Fix/make azurerm_firewall_policy premium tier features available

azurerm/internal/services/firewall/firewall_policy_data_source.go

@@ -130,7 +130,7 @@ func FirewallDataSourcePolicyRead(d *pluginsdk.ResourceData, meta interface{}) e
 	resp, err := client.Get(ctx, resourceGroup, name, "")
 	if err != nil {
 		if utils.ResponseWasNotFound(resp.Response) {
-			return fmt.Errorf("Firewall Policy %q (Resource Group %q) was not found", name, resourceGroup)
+			return fmt.Errorf("firewall Policy %q (Resource Group %q) was not found", name, resourceGroup)
 		}
 
 		return fmt.Errorf("retrieving Firewall Policy %q (Resource Group %q): %+v", name, resourceGroup, err)

azurerm/internal/services/firewall/firewall_policy_resource.go

@@ -142,6 +142,131 @@ func resourceFirewallPolicy() *pluginsdk.Resource {
 				},
 			},
 
+			"intrusion_detection": {
+				Type:     pluginsdk.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &pluginsdk.Resource{
+					Schema: map[string]*pluginsdk.Schema{
+						"mode": {
+							Type: pluginsdk.TypeString,
+							ValidateFunc: validation.StringInSlice([]string{
+								string(network.FirewallPolicyIntrusionDetectionStateTypeOff),
+								string(network.FirewallPolicyIntrusionDetectionStateTypeAlert),
+								string(network.FirewallPolicyIntrusionDetectionStateTypeDeny),
+							}, false),
+							Optional: true,
+						},
+						"signature_overrides": {
+							Type:     pluginsdk.TypeList,
+							Optional: true,
+							Elem: &pluginsdk.Resource{
+								Schema: map[string]*pluginsdk.Schema{
+									"state": {
+										Type: pluginsdk.TypeString,
+										ValidateFunc: validation.StringInSlice([]string{
+											string(network.FirewallPolicyIntrusionDetectionStateTypeOff),
+											string(network.FirewallPolicyIntrusionDetectionStateTypeAlert),
+											string(network.FirewallPolicyIntrusionDetectionStateTypeDeny),
+										}, false),
+										Optional: true,
+									},
+									"id": {
+										Type:     pluginsdk.TypeString,
+										Optional: true,
+									},
+								},
+							},
+						},
+						"traffic_bypass": {
+							Type:     pluginsdk.TypeList,
+							Optional: true,
+							Elem: &pluginsdk.Resource{
+								Schema: map[string]*pluginsdk.Schema{
+									"name": {
+										Type:     pluginsdk.TypeString,
+										Required: true,
+									},
+									"description": {
+										Type:     pluginsdk.TypeString,
+										Optional: true,
+									},
+									"protocol": {
+										Type:     pluginsdk.TypeString,
+										Required: true,
+										ValidateFunc: validation.StringInSlice([]string{
+											string(network.FirewallPolicyIntrusionDetectionProtocolICMP),
+											string(network.FirewallPolicyIntrusionDetectionProtocolANY),
+											string(network.FirewallPolicyIntrusionDetectionProtocolTCP),
+											string(network.FirewallPolicyIntrusionDetectionProtocolUDP),
+										}, false),
+									},
+									"source_addresses": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.IsIPv4Address,
+										},
+									},
+									"destination_addresses": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.IsIPv4Address,
+										},
+									},
+									"destination_ports": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.IsIPv4Address,
+										},
+									},
+									"source_ip_groups": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.IsIPv4Address,
+										},
+									},
+									"destination_ip_groups": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.IsIPv4Address,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
+			"tls_certificate": {
+				Type:     pluginsdk.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				MinItems: 1,
+				Elem: &pluginsdk.Resource{
+					Schema: map[string]*pluginsdk.Schema{
+						"key_vault_secret_id": {
+							Type:     pluginsdk.TypeString,
+							Required: true,
+						},
+						"name": {
+							Type:     pluginsdk.TypeString,
+							Required: true,
+						},
+					},
+				},
+			},
+
 			"child_policies": {
 				Type:     pluginsdk.TypeList,
 				Computed: true,
@@ -197,6 +322,8 @@ func resourceFirewallPolicyCreateUpdate(d *pluginsdk.ResourceData, meta interfac
 			ThreatIntelMode:      network.AzureFirewallThreatIntelMode(d.Get("threat_intelligence_mode").(string)),
 			ThreatIntelWhitelist: expandFirewallPolicyThreatIntelWhitelist(d.Get("threat_intelligence_allowlist").([]interface{})),
 			DNSSettings:          expandFirewallPolicyDNSSetting(d.Get("dns").([]interface{})),
+			IntrusionDetection:   expandFirewallPolicyIntrusionDetection(d.Get("intrusion_detection").([]interface{})),
+			TransportSecurity:    expandFirewallPolicyTransportSecurity(d.Get("tls_certificate").([]interface{})),
 		},
 		Location: utils.String(location.Normalize(d.Get("location").(string))),
 		Tags:     tags.Expand(d.Get("tags").(map[string]interface{})),
@@ -276,6 +403,14 @@ func resourceFirewallPolicyRead(d *pluginsdk.ResourceData, meta interface{}) err
 			return fmt.Errorf(`setting "dns": %+v`, err)
 		}
 
+		if err := d.Set("intrusion_detection", flattenFirewallPolicyIntrusionDetection(resp.IntrusionDetection)); err != nil {
+			return fmt.Errorf(`setting "intrusion_detection": %+v`, err)
+		}
+
+		if err := d.Set("transport_security", flattenFirewallPolicyTransportSecurity(prop.TransportSecurity)); err != nil {
+			return fmt.Errorf(`setting "transport_security": %+v`, err)
+		}
+
 		if err := d.Set("child_policies", flattenNetworkSubResourceID(prop.ChildPolicies)); err != nil {
 			return fmt.Errorf(`setting "child_policies": %+v`, err)
 		}
@@ -346,6 +481,58 @@ func expandFirewallPolicyDNSSetting(input []interface{}) *network.DNSSettings {
 	return output
 }
 
+func expandFirewallPolicyIntrusionDetection(input []interface{}) *network.FirewallPolicyIntrusionDetection {
+
+	if len(input) == 0 || input[0] == nil {
+		return nil
+	}
+
+	raw := input[0].(map[string]interface{})
+
+	signature_overrides := []network.FirewallPolicyIntrusionDetectionSignatureSpecification{}
+	for i, v := range signature_overrides {
+		signature_overrides[i].ID = v.ID
+		signature_overrides[i].Mode = v.Mode
+	}
+
+	traffic_bypass := []network.FirewallPolicyIntrusionDetectionBypassTrafficSpecifications{}
+
+	for i, v := range traffic_bypass {
+		traffic_bypass[i].Name = v.Name
+		traffic_bypass[i].Description = v.Description
+		traffic_bypass[i].Protocol = v.Protocol
+		traffic_bypass[i].SourceAddresses = v.SourceAddresses
+		traffic_bypass[i].DestinationAddresses = v.DestinationAddresses
+		traffic_bypass[i].DestinationPorts = v.DestinationPorts
+		traffic_bypass[i].SourceIPGroups = v.SourceIPGroups
+		traffic_bypass[i].DestinationIPGroups = v.DestinationIPGroups
+	}
+
+	return &network.FirewallPolicyIntrusionDetection{
+		Mode: network.FirewallPolicyIntrusionDetectionStateType(raw["mode"].(string)),
+		Configuration: &network.FirewallPolicyIntrusionDetectionConfiguration{
+			SignatureOverrides:    &signature_overrides,
+			BypassTrafficSettings: &traffic_bypass,
+		},
+	}
+
+}
+
+func expandFirewallPolicyTransportSecurity(input []interface{}) *network.FirewallPolicyTransportSecurity {
+	if len(input) == 0 || input[0] == nil {
+		return nil
+	}
+
+	raw := input[0].(map[string]interface{})
+
+	return &network.FirewallPolicyTransportSecurity{
+		CertificateAuthority: &network.FirewallPolicyCertificateAuthority{
+			KeyVaultSecretID: utils.String(raw["key_vault_secret_id"].(string)),
+			Name:             utils.String(raw["name"].(string)),
+		},
+	}
+}
+
 func flattenFirewallPolicyThreatIntelWhitelist(input *network.FirewallPolicyThreatIntelWhitelist) []interface{} {
 	if input == nil {
 		return []interface{}{}
@@ -378,3 +565,31 @@ func flattenFirewallPolicyDNSSetting(input *network.DNSSettings) []interface{} {
 		},
 	}
 }
+
+func flattenFirewallPolicyIntrusionDetection(input *network.FirewallPolicyIntrusionDetection) []interface{} {
+
+	if input == nil {
+		return []interface{}{}
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"mode":                input.Mode,
+			"signature_overrides": input.Configuration.SignatureOverrides,
+			"traffic_bypass":      input.Configuration.BypassTrafficSettings,
+		},
+	}
+}
+
+func flattenFirewallPolicyTransportSecurity(input *network.FirewallPolicyTransportSecurity) []interface{} {
+	if input == nil {
+		return []interface{}{}
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"key_vault_secret_id": input.CertificateAuthority.KeyVaultSecretID,
+			"name":                input.CertificateAuthority.Name,
+		},
+	}
+}