azurerm_firewall_policy_rule_collection_group - support description,destination_addresses,destination_urls,terminate_tls,web_categories

internal/services/firewall/firewall_policy_rule_collection_group_resource.go

@@ -8,14 +8,14 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2021-02-01/network"
 	"github.com/hashicorp/go-azure-helpers/response"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-azurerm/helpers/tf"
 	azValidate "github.com/hashicorp/terraform-provider-azurerm/helpers/validate"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/locks"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/firewall/parse"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/firewall/validate"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
-	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/validation"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/timeouts"
 	"github.com/hashicorp/terraform-provider-azurerm/utils"
 )
@@ -95,6 +95,11 @@ func resourceFirewallPolicyRuleCollectionGroup() *pluginsdk.Resource {
 										Required:     true,
 										ValidateFunc: validate.FirewallPolicyRuleName(),
 									},
+									"description": {
+										Type:         pluginsdk.TypeString,
+										Required:     true,
+										ValidateFunc: validate.FirewallPolicyRuleName(),
+									},
 									"protocols": {
 										Type:     pluginsdk.TypeSet,
 										Required: true,
@@ -136,6 +141,18 @@ func resourceFirewallPolicyRuleCollectionGroup() *pluginsdk.Resource {
 											ValidateFunc: validation.StringIsNotEmpty,
 										},
 									},
+									"destination_addresses": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type: pluginsdk.TypeString,
+											ValidateFunc: validation.Any(
+												validation.IsIPAddress,
+												validation.IsCIDR,
+												validation.StringInSlice([]string{`*`}, false),
+											),
+										},
+									},
 									"destination_fqdns": {
 										Type:     pluginsdk.TypeSet,
 										Optional: true,
@@ -144,6 +161,14 @@ func resourceFirewallPolicyRuleCollectionGroup() *pluginsdk.Resource {
 											ValidateFunc: validation.StringIsNotEmpty,
 										},
 									},
+									"destination_urls": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.StringIsNotEmpty,
+										},
+									},
 									"destination_fqdn_tags": {
 										Type:     pluginsdk.TypeSet,
 										Optional: true,
@@ -152,6 +177,18 @@ func resourceFirewallPolicyRuleCollectionGroup() *pluginsdk.Resource {
 											ValidateFunc: validation.StringIsNotEmpty,
 										},
 									},
+									"terminate_tls": {
+										Type:     pluginsdk.TypeBool,
+										Optional: true,
+									},
+									"web_categories": {
+										Type:     pluginsdk.TypeSet,
+										Optional: true,
+										Elem: &pluginsdk.Schema{
+											Type:         pluginsdk.TypeString,
+											ValidateFunc: validation.StringIsNotEmpty,
+										},
+									},
 								},
 							},
 						},
@@ -564,13 +601,18 @@ func expandFirewallPolicyRuleApplication(input []interface{}) *[]network.BasicFi
 			})
 		}
 		output := &network.ApplicationRule{
-			Name:            utils.String(condition["name"].(string)),
-			RuleType:        network.RuleTypeApplicationRule,
-			Protocols:       &protocols,
-			SourceAddresses: utils.ExpandStringSlice(condition["source_addresses"].(*pluginsdk.Set).List()),
-			SourceIPGroups:  utils.ExpandStringSlice(condition["source_ip_groups"].(*pluginsdk.Set).List()),
-			TargetFqdns:     utils.ExpandStringSlice(condition["destination_fqdns"].(*pluginsdk.Set).List()),
-			FqdnTags:        utils.ExpandStringSlice(condition["destination_fqdn_tags"].(*pluginsdk.Set).List()),
+			Name:                 utils.String(condition["name"].(string)),
+			Description:          utils.String(condition["description"].(string)),
+			RuleType:             network.RuleTypeApplicationRule,
+			Protocols:            &protocols,
+			SourceAddresses:      utils.ExpandStringSlice(condition["source_addresses"].(*pluginsdk.Set).List()),
+			SourceIPGroups:       utils.ExpandStringSlice(condition["source_ip_groups"].(*pluginsdk.Set).List()),
+			DestinationAddresses: utils.ExpandStringSlice(condition["destination_addresses"].(*pluginsdk.Set).List()),
+			TargetFqdns:          utils.ExpandStringSlice(condition["destination_fqdns"].(*pluginsdk.Set).List()),
+			TargetUrls:           utils.ExpandStringSlice(condition["destination_urls"].(*pluginsdk.Set).List()),
+			FqdnTags:             utils.ExpandStringSlice(condition["destination_fqdn_tags"].(*pluginsdk.Set).List()),
+			TerminateTLS:         utils.Bool(condition["terminate_tls"].(bool)),
+			WebCategories:        utils.ExpandStringSlice(condition["web_categories"].(*pluginsdk.Set).List()),
 		}
 		result = append(result, output)
 	}
@@ -739,6 +781,16 @@ func flattenFirewallPolicyRuleApplication(input *[]network.BasicFirewallPolicyRu
 			name = *rule.Name
 		}
 
+		var description string
+		if rule.Description != nil {
+			description = *rule.Description
+		}
+
+		var terminate_tls bool
+		if rule.TerminateTLS != nil {
+			terminate_tls = *rule.TerminateTLS
+		}
+
 		protocols := make([]interface{}, 0)
 		if rule.Protocols != nil {
 			for _, protocol := range *rule.Protocols {
@@ -755,11 +807,16 @@ func flattenFirewallPolicyRuleApplication(input *[]network.BasicFirewallPolicyRu
 
 		output = append(output, map[string]interface{}{
 			"name":                  name,
+			"description":           description,
 			"protocols":             protocols,
 			"source_addresses":      utils.FlattenStringSlice(rule.SourceAddresses),
 			"source_ip_groups":      utils.FlattenStringSlice(rule.SourceIPGroups),
+			"destination_addresses": utils.FlattenStringSlice(rule.DestinationAddresses),
+			"destination_urls":      utils.FlattenStringSlice(rule.TargetUrls),
 			"destination_fqdns":     utils.FlattenStringSlice(rule.TargetFqdns),
 			"destination_fqdn_tags": utils.FlattenStringSlice(rule.FqdnTags),
+			"terminate_tls":         terminate_tls,
+			"web_categories":        utils.FlattenStringSlice(rule.WebCategories),
 		})
 	}
 

internal/services/firewall/firewall_policy_rule_collection_group_resource_test.go

@@ -173,7 +173,8 @@ resource "azurerm_firewall_policy_rule_collection_group" "test" {
     priority = 500
     action   = "Deny"
     rule {
-      name = "app_rule_collection1_rule1"
+      name        = "app_rule_collection1_rule1"
+      description = "app_rule_collection1_rule1"
       protocols {
         type = "Http"
         port = 80
@@ -182,11 +183,16 @@ resource "azurerm_firewall_policy_rule_collection_group" "test" {
         type = "Https"
         port = 443
       }
-      source_addresses  = ["10.0.0.1"]
-      destination_fqdns = ["pluginsdk.io"]
+      source_addresses      = ["10.0.0.1"]
+      destination_addresses = ["10.0.0.1"]
+      destination_urls      = ["www.google.com/en"]
+      destination_fqdns     = ["pluginsdk.io"]
+      terminate_tls         = true
+      web_categories        = ["Liability"]
     }
     rule {
-      name = "app_rule_collection1_rule2"
+      name        = "app_rule_collection1_rule2"
+      description = "app_rule_collection1_rule2"
       protocols {
         type = "Http"
         port = 80
@@ -195,11 +201,16 @@ resource "azurerm_firewall_policy_rule_collection_group" "test" {
         type = "Https"
         port = 443
       }
-      source_ip_groups  = [azurerm_ip_group.test_source.id]
-      destination_fqdns = ["pluginsdk.io"]
+      source_ip_groups      = [azurerm_ip_group.test_source.id]
+      destination_addresses = ["10.0.0.1"]
+      destination_urls      = ["www.google.com/en"]
+      destination_fqdns     = ["pluginsdk.io"]
+      terminate_tls         = true
+      web_categories        = ["Liability"]
     }
     rule {
-      name = "app_rule_collection1_rule3"
+      name        = "app_rule_collection1_rule3"
+      description = "app_rule_collection1_rule3"
       protocols {
         type = "Http"
         port = 80
@@ -209,7 +220,11 @@ resource "azurerm_firewall_policy_rule_collection_group" "test" {
         port = 443
       }
       source_addresses      = ["10.0.0.1"]
+      destination_addresses = ["10.0.0.1"]
+      destination_urls      = ["www.google.com/en"]
       destination_fqdn_tags = ["WindowsDiagnostics"]
+      terminate_tls         = true
+      web_categories        = ["Liability"]
     }
   }
 

website/docs/r/firewall_policy_rule_collection_group.html.markdown

@@ -137,16 +137,27 @@ A `rule` (application rule) block supports the following:
 
 * `name` - (Required) The name which should be used for this rule.
 
+* `description` - (Optional) The description which should be used for this rule.
+
 * `protocols` - (Required) One or more `protocols` blocks as defined below.
 
 * `source_addresses` - (Optional) Specifies a list of source IP addresses (including CIDR and `*`).
 
 * `source_ip_groups` - (Optional) Specifies a list of source IP groups.
 
+* `destination_addresses` - (Optional) Specifies a list of destination IP addresses (including CIDR and `*`).
+
+* `destination_urls` - (Optional) Specifies a list of destination URLs for which policy should hold.
+
 * `destination_fqdns` - (Optional) Specifies a list of destination FQDNs.
 
 * `destination_fqdn_tags` - (Optional) Specifies a list of destination FQDN tags.
 
+* `terminate_tls` - (Optional) Boolean specifying if TLS shall be terminated (true) or not (false).
+
+* `web_categories` - (Optional) Specifies a list of web categories to which access is denied or allowed depending on the value of `action` above.
+
+
 ---
 
 A `rule` (network rule) block supports the following: