Adds support for external SPGs to net-firewall-policy

modules/net-firewall-policy/README.md

@@ -253,19 +253,76 @@ issue-1995:
       - 1-65535
     - protocol: icmp
 ```
+
+You might need to reference external security profile groups in your firewall rules, using their Terraform ids. For example, `//networksecurity.googleapis.com/${google_network_security_security_profile_group.security_profile_group.id}`. To do so, list your security profile groups in the `security_profile_group_ids` map variable. Then reference them by key from your factories.
+
+```hcl
+module "vpc" {
+  source     = "./fabric/modules/net-vpc"
+  project_id = "my-project"
+  name       = "my-network"
+}
+
+resource "google_network_security_security_profile" "security_profile" {
+  name     = "security-profile"
+  type     = "THREAT_PREVENTION"
+  parent   = "organizations/0123456789"
+  location = "global"
+}
+
+resource "google_network_security_security_profile_group" "security_profile_group" {
+  name                      = "security-profile-group"
+  parent                    = "organizations/0123456789"
+  location                  = "global"
+  description               = "Sample security profile group."
+  threat_prevention_profile = google_network_security_security_profile.security_profile.id
+}
+
+module "firewall-policy" {
+  source    = "./fabric/modules/net-firewall-policy"
+  name      = "fw-policy"
+  parent_id = "my-project"
+  security_profile_group_ids = {
+    http-sg = "//networksecurity.googleapis.com/${google_network_security_security_profile_group.security_profile_group.id}"
+  }
+  attachments = {
+    my-vpc = module.vpc.self_link
+  }
+  factories_config = {
+    ingress_rules_file_path = "configs/ingress-spg.yaml"
+  }
+}
+# tftest modules=2 resources=8 files=ingress-spg inventory=factory-spg.yaml
+```
+
+```yaml
+# tftest-file id=ingress-spg path=configs/ingress-spg.yaml
+http:
+  priority: 1000
+  action: apply_security_profile_group
+  security_profile_group: http-sg
+  match:
+    source_ranges:
+    - 10.0.0.0/8
+    layer4_configs:
+    - protocol: tcp
+      ports:
+      - 80
+```
 <!-- BEGIN TFDOC -->
 ## Variables
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [name](variables.tf#L115) | Policy name. | <code>string</code> | ✓ |  |
-| [parent_id](variables.tf#L121) | Parent node where the policy will be created, `folders/nnn` or `organizations/nnn` for hierarchical policy, project id for a network policy. | <code>string</code> | ✓ |  |
+| [name](variables.tf#L117) | Policy name. | <code>string</code> | ✓ |  |
+| [parent_id](variables.tf#L123) | Parent node where the policy will be created, `folders/nnn` or `organizations/nnn` for hierarchical policy, project id for a network policy. | <code>string</code> | ✓ |  |
 | [attachments](variables.tf#L17) | Ids of the resources to which this policy will be attached, in descriptive name => self link format. Specify folders or organization for hierarchical policy, VPCs for network policy. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 | [description](variables.tf#L24) | Policy description. | <code>string</code> |  | <code>null</code> |
-| [egress_rules](variables.tf#L30) | List of egress rule definitions, action can be 'allow', 'deny', 'goto_next' or 'apply_security_profile_group'. The match.layer4configs map is in protocol => optional [ports] format. | <code title="map&#40;object&#40;&#123;&#10;  priority                &#61; number&#10;  action                  &#61; optional&#40;string, &#34;deny&#34;&#41;&#10;  description             &#61; optional&#40;string&#41;&#10;  disabled                &#61; optional&#40;bool, false&#41;&#10;  enable_logging          &#61; optional&#40;bool&#41;&#10;  security_profile_group  &#61; optional&#40;string&#41;&#10;  target_resources        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_service_accounts &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_tags             &#61; optional&#40;list&#40;string&#41;&#41;&#10;  match &#61; object&#40;&#123;&#10;    address_groups       &#61; optional&#40;list&#40;string&#41;&#41;&#10;    fqdns                &#61; optional&#40;list&#40;string&#41;&#41;&#10;    region_codes         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    threat_intelligences &#61; optional&#40;list&#40;string&#41;&#41;&#10;    destination_ranges   &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_ranges        &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_tags          &#61; optional&#40;list&#40;string&#41;&#41;&#10;    layer4_configs &#61; optional&#40;list&#40;object&#40;&#123;&#10;      protocol &#61; optional&#40;string, &#34;all&#34;&#41;&#10;      ports    &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;, &#91;&#123;&#125;&#93;&#41;&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [factories_config](variables.tf#L67) | Paths to folders for the optional factories. | <code title="object&#40;&#123;&#10;  cidr_file_path          &#61; optional&#40;string&#41;&#10;  egress_rules_file_path  &#61; optional&#40;string&#41;&#10;  ingress_rules_file_path &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [ingress_rules](variables.tf#L78) | List of ingress rule definitions, action can be 'allow', 'deny', 'goto_next' or 'apply_security_profile_group'. | <code title="map&#40;object&#40;&#123;&#10;  priority                &#61; number&#10;  action                  &#61; optional&#40;string, &#34;allow&#34;&#41;&#10;  description             &#61; optional&#40;string&#41;&#10;  disabled                &#61; optional&#40;bool, false&#41;&#10;  enable_logging          &#61; optional&#40;bool&#41;&#10;  security_profile_group  &#61; optional&#40;string&#41;&#10;  target_resources        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_service_accounts &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_tags             &#61; optional&#40;list&#40;string&#41;&#41;&#10;  match &#61; object&#40;&#123;&#10;    address_groups       &#61; optional&#40;list&#40;string&#41;&#41;&#10;    fqdns                &#61; optional&#40;list&#40;string&#41;&#41;&#10;    region_codes         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    threat_intelligences &#61; optional&#40;list&#40;string&#41;&#41;&#10;    destination_ranges   &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_ranges        &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_tags          &#61; optional&#40;list&#40;string&#41;&#41;&#10;    layer4_configs &#61; optional&#40;list&#40;object&#40;&#123;&#10;      protocol &#61; optional&#40;string, &#34;all&#34;&#41;&#10;      ports    &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;, &#91;&#123;&#125;&#93;&#41;&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [region](variables.tf#L127) | Policy region. Leave null for hierarchical policy, set to 'global' for a global network policy. | <code>string</code> |  | <code>null</code> |
+| [egress_rules](variables.tf#L30) | List of egress rule definitions, action can be 'allow', 'deny', 'goto_next' or 'apply_security_profile_group'. The match.layer4configs map is in protocol => optional [ports] format. | <code title="map&#40;object&#40;&#123;&#10;  priority                &#61; number&#10;  action                  &#61; optional&#40;string, &#34;deny&#34;&#41;&#10;  description             &#61; optional&#40;string&#41;&#10;  disabled                &#61; optional&#40;bool, false&#41;&#10;  enable_logging          &#61; optional&#40;bool&#41;&#10;  security_profile_group  &#61; optional&#40;string&#41;&#10;  target_resources        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_service_accounts &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_tags             &#61; optional&#40;list&#40;string&#41;&#41;&#10;  tls_inspect             &#61; optional&#40;bool, null&#41;&#10;  match &#61; object&#40;&#123;&#10;    address_groups       &#61; optional&#40;list&#40;string&#41;&#41;&#10;    fqdns                &#61; optional&#40;list&#40;string&#41;&#41;&#10;    region_codes         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    threat_intelligences &#61; optional&#40;list&#40;string&#41;&#41;&#10;    destination_ranges   &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_ranges        &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_tags          &#61; optional&#40;list&#40;string&#41;&#41;&#10;    layer4_configs &#61; optional&#40;list&#40;object&#40;&#123;&#10;      protocol &#61; optional&#40;string, &#34;all&#34;&#41;&#10;      ports    &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;, &#91;&#123;&#125;&#93;&#41;&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [factories_config](variables.tf#L68) | Paths to folders for the optional factories. | <code title="object&#40;&#123;&#10;  cidr_file_path          &#61; optional&#40;string&#41;&#10;  egress_rules_file_path  &#61; optional&#40;string&#41;&#10;  ingress_rules_file_path &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [ingress_rules](variables.tf#L79) | List of ingress rule definitions, action can be 'allow', 'deny', 'goto_next' or 'apply_security_profile_group'. | <code title="map&#40;object&#40;&#123;&#10;  priority                &#61; number&#10;  action                  &#61; optional&#40;string, &#34;allow&#34;&#41;&#10;  description             &#61; optional&#40;string&#41;&#10;  disabled                &#61; optional&#40;bool, false&#41;&#10;  enable_logging          &#61; optional&#40;bool&#41;&#10;  security_profile_group  &#61; optional&#40;string&#41;&#10;  target_resources        &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_service_accounts &#61; optional&#40;list&#40;string&#41;&#41;&#10;  target_tags             &#61; optional&#40;list&#40;string&#41;&#41;&#10;  tls_inspect             &#61; optional&#40;bool, null&#41;&#10;  match &#61; object&#40;&#123;&#10;    address_groups       &#61; optional&#40;list&#40;string&#41;&#41;&#10;    fqdns                &#61; optional&#40;list&#40;string&#41;&#41;&#10;    region_codes         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    threat_intelligences &#61; optional&#40;list&#40;string&#41;&#41;&#10;    destination_ranges   &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_ranges        &#61; optional&#40;list&#40;string&#41;&#41;&#10;    source_tags          &#61; optional&#40;list&#40;string&#41;&#41;&#10;    layer4_configs &#61; optional&#40;list&#40;object&#40;&#123;&#10;      protocol &#61; optional&#40;string, &#34;all&#34;&#41;&#10;      ports    &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;, &#91;&#123;&#125;&#93;&#41;&#10;  &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [region](variables.tf#L129) | Policy region. Leave null for hierarchical policy, set to 'global' for a global network policy. | <code>string</code> |  | <code>null</code> |
+| [security_profile_group_ids](variables.tf#L135) | The optional security groups ids to be referenced in factories. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 
 ## Outputs
 

modules/net-firewall-policy/factory.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ locals {
       target_resources        = lookup(v, "target_resources", null)
       target_service_accounts = lookup(v, "target_service_accounts", null)
       target_tags             = lookup(v, "target_tags", null)
+      tls_inspect             = lookup(v, "tls_inspect", null)
       match = {
         address_groups       = lookup(v.match, "address_groups", null)
         fqdns                = lookup(v.match, "fqdns", null)
@@ -85,6 +86,7 @@ locals {
       target_resources        = lookup(v, "target_resources", null)
       target_service_accounts = lookup(v, "target_service_accounts", null)
       target_tags             = lookup(v, "target_tags", null)
+      tls_inspect             = lookup(v, "tls_inspect", null)
       match = {
         address_groups       = lookup(v.match, "address_groups", null)
         fqdns                = lookup(v.match, "fqdns", null)

modules/net-firewall-policy/hierarchical.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,12 +37,16 @@ resource "google_compute_firewall_policy_rule" "hierarchical" {
   action                  = local.rules[each.key].action
   description             = local.rules[each.key].description
   direction               = local.rules[each.key].direction
-  security_profile_group  = local.rules[each.key].security_profile_group
   disabled                = local.rules[each.key].disabled
   enable_logging          = local.rules[each.key].enable_logging
   priority                = local.rules[each.key].priority
   target_resources        = local.rules[each.key].target_resources
   target_service_accounts = local.rules[each.key].target_service_accounts
+  tls_inspect             = local.rules[each.key].tls_inspect
+  security_profile_group = try(
+    var.security_profile_group_ids[local.rules[each.key].security_profile_group],
+    local.rules[each.key].security_profile_group
+  )
   match {
     dest_ip_ranges = local.rules[each.key].match.destination_ranges
     src_ip_ranges  = local.rules[each.key].match.source_ranges

modules/net-firewall-policy/net-global.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,11 +44,15 @@ resource "google_compute_network_firewall_policy_rule" "net-global" {
   action                  = local.rules[each.key].action
   description             = local.rules[each.key].description
   direction               = local.rules[each.key].direction
-  security_profile_group  = local.rules[each.key].security_profile_group
   disabled                = local.rules[each.key].disabled
   enable_logging          = local.rules[each.key].enable_logging
   priority                = local.rules[each.key].priority
   target_service_accounts = local.rules[each.key].target_service_accounts
+  tls_inspect             = local.rules[each.key].tls_inspect
+  security_profile_group = try(
+    var.security_profile_group_ids[local.rules[each.key].security_profile_group],
+    local.rules[each.key].security_profile_group
+  )
   match {
     dest_ip_ranges = local.rules[each.key].match.destination_ranges
     src_ip_ranges  = local.rules[each.key].match.source_ranges

modules/net-firewall-policy/net-regional.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,6 @@ resource "google_compute_region_network_firewall_policy_rule" "net-regional" {
   action                  = local.rules[each.key].action
   description             = local.rules[each.key].description
   direction               = local.rules[each.key].direction
-  security_profile_group  = local.rules[each.key].security_profile_group
   disabled                = local.rules[each.key].disabled
   enable_logging          = local.rules[each.key].enable_logging
   priority                = local.rules[each.key].priority

modules/net-firewall-policy/variables.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ variable "egress_rules" {
     target_resources        = optional(list(string))
     target_service_accounts = optional(list(string))
     target_tags             = optional(list(string))
+    tls_inspect             = optional(bool, null)
     match = object({
       address_groups       = optional(list(string))
       fqdns                = optional(list(string))
@@ -87,6 +88,7 @@ variable "ingress_rules" {
     target_resources        = optional(list(string))
     target_service_accounts = optional(list(string))
     target_tags             = optional(list(string))
+    tls_inspect             = optional(bool, null)
     match = object({
       address_groups       = optional(list(string))
       fqdns                = optional(list(string))
@@ -129,3 +131,10 @@ variable "region" {
   type        = string
   default     = null
 }
+
+variable "security_profile_group_ids" {
+  description = "The optional security groups ids to be referenced in factories."
+  type        = map(string)
+  nullable    = false
+  default     = {}
+}