputeSecurityPolicyRule_securityPolicyRuleMultipleRulesExample(t *testing.T) {
83145
t.Parallel()
84146

‎google/services/compute/resource_compute_security_policy_rule_sweeper.go

Lines changed: 0 additions & 139 deletions
This file was deleted.

‎google/services/compute/resource_compute_security_policy_test.go

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,38 @@ func TestAccComputeSecurityPolicy_update(t *testing.T) {
124124
})
125125
}
126126

127+
func TestAccComputeSecurityPolicyRule_securityPolicyDefaultRule(t *testing.T) {
128+
t.Parallel()
129+
130+
context := map[string]interface{}{
131+
"random_suffix": acctest.RandString(t, 10),
132+
}
133+
134+
acctest.VcrTest(t, resource.TestCase{
135+
PreCheck: func() { acctest.AccTestPreCheck(t) },
136+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
137+
CheckDestroy: testAccCheckComputeSecurityPolicyRuleDestroyProducer(t),
138+
Steps: []resource.TestStep{
139+
{
140+
Config: testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleDeny(context),
141+
},
142+
{
143+
ResourceName: "google_compute_security_policy_rule.policy_rule_default",
144+
ImportState: true,
145+
ImportStateVerify: true,
146+
},
147+
{
148+
Config: testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleAllow(context),
149+
},
150+
{
151+
ResourceName: "google_compute_security_policy_rule.policy_rule_default",
152+
ImportState: true,
153+
ImportStateVerify: true,
154+
},
155+
},
156+
})
157+
}
158+
127159
func TestAccComputeSecurityPolicy_withAdvancedOptionsConfig(t *testing.T) {
128160
t.Parallel()
129161

@@ -689,6 +721,52 @@ resource "google_compute_security_policy" "policy" {
689721
`, spName)
690722
}
691723

724+
func testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleDeny(context map[string]interface{}) string {
725+
return acctest.Nprintf(`
726+
resource "google_compute_security_policy" "default" {
727+
name = "tf-test%{random_suffix}"
728+
description = "basic global security policy"
729+
type = "CLOUD_ARMOR"
730+
}
731+
732+
resource "google_compute_security_policy_rule" "policy_rule_default" {
733+
security_policy = google_compute_security_policy.default.name
734+
description = "default rule"
735+
action = "deny"
736+
priority = "2147483647"
737+
match {
738+
versioned_expr = "SRC_IPS_V1"
739+
config {
740+
src_ip_ranges = ["*"]
741+
}
742+
}
743+
}
744+
`, context)
745+
}
746+
747+
func testAccComputeSecurityPolicyRule_securityPolicyDefaultRuleAllow(context map[string]interface{}) string {
748+
return acctest.Nprintf(`
749+
resource "google_compute_security_policy" "default" {
750+
name = "tf-test%{random_suffix}"
751+
description = "basic global security policy"
752+
type = "CLOUD_ARMOR"
753+
}
754+
755+
resource "google_compute_security_policy_rule" "policy_rule_default" {
756+
security_policy = google_compute_security_policy.default.name
757+
description = "default rule"
758+
action = "allow"
759+
priority = "2147483647"
760+
match {
761+
versioned_expr = "SRC_IPS_V1"
762+
config {
763+
src_ip_ranges = ["*"]
764+
}
765+
}
766+
}
767+
`, context)
768+
}
769+
692770
func testAccComputeSecurityPolicy_withRuleExpr(spName string) string {
693771
return fmt.Sprintf(`
694772
resource "google_compute_security_policy" "policy" {

‎website/docs/r/compute_region_security_policy_rule.html.markdown

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,54 @@ resource "google_compute_region_security_policy_rule" "policy_rule_two" {
117117
preview = true
118118
}
119119
```
120+
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
121+
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md&cloudshell_working_dir=region_security_policy_rule_default_rule&open_in_editor=main.tf" target="_blank">
122+
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
123+
</a>
124+
</div>
125+
## Example Usage - Region Security Policy Rule Default Rule
126+
127+
128+
```hcl
129+
resource "google_compute_region_security_policy" "default" {
130+
provider = google-beta
131+
region = "us-west2"
132+
name = "policywithdefaultrule"
133+
description = "basic region security policy"
134+
type = "CLOUD_ARMOR"
135+
}
136+
137+
resource "google_compute_region_security_policy_rule" "default_rule" {
138+
provider = google-beta
139+
region = "us-west2"
140+
security_policy = google_compute_region_security_policy.default.name
141+
description = "new rule"
142+
action = "deny"
143+
priority = "2147483647"
144+
match {
145+
versioned_expr = "SRC_IPS_V1"
146+
config {
147+
src_ip_ranges = ["*"]
148+
}
149+
}
150+
}
151+
152+
resource "google_compute_region_security_policy_rule" "policy_rule" {
153+
provider = google-beta
154+
region = "us-west2"
155+
security_policy = google_compute_region_security_policy.default.name
156+
description = "new rule"
157+
priority = 100
158+
match {
159+
versioned_expr = "SRC_IPS_V1"
160+
config {
161+
src_ip_ranges = ["10.10.0.0/16"]
162+
}
163+
}
164+
action = "allow"
165+
preview = true
166+
}
167+
```
120168
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
121169
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md&cloudshell_working_dir=region_security_policy_rule_with_preconfigured_waf_config&open_in_editor=main.tf" target="_blank">
122170
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">

0 commit comments

Comments
 (0)