Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

f_aws-network-firewall-rule-group Add IP Prefix list #28335

Merged
merged 9 commits into from
Dec 16, 2022
Merged

f_aws-network-firewall-rule-group Add IP Prefix list #28335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c282a58
add IP Reference Sets
Dec 13, 2022
3714121
add IP Reference Sets
Dec 13, 2022
8d8bc30
Fix Linting Errors
Dec 14, 2022
66d0119
Fix Linting Errors
Dec 14, 2022
d649b37
Fix Peer Review Comments
Dec 15, 2022
ce9e053
Address Comments from Peer Review
Dec 16, 2022
fb33a84
Update 27421.txt
ewbankkit Dec 16, 2022
632e299
r/aws_networkfirewall_rule_group: Check 'reference_sets' in 'TestAccN…
ewbankkit Dec 16, 2022
d05535b
Fix typo.
ewbankkit Dec 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/27421.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:feature
resource/aws_networkfirewall_rule_group: Add `reference_sets` configuration block
```
195 changes: 156 additions & 39 deletions internal/service/networkfirewall/rule_group.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,13 +58,13 @@ func ResourceRuleGroup() *schema.Resource {
Computed: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"rule_variables": {
"reference_sets": {
Type: schema.TypeList,
Optional: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"ip_sets": {
"ip_set_references": {
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Resource{
Expand All @@ -78,47 +78,15 @@ func ResourceRuleGroup() *schema.Resource {
validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
),
},
"ip_set": {
"ip_set_reference": {
Type: schema.TypeList,
Required: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"definition": {
Type: schema.TypeSet,
Required: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
},
},
},
},
},
},
"port_sets": {
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"key": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.All(
validation.StringLenBetween(1, 32),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
),
},
"port_set": {
Type: schema.TypeList,
Required: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"definition": {
Type: schema.TypeSet,
Required: true,
Elem: &schema.Schema{Type: schema.TypeString},
"reference_arn": {
Type: schema.TypeString,
Required: true,
ValidateFunc: verify.ValidARN,
},
},
},
Expand Down Expand Up @@ -366,6 +334,77 @@ func ResourceRuleGroup() *schema.Resource {
},
},
},
"rule_variables": {
Type: schema.TypeList,
Optional: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"ip_sets": {
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"key": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.All(
validation.StringLenBetween(1, 32),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
),
},
"ip_set": {
Type: schema.TypeList,
Required: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"definition": {
Type: schema.TypeSet,
Required: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
},
},
},
},
},
},
"port_sets": {
Type: schema.TypeSet,
Optional: true,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"key": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.All(
validation.StringLenBetween(1, 32),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z]`), "must begin with alphabetic character"),
validation.StringMatch(regexp.MustCompile(`^[A-Za-z0-9_]+$`), "must contain only alphanumeric and underscore characters"),
),
},
"port_set": {
Type: schema.TypeList,
Required: true,
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"definition": {
Type: schema.TypeSet,
Required: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
},
},
},
},
},
},
},
},
},
"stateful_rule_options": {
Type: schema.TypeList,
Optional: true,
Expand Down Expand Up @@ -705,6 +744,17 @@ func expandRuleGroup(l []interface{}) *networkfirewall.RuleGroup {
return nil
}
ruleGroup := &networkfirewall.RuleGroup{}
if tfList, ok := tfMap["reference_sets"].([]interface{}); ok && len(tfList) > 0 && tfList[0] != nil {
referenceSets := &networkfirewall.ReferenceSets{}
rvMap, ok := tfList[0].(map[string]interface{})
if ok {
if v, ok := rvMap["ip_set_references"].(*schema.Set); ok && v.Len() > 0 {
referenceSets.IPSetReferences = expandIPSetReferences(v.List())
}

ruleGroup.ReferenceSets = referenceSets
}
}
if tfList, ok := tfMap["rule_variables"].([]interface{}); ok && len(tfList) > 0 && tfList[0] != nil {
ruleVariables := &networkfirewall.RuleVariables{}
rvMap, ok := tfList[0].(map[string]interface{})
Expand Down Expand Up @@ -780,7 +830,35 @@ func expandIPSets(l []interface{}) map[string]*networkfirewall.IPSet {

return m
}
func expandIPSetReferences(l []interface{}) map[string]*networkfirewall.IPSetReference {
if len(l) == 0 || l[0] == nil {
return nil
}

m := make(map[string]*networkfirewall.IPSetReference)
for _, tfMapRaw := range l {
tfMap, ok := tfMapRaw.(map[string]interface{})
if !ok {
continue
}

if key, ok := tfMap["key"].(string); ok && key != "" {
if tfList, ok := tfMap["ip_set_reference"].([]interface{}); ok && len(tfList) > 0 && tfList[0] != nil {
tfMap, ok := tfList[0].(map[string]interface{})
if ok {
if tfSet, ok := tfMap["reference_arn"].(string); ok && tfSet != "" {
ipSetReference := &networkfirewall.IPSetReference{
ReferenceArn: aws.String(tfSet),
}
m[key] = ipSetReference
}
}
}
}
}

return m
}
func expandPortSets(l []interface{}) map[string]*networkfirewall.PortSet {
if len(l) == 0 || l[0] == nil {
return nil
Expand Down Expand Up @@ -973,6 +1051,7 @@ func flattenRuleGroup(r *networkfirewall.RuleGroup) []interface{} {
}

m := map[string]interface{}{
"reference_sets": flattenReferenceSets(r.ReferenceSets),
"rule_variables": flattenRuleVariables(r.RuleVariables),
"rules_source": flattenRulesSource(r.RulesSource),
"stateful_rule_options": flattenStatefulRulesOptions(r.StatefulRuleOptions),
Expand All @@ -981,6 +1060,44 @@ func flattenRuleGroup(r *networkfirewall.RuleGroup) []interface{} {
return []interface{}{m}
}

func flattenReferenceSets(rv *networkfirewall.ReferenceSets) []interface{} {
if rv == nil {
return []interface{}{}
}
m := map[string]interface{}{
"ip_set_references": flattenIPSetReferences(rv.IPSetReferences),
}

return []interface{}{m}
}

func flattenIPSetReferences(m map[string]*networkfirewall.IPSetReference) []interface{} {
if m == nil {
return []interface{}{}
}
sets := make([]interface{}, 0, len(m))
for k, v := range m {
tfMap := map[string]interface{}{
"key": k,
"ip_set_reference": flattenIPSetReference(v),
}
sets = append(sets, tfMap)
}

return sets
}

func flattenIPSetReference(i *networkfirewall.IPSetReference) []interface{} {
if i == nil {
return []interface{}{}
}
m := map[string]interface{}{
"reference_arn": aws.StringValue(i.ReferenceArn),
}

return []interface{}{m}
}

func flattenRuleVariables(rv *networkfirewall.RuleVariables) []interface{} {
if rv == nil {
return []interface{}{}
Expand Down
Loading