Terraform resource query matching an argument and a block

[scottford-io]

I need help creating a query for the following Terraform resource.

resource "google_compute_firewall" "default" {
  name    = "fw-rule-deny-default"
  network = google_compute_network.default.name

  source_ranges = ["0.0.0.0/0"]

  allow {
    protocol = "tcp"
    ports    = ["22", "3389"]
  }
}

The query should fail if any element in the array contains 0.0.0.0/0 and there is an allow block.

I tried writing the query like this, but I don't think this is quite right:

terraform.resources
  .where( nameLabel == "google_compute_firewall" )
  .all( arguments['source_ranges'].where( _ == '0.0.0.0/0' ) && blocks { type != 'allow' })

[arlimus]

Awesome question, let's pick it apart:

First, you have the part where you are looking for the firewall statement, which you already wrote down:

terraform.resources
  .where( nameLabel == "google_compute_firewall" )

Next comes another filter, because you only care about elements that have the source_ranges set:

terraform.resources
  .where( nameLabel == "google_compute_firewall" )
  .where( arguments['source_ranges'].contains("0.0.0.0/0") )

(you could even check for specific subranges and more ;) )

Finally, we want to say that none of these resources have allow-blocks configured

terraform.resources
  .where( nameLabel == "google_compute_firewall" )
  .where( arguments['source_ranges'].contains("0.0.0.0/0") )
  .none( blocks.contains( type == "allow" ))

This will return any resource that is a compute firewall whose source ranges contain 0.0.0.0/0 and that has an allow block.

[scottford-io]

Thanks @arlimus! that solution worked for me!