Tests for other firewall policy types

GoogleCloudPlatform · Aug 8, 2023 · b21cd41 · b21cd41
1 parent da8a491
commit b21cd41
Show file tree

Hide file tree

Showing 5 changed files with 351 additions and 16 deletions.
diff --git a/modules/net-vpc-firewall-policy/README.md b/modules/net-vpc-firewall-policy/README.md
@@ -54,7 +54,7 @@ module "firewall-policy" {
     }
   }
 }
-# tftest modules=1 resources=6
+# tftest modules=1 resources=6 inventory=hierarchical.yaml
 ```
 
 ### Global Network policy
@@ -106,7 +106,7 @@ module "firewall-policy" {
     }
   }
 }
-# tftest modules=2 resources=9
+# tftest modules=2 resources=9 inventory=global-net.yaml
 ```
 
 ### Regional Network policy
@@ -145,7 +145,7 @@ module "firewall-policy" {
     }
   }
 }
-# tftest modules=2 resources=7
+# tftest modules=2 resources=7 inventory=regional-net.yaml
 ```
 
 ### Factory

diff --git a/tests/modules/net_vpc_firewall_policy/examples/factory.yaml b/tests/modules/net_vpc_firewall_policy/examples/factory.yaml
@@ -14,17 +14,13 @@
 
 values:
   module.firewall-policy.google_compute_firewall_policy.hierarchical[0]:
-    description: null
     parent: folders/1234567890
     short_name: test-1
-    timeouts: null
   module.firewall-policy.google_compute_firewall_policy_association.hierarchical["test"]:
     attachment_target: folders/4567890123
     name: test-1-test
-    timeouts: null
   module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["icmp"]:
     action: allow
-    description: null
     direction: INGRESS
     disabled: false
     enable_logging: null
@@ -46,10 +42,8 @@ values:
     priority: 1000
     target_resources: null
     target_service_accounts: null
-    timeouts: null
   module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["smtp"]:
     action: deny
-    description: null
     direction: EGRESS
     disabled: false
     enable_logging: null
@@ -74,10 +68,8 @@ values:
     priority: 900
     target_resources: null
     target_service_accounts: null
-    timeouts: null
   module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["ssh"]:
     action: allow
-    description: null
     direction: INGRESS
     disabled: false
     enable_logging: null
@@ -100,14 +92,9 @@ values:
     priority: 1002
     target_resources: null
     target_service_accounts: null
-    timeouts: null
 
 counts:
   google_compute_firewall_policy: 1
   google_compute_firewall_policy_association: 1
   google_compute_firewall_policy_rule: 3
-  modules: 1
-  resources: 5
-
-outputs: {}
 
diff --git a/tests/modules/net_vpc_firewall_policy/examples/global-net.yaml b/tests/modules/net_vpc_firewall_policy/examples/global-net.yaml
@@ -0,0 +1,137 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.firewall-policy.google_compute_network_firewall_policy.net-global[0]:
+    name: test-1
+    project: my-project
+  module.firewall-policy.google_compute_network_firewall_policy_association.net-global["my-vpc"]:
+    firewall_policy: test-1
+    name: test-1-my-vpc
+    project: my-project
+  module.firewall-policy.google_compute_network_firewall_policy_rule.net-global["egress/smtp"]:
+    action: deny
+    direction: EGRESS
+    disabled: false
+    enable_logging: null
+    firewall_policy: test-1
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges:
+      - 0.0.0.0/0
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: tcp
+        ports:
+        - '25'
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges: null
+      src_region_codes: null
+      src_secure_tags: []
+      src_threat_intelligences: null
+    priority: 900
+    project: my-project
+    rule_name: egress/smtp
+    target_secure_tags: []
+    target_service_accounts: null
+  module.firewall-policy.google_compute_network_firewall_policy_rule.net-global["ingress/icmp"]:
+    action: allow
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    firewall_policy: test-1
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: icmp
+        ports: null
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 0.0.0.0/0
+      src_region_codes: null
+      src_secure_tags: []
+      src_threat_intelligences: null
+    priority: 1000
+    project: my-project
+    rule_name: ingress/icmp
+    target_secure_tags: []
+    target_service_accounts: null
+  module.firewall-policy.google_compute_network_firewall_policy_rule.net-global["ingress/mgmt"]:
+    action: allow
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    firewall_policy: test-1
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: all
+        ports: null
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 10.1.1.0/24
+      src_region_codes: null
+      src_secure_tags: []
+      src_threat_intelligences: null
+    priority: 1001
+    project: my-project
+    rule_name: ingress/mgmt
+    target_secure_tags: []
+    target_service_accounts: null
+  module.firewall-policy.google_compute_network_firewall_policy_rule.net-global["ingress/ssh"]:
+    action: allow
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    firewall_policy: test-1
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: tcp
+        ports:
+        - '22'
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 10.0.0.0/8
+      src_region_codes: null
+      src_secure_tags: []
+      src_threat_intelligences: null
+    priority: 1002
+    project: my-project
+    rule_name: ingress/ssh
+    target_secure_tags: []
+    target_service_accounts: null
+
+counts:
+  google_compute_network_firewall_policy: 1
+  google_compute_network_firewall_policy_association: 1
+  google_compute_network_firewall_policy_rule: 4
diff --git a/tests/modules/net_vpc_firewall_policy/examples/hierarchical.yaml b/tests/modules/net_vpc_firewall_policy/examples/hierarchical.yaml
@@ -0,0 +1,125 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.firewall-policy.google_compute_firewall_policy.hierarchical[0]:
+    description: null
+    parent: folders/1234567890
+    short_name: test-1
+  module.firewall-policy.google_compute_firewall_policy_association.hierarchical["test"]:
+    attachment_target: folders/4567890123
+    name: test-1-test
+  module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["egress/smtp"]:
+    action: deny
+    description: null
+    direction: EGRESS
+    disabled: false
+    enable_logging: null
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges:
+      - 0.0.0.0/0
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: tcp
+        ports:
+        - '25'
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges: null
+      src_region_codes: null
+      src_threat_intelligences: null
+    priority: 900
+    target_resources: null
+    target_service_accounts: null
+  module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["ingress/icmp"]:
+    action: allow
+    description: null
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: icmp
+        ports: null
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 0.0.0.0/0
+      src_region_codes: null
+      src_threat_intelligences: null
+    priority: 1000
+    target_resources: null
+    target_service_accounts: null
+  module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["ingress/mgmt"]:
+    action: allow
+    description: null
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: all
+        ports: null
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 10.1.1.0/24
+      src_region_codes: null
+      src_threat_intelligences: null
+    priority: 1001
+    target_resources: null
+    target_service_accounts: null
+  module.firewall-policy.google_compute_firewall_policy_rule.hierarchical["ingress/ssh"]:
+    action: allow
+    description: null
+    direction: INGRESS
+    disabled: false
+    enable_logging: null
+    match:
+    - dest_address_groups: null
+      dest_fqdns: null
+      dest_ip_ranges: null
+      dest_region_codes: null
+      dest_threat_intelligences: null
+      layer4_configs:
+      - ip_protocol: tcp
+        ports:
+        - '22'
+      src_address_groups: null
+      src_fqdns: null
+      src_ip_ranges:
+      - 10.0.0.0/8
+      src_region_codes: null
+      src_threat_intelligences: null
+    priority: 1002
+    target_resources: null
+    target_service_accounts: null
+
+counts:
+  google_compute_firewall_policy: 1
+  google_compute_firewall_policy_association: 1
+  google_compute_firewall_policy_rule: 4