[azurerm_database_vulnerability_assessment_rule_baseline] New resource for vulnerability scan baseline settings

azurerm/config.go

@@ -39,6 +39,7 @@ import (
 	securitySvc "github.com/Azure/azure-sdk-for-go/services/preview/security/mgmt/v1.0/security"
 	signalrSvc "github.com/Azure/azure-sdk-for-go/services/preview/signalr/mgmt/2018-03-01-preview/signalr"
 	"github.com/Azure/azure-sdk-for-go/services/preview/sql/mgmt/2015-05-01-preview/sql"
+	vulnerabilitySvc "github.com/Azure/azure-sdk-for-go/services/preview/sql/mgmt/2017-03-01-preview/sql"
 	MsSql "github.com/Azure/azure-sdk-for-go/services/preview/sql/mgmt/2017-10-01-preview/sql"
 	privateDnsSvc "github.com/Azure/azure-sdk-for-go/services/privatedns/mgmt/2018-09-01/privatedns"
 	iotdps "github.com/Azure/azure-sdk-for-go/services/provisioningservices/mgmt/2018-01-22/iothub"
@@ -201,11 +202,12 @@ type ArmClient struct {
 	sqlDatabaseThreatDetectionPoliciesClient sql.DatabaseThreatDetectionPoliciesClient
 	sqlElasticPoolsClient                    sql.ElasticPoolsClient
 	// Client for the new 2017-10-01-preview SQL API which implements vCore, DTU, and Azure data standards
-	msSqlElasticPoolsClient              MsSql.ElasticPoolsClient
-	sqlFirewallRulesClient               sql.FirewallRulesClient
-	sqlServersClient                     sql.ServersClient
-	sqlServerAzureADAdministratorsClient sql.ServerAzureADAdministratorsClient
-	sqlVirtualNetworkRulesClient         sql.VirtualNetworkRulesClient
+	msSqlElasticPoolsClient                            MsSql.ElasticPoolsClient
+	sqlFirewallRulesClient                             sql.FirewallRulesClient
+	sqlServersClient                                   sql.ServersClient
+	sqlServerAzureADAdministratorsClient               sql.ServerAzureADAdministratorsClient
+	sqlVirtualNetworkRulesClient                       sql.VirtualNetworkRulesClient
+	databaseVulnerabilityAssessmentRuleBaselinesClient vulnerabilitySvc.DatabaseVulnerabilityAssessmentRuleBaselinesClient
 
 	// Data Lake Store
 	dataLakeStoreAccountClient       storeAccount.AccountsClient
@@ -619,6 +621,10 @@ func (c *ArmClient) registerDatabases(endpoint, subscriptionId string, auth auto
 	sqlVNRClient := sql.NewVirtualNetworkRulesClientWithBaseURI(endpoint, subscriptionId)
 	c.configureClient(&sqlVNRClient.Client, auth)
 	c.sqlVirtualNetworkRulesClient = sqlVNRClient
+
+	databaseVulnerabilityAssessmentRuleBaselinesClient := vulnerabilitySvc.NewDatabaseVulnerabilityAssessmentRuleBaselinesClientWithBaseURI(endpoint, subscriptionId)
+	c.configureClient(&databaseVulnerabilityAssessmentRuleBaselinesClient.Client, auth)
+	c.databaseVulnerabilityAssessmentRuleBaselinesClient = databaseVulnerabilityAssessmentRuleBaselinesClient
 }
 
 func (c *ArmClient) registerDataLakeStoreClients(endpoint, subscriptionId string, auth autorest.Authorizer) {

azurerm/provider.go

@@ -259,6 +259,7 @@ func Provider() terraform.ResourceProvider {
 			"azurerm_data_lake_store_file":                               resourceArmDataLakeStoreFile(),
 			"azurerm_data_lake_store_firewall_rule":                      resourceArmDataLakeStoreFirewallRule(),
 			"azurerm_data_lake_store":                                    resourceArmDataLakeStore(),
+			"azurerm_database_vulnerability_assessment_rule_baseline":    resourceArmDatabaseVulnerabilityAssessmentRuleBaseline(),
 			"azurerm_databricks_workspace":                               resourceArmDatabricksWorkspace(),
 			"azurerm_ddos_protection_plan":                               resourceArmDDoSProtectionPlan(),
 			"azurerm_dev_test_lab":                                       resourceArmDevTestLab(),

azurerm/resource_arm_database_vulnerability_assessment_rule_baseline.go

@@ -0,0 +1,238 @@
+package azurerm
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Azure/azure-sdk-for-go/services/preview/sql/mgmt/2017-03-01-preview/sql"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/helper/validation"
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils"
+)
+
+func resourceArmDatabaseVulnerabilityAssessmentRuleBaseline() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceArmDatabaseVulnerabilityAssessmentRuleBaselineCreateUpdate,
+		Read:   resourceArmDatabaseVulnerabilityAssessmentRuleBaselineRead,
+		Update: resourceArmDatabaseVulnerabilityAssessmentRuleBaselineCreateUpdate,
+		Delete: resourceArmDatabaseVulnerabilityAssessmentRuleBaselineDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
+
+		Schema: map[string]*schema.Schema{
+			"resource_group_name": azure.SchemaResourceGroupName(),
+
+			"server_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: azure.ValidateMsSqlServerName,
+			},
+
+			"database_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: azure.ValidateMsSqlDatabaseName,
+			},
+
+			"rule_id": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+
+			"baseline_name": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: true,
+				Default:  string(sql.VulnerabilityAssessmentPolicyBaselineNameDefault),
+				ValidateFunc: validation.StringInSlice([]string{
+					string(sql.VulnerabilityAssessmentPolicyBaselineNameDefault),
+					string(sql.VulnerabilityAssessmentPolicyBaselineNameMaster),
+				}, true),
+			},
+
+			"baseline_result": {
+				Type:     schema.TypeSet,
+				Required: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"result": {
+							Type:     schema.TypeList,
+							Required: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func resourceArmDatabaseVulnerabilityAssessmentRuleBaselineCreateUpdate(d *schema.ResourceData, meta interface{}) error {
+	client := meta.(*ArmClient).databaseVulnerabilityAssessmentRuleBaselinesClient
+	ctx := meta.(*ArmClient).StopContext
+
+	log.Printf("[INFO] preparing arguments for Azure ARM Vulnerability Assessment Rule Baselines creation.")
+
+	resourceGroupName := d.Get("resource_group_name").(string)
+	serverName := d.Get("server_name").(string)
+	databaseName := d.Get("database_name").(string)
+	ruleId := d.Get("rule_id").(string)
+	baselineName := expandBaselineName(d.Get("baseline_name").(string))
+	parameters := expandBaselineResults(d.Get("baseline_result").(*schema.Set))
+
+	result, err := client.CreateOrUpdate(ctx, resourceGroupName, serverName, databaseName, ruleId, *baselineName, *parameters)
+
+	if err != nil {
+		return fmt.Errorf("error updataing database vulnerability assessment rule baseline: %s", err)
+	}
+
+	id, err := parseAzureResourceID(*result.ID)
+
+	if err != nil {
+		return err
+	}
+
+	// Currently REST API always returns "Default" as baseline that's why the Id is created manually here as a workaround
+	resourceId := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Sql/servers/%s/databases/%s/vulnerabilityAssessments/Default/rules/%s/baselines/%s",
+		id.SubscriptionID, id.ResourceGroup, id.Path["servers"], id.Path["databases"], id.Path["rules"], *baselineName)
+
+	d.SetId(resourceId)
+
+	return resourceArmDatabaseVulnerabilityAssessmentRuleBaselineRead(d, meta)
+}
+
+func resourceArmDatabaseVulnerabilityAssessmentRuleBaselineRead(d *schema.ResourceData, meta interface{}) error {
+	client := meta.(*ArmClient).databaseVulnerabilityAssessmentRuleBaselinesClient
+	ctx := meta.(*ArmClient).StopContext
+
+	log.Printf("[INFO] Reading Azure ARM Vulnerability Assessment Rule Baselines.")
+
+	id, err := parseAzureResourceID(d.Id())
+
+	if err != nil {
+		return err
+	}
+
+	resourceGroupName := id.ResourceGroup
+	serverName := id.Path["servers"]
+	databaseName := id.Path["databases"]
+	ruleId := id.Path["rules"]
+	baselineName := expandBaselineName(id.Path["baselines"])
+
+	result, err := client.Get(ctx, resourceGroupName, serverName, databaseName, ruleId, *baselineName)
+
+	if err != nil {
+		if utils.ResponseWasNotFound(result.Response) {
+			log.Printf("[WARN] Vulnerability Assessment Rule Baseline %s not found", id)
+			d.SetId("")
+			return nil
+		}
+
+		return fmt.Errorf("error making Read request to Vulnerability Assessment Rule Baselines: %+v", err)
+	}
+
+	d.Set("resource_group_name", resourceGroupName)
+	d.Set("server_name", serverName)
+	d.Set("database_name", databaseName)
+	d.Set("rule_id", ruleId)
+	d.Set("baseline_name", *baselineName)
+
+	if baselineResults := result.BaselineResults; baselineResults != nil {
+		d.Set("baseline_result", flattenBaselineResult(baselineResults))
+	}
+
+	return nil
+}
+
+func resourceArmDatabaseVulnerabilityAssessmentRuleBaselineDelete(d *schema.ResourceData, meta interface{}) error {
+	client := meta.(*ArmClient).databaseVulnerabilityAssessmentRuleBaselinesClient
+	ctx := meta.(*ArmClient).StopContext
+
+	log.Printf("[INFO] Deleting Azure ARM Vulnerability Assessment Rule Baselines.")
+
+	id, err := parseAzureResourceID(d.Id())
+
+	if err != nil {
+		return err
+	}
+
+	resourceGroupName := id.ResourceGroup
+	serverName := id.Path["servers"]
+	databaseName := id.Path["databases"]
+	ruleId := id.Path["rules"]
+	baselineName := expandBaselineName(id.Path["baselines"])
+
+	result, err := client.Delete(ctx, resourceGroupName, serverName, databaseName, ruleId, *baselineName)
+
+	if err != nil {
+		if utils.ResponseWasNotFound(result) {
+			log.Printf("[DEBUG] Vulnerability Assessment Rule Baseline %s not found", id)
+			return nil
+		}
+
+		return fmt.Errorf("error deleting Vulnerability Assessment Rule Baselines: %s", err)
+	}
+
+	return nil
+}
+
+func expandBaselineName(baselineName string) *sql.VulnerabilityAssessmentPolicyBaselineName {
+
+	resp := sql.VulnerabilityAssessmentPolicyBaselineName(baselineName)
+	return &resp
+}
+
+func expandBaselineResults(baselineResult *schema.Set) *sql.DatabaseVulnerabilityAssessmentRuleBaseline {
+
+	baselineResultList := baselineResult.List()
+
+	baselineResults := make([]sql.DatabaseVulnerabilityAssessmentRuleBaselineItem, len(baselineResultList))
+
+	for i, baselineResult := range baselineResultList {
+
+		result := make([]string, 0)
+		baselineResultMap := baselineResult.(map[string]interface{})
+
+		for _, s := range baselineResultMap["result"].([]interface{}) {
+			result = append(result, s.(string))
+		}
+
+		baselineResults[i] = sql.DatabaseVulnerabilityAssessmentRuleBaselineItem{
+			Result: &result,
+		}
+	}
+
+	return &sql.DatabaseVulnerabilityAssessmentRuleBaseline{
+		DatabaseVulnerabilityAssessmentRuleBaselineProperties: &sql.DatabaseVulnerabilityAssessmentRuleBaselineProperties{
+			BaselineResults: &baselineResults,
+		},
+	}
+}
+
+func flattenBaselineResult(baselineResults *[]sql.DatabaseVulnerabilityAssessmentRuleBaselineItem) []map[string]interface{} {
+
+	resp := make([]map[string]interface{}, 0)
+
+	if baselineResults != nil {
+		for _, baselineResult := range *baselineResults {
+
+			output := map[string]interface{}{}
+
+			if result := baselineResult.Result; result != nil {
+
+				output["result"] = *result
+			}
+
+			resp = append(resp, output)
+		}
+	}
+
+	return resp
+}