Skip to content

Commit 377bbab

Browse files
ewbankkitewbankkit
authored
Merge pull request #43137 from acwwat/f-aws_networkfirewall_firewall_policy-add_active_threat_defense_support
feat: Add active threat defense support to aws_networkfirewall_firewall_policy
2 parents 1a5ea82 + b91512c commit 377bbab

File tree

6 files changed

+313
-2
lines changed

6 files changed

+313
-2
lines changed

‎.changelog/43137.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
```release-note:enhancement
2+
resource/aws_networkfirewall_firewall_policy: Add `firewall_policy.stateful_rule_group_reference.deep_threat_inspection` argument
3+
```
4+
5+
```release-note:enhancement
6+
data-source/aws_networkfirewall_firewall_policy: Add `firewall_policy.stateful_rule_group_reference.deep_threat_inspection` attribute
7+
```

‎internal/service/networkfirewall/firewall_policy.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package networkfirewall
66
import (
77
"context"
88
"log"
9+
"strconv"
910
"time"
1011

1112
"github.com/YakDriver/regexache"
@@ -22,6 +23,7 @@ import (
2223
"github.com/hashicorp/terraform-provider-aws/internal/errs"
2324
"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
2425
"github.com/hashicorp/terraform-provider-aws/internal/flex"
26+
"github.com/hashicorp/terraform-provider-aws/internal/sdkv2/types/nullable"
2527
tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
2628
"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
2729
"github.com/hashicorp/terraform-provider-aws/internal/verify"
@@ -142,6 +144,12 @@ func resourceFirewallPolicy() *schema.Resource {
142144
Optional: true,
143145
Elem: &schema.Resource{
144146
Schema: map[string]*schema.Schema{
147+
"deep_threat_inspection": {
148+
Type: nullable.TypeNullableBool,
149+
Optional: true,
150+
Computed: true,
151+
ValidateFunc: nullable.ValidateTypeStringNullableBool,
152+
},
145153
"override": {
146154
Type: schema.TypeList,
147155
MaxItems: 1,
@@ -493,6 +501,11 @@ func expandStatefulRuleGroupReferences(tfList []any) []awstypes.StatefulRuleGrou
493501

494502
apiObject := awstypes.StatefulRuleGroupReference{}
495503

504+
if v, ok := tfMap["deep_threat_inspection"]; ok {
505+
if v, null, _ := nullable.Bool(v.(string)).ValueBool(); !null {
506+
apiObject.DeepThreatInspection = aws.Bool(v)
507+
}
508+
}
496509
if v, ok := tfMap["override"].([]any); ok && len(v) > 0 {
497510
apiObject.Override = expandStatefulRuleGroupOverride(v)
498511
}
@@ -678,6 +691,9 @@ func flattenPolicyStatefulRuleGroupReferences(apiObjects []awstypes.StatefulRule
678691
names.AttrResourceARN: aws.ToString(apiObject.ResourceArn),
679692
}
680693

694+
if apiObject.DeepThreatInspection != nil {
695+
tfMap["deep_threat_inspection"] = strconv.FormatBool(aws.ToBool(apiObject.DeepThreatInspection))
696+
}
681697
if apiObject.Override != nil {
682698
tfMap["override"] = flattenStatefulRuleGroupOverride(apiObject.Override)
683699
}

‎internal/service/networkfirewall/firewall_policy_data_source.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/hashicorp/terraform-provider-aws/internal/conns"
1616
"github.com/hashicorp/terraform-provider-aws/internal/errs/sdkdiag"
1717
"github.com/hashicorp/terraform-provider-aws/internal/sdkv2"
18+
"github.com/hashicorp/terraform-provider-aws/internal/sdkv2/types/nullable"
1819
tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
1920
"github.com/hashicorp/terraform-provider-aws/internal/verify"
2021
"github.com/hashicorp/terraform-provider-aws/names"
@@ -102,6 +103,10 @@ func dataSourceFirewallPolicy() *schema.Resource {
102103
Computed: true,
103104
Elem: &schema.Resource{
104105
Schema: map[string]*schema.Schema{
106+
"deep_threat_inspection": {
107+
Type: nullable.TypeNullableBool,
108+
Computed: true,
109+
},
105110
"override": {
106111
Type: schema.TypeList,
107112
Optional: true,

‎internal/service/networkfirewall/firewall_policy_data_source_test.go

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ func TestAccNetworkFirewallFirewallPolicyDataSource_withOverriddenManagedRuleGro
125125
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateless_default_actions.0", resourceName, "firewall_policy.0.stateless_default_actions.0"),
126126
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.#", resourceName, "firewall_policy.0.stateful_rule_group_reference.#"),
127127
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.0", resourceName, "firewall_policy.0.stateful_rule_group_reference.0"),
128+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection"),
128129
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.override.action", resourceName, "firewall_policy.0.stateful_rule_group_reference.override.action"),
129130
resource.TestCheckResourceAttrPair(datasourceName, names.AttrName, resourceName, names.AttrName),
130131
resource.TestCheckResourceAttrPair(datasourceName, acctest.CtTagsPercent, resourceName, acctest.CtTagsPercent),
@@ -162,6 +163,35 @@ func TestAccNetworkFirewallFirewallPolicyDataSource_withPolicyVariables(t *testi
162163
})
163164
}
164165

166+
func TestAccNetworkFirewallFirewallPolicyDataSource_activeThreatDefense(t *testing.T) {
167+
ctx := acctest.Context(t)
168+
rName := sdkacctest.RandomWithPrefix("resource-test-terraform")
169+
resourceName := "aws_networkfirewall_firewall_policy.test"
170+
datasourceName := "data.aws_networkfirewall_firewall_policy.test"
171+
172+
resource.ParallelTest(t, resource.TestCase{
173+
PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
174+
ErrorCheck: acctest.ErrorCheck(t, names.NetworkFirewallServiceID),
175+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
176+
Steps: []resource.TestStep{
177+
{
178+
Config: testAccFirewallPolicyDataSourceConfig_activeThreatDefense(rName),
179+
Check: resource.ComposeAggregateTestCheckFunc(
180+
resource.TestCheckResourceAttrPair(datasourceName, names.AttrARN, resourceName, names.AttrARN), resource.TestCheckResourceAttrPair(datasourceName, names.AttrDescription, resourceName, names.AttrDescription),
181+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.#", resourceName, "firewall_policy.#"),
182+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateless_fragment_default_actions.#", resourceName, "firewall_policy.0.stateless_fragment_default_actions.#"),
183+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateless_fragment_default_actions.0", resourceName, "firewall_policy.0.stateless_fragment_default_actions.0"),
184+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.#", resourceName, "firewall_policy.0.stateful_rule_group_reference.#"),
185+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.0", resourceName, "firewall_policy.0.stateful_rule_group_reference.0"),
186+
resource.TestCheckResourceAttrPair(datasourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection"),
187+
resource.TestCheckResourceAttrPair(datasourceName, names.AttrName, resourceName, names.AttrName),
188+
resource.TestCheckResourceAttrPair(datasourceName, acctest.CtTagsPercent, resourceName, acctest.CtTagsPercent),
189+
),
190+
},
191+
},
192+
})
193+
}
194+
165195
func testAccFirewallPolicyDataSourceConfig_basic(rName string) string {
166196
return fmt.Sprintf(`
167197
resource "aws_networkfirewall_firewall_policy" "test" {
@@ -252,3 +282,27 @@ data "aws_networkfirewall_firewall_policy" "test" {
252282
arn = aws_networkfirewall_firewall_policy.test.arn
253283
}`, rName)
254284
}
285+
286+
func testAccFirewallPolicyDataSourceConfig_activeThreatDefense(rName string) string {
287+
return fmt.Sprintf(`
288+
data "aws_region" "current" {}
289+
data "aws_partition" "current" {}
290+
291+
resource "aws_networkfirewall_firewall_policy" "test" {
292+
name = %[1]q
293+
294+
firewall_policy {
295+
stateless_fragment_default_actions = ["aws:drop"]
296+
stateless_default_actions = ["aws:pass"]
297+
298+
stateful_rule_group_reference {
299+
deep_threat_inspection = true
300+
resource_arn = "arn:${data.aws_partition.current.partition}:network-firewall:${data.aws_region.current.region}:aws-managed:stateful-rulegroup/AttackInfrastructureActionOrder"
301+
}
302+
}
303+
}
304+
305+
data "aws_networkfirewall_firewall_policy" "test" {
306+
arn = aws_networkfirewall_firewall_policy.test.arn
307+
}`, rName)
308+
}

‎internal/service/networkfirewall/firewall_policy_test.go

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -406,6 +406,7 @@ func TestAccNetworkFirewallFirewallPolicy_statefulRuleGroupReference(t *testing.
406406
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_default_actions.#", "0"),
407407
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_engine_options.#", "0"),
408408
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
409+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", ""),
409410
resource.TestCheckTypeSetElemAttrPair(resourceName, "firewall_policy.0.stateful_rule_group_reference.*.resource_arn", ruleGroupResourceName, names.AttrARN),
410411
),
411412
},
@@ -1093,6 +1094,113 @@ func TestAccNetworkFirewallFirewallPolicy_disappears(t *testing.T) {
10931094
})
10941095
}
10951096

1097+
func TestAccNetworkFirewallFirewallPolicy_activeThreatDefense_actionOrder(t *testing.T) {
1098+
ctx := acctest.Context(t)
1099+
var firewallPolicy networkfirewall.DescribeFirewallPolicyOutput
1100+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
1101+
resourceName := "aws_networkfirewall_firewall_policy.test"
1102+
1103+
resource.ParallelTest(t, resource.TestCase{
1104+
PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
1105+
ErrorCheck: acctest.ErrorCheck(t, names.NetworkFirewallServiceID),
1106+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
1107+
CheckDestroy: testAccCheckFirewallPolicyDestroy(ctx),
1108+
Steps: []resource.TestStep{
1109+
{
1110+
Config: testAccFirewallPolicyConfig_activeThreatDefense_actionOrder_default(rName),
1111+
Check: resource.ComposeTestCheckFunc(
1112+
testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
1113+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
1114+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
1115+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", ""),
1116+
),
1117+
},
1118+
{
1119+
ResourceName: resourceName,
1120+
ImportState: true,
1121+
ImportStateVerify: true,
1122+
ImportStateVerifyIgnore: []string{"firewall_policy.0.stateful_rule_group_reference.0.priority"},
1123+
},
1124+
{
1125+
Config: testAccFirewallPolicyConfig_activeThreatDefense_actionOrder(rName, false),
1126+
Check: resource.ComposeTestCheckFunc(
1127+
testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
1128+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
1129+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
1130+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", acctest.CtFalse),
1131+
),
1132+
},
1133+
{
1134+
ResourceName: resourceName,
1135+
ImportState: true,
1136+
ImportStateVerify: true,
1137+
ImportStateVerifyIgnore: []string{"firewall_policy.0.stateful_rule_group_reference.0.priority"},
1138+
},
1139+
{
1140+
Config: testAccFirewallPolicyConfig_activeThreatDefense_actionOrder(rName, true),
1141+
Check: resource.ComposeTestCheckFunc(
1142+
testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
1143+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
1144+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
1145+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", acctest.CtTrue),
1146+
),
1147+
},
1148+
{
1149+
ResourceName: resourceName,
1150+
ImportState: true,
1151+
ImportStateVerify: true,
1152+
ImportStateVerifyIgnore: []string{"firewall_policy.0.stateful_rule_group_reference.0.priority"},
1153+
},
1154+
},
1155+
})
1156+
}
1157+
1158+
func TestAccNetworkFirewallFirewallPolicy_activeThreatDefense_strictOrder(t *testing.T) {
1159+
ctx := acctest.Context(t)
1160+
var firewallPolicy networkfirewall.DescribeFirewallPolicyOutput
1161+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
1162+
resourceName := "aws_networkfirewall_firewall_policy.test"
1163+
1164+
resource.ParallelTest(t, resource.TestCase{
1165+
PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
1166+
ErrorCheck: acctest.ErrorCheck(t, names.NetworkFirewallServiceID),
1167+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
1168+
CheckDestroy: testAccCheckFirewallPolicyDestroy(ctx),
1169+
Steps: []resource.TestStep{
1170+
{
1171+
Config: testAccFirewallPolicyConfig_activeThreatDefense_strictOrder(rName, false),
1172+
Check: resource.ComposeTestCheckFunc(
1173+
testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
1174+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
1175+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
1176+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", acctest.CtFalse),
1177+
),
1178+
},
1179+
{
1180+
ResourceName: resourceName,
1181+
ImportState: true,
1182+
ImportStateVerify: true,
1183+
ImportStateVerifyIgnore: []string{"firewall_policy.0.stateful_rule_group_reference.0.priority"},
1184+
},
1185+
{
1186+
Config: testAccFirewallPolicyConfig_activeThreatDefense_strictOrder(rName, true),
1187+
Check: resource.ComposeTestCheckFunc(
1188+
testAccCheckFirewallPolicyExists(ctx, resourceName, &firewallPolicy),
1189+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.#", "1"),
1190+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.#", "1"),
1191+
resource.TestCheckResourceAttr(resourceName, "firewall_policy.0.stateful_rule_group_reference.0.deep_threat_inspection", acctest.CtTrue),
1192+
),
1193+
},
1194+
{
1195+
ResourceName: resourceName,
1196+
ImportState: true,
1197+
ImportStateVerify: true,
1198+
ImportStateVerifyIgnore: []string{"firewall_policy.0.stateful_rule_group_reference.0.priority"},
1199+
},
1200+
},
1201+
})
1202+
}
1203+
10961204
func testAccCheckFirewallPolicyDestroy(ctx context.Context) resource.TestCheckFunc {
10971205
return func(s *terraform.State) error {
10981206
for _, rs := range s.RootModule().Resources {
@@ -1816,3 +1924,70 @@ resource "aws_networkfirewall_firewall_policy" "test" {
18161924
}
18171925
`, rName)
18181926
}
1927+
1928+
func testAccFirewallPolicyConfig_activeThreatDefense_actionOrder_default(rName string) string {
1929+
return acctest.ConfigCompose(testAccFirewallPolicyConfig_baseStatelessRuleGroup(rName, 1), fmt.Sprintf(`
1930+
data "aws_region" "current" {}
1931+
data "aws_partition" "current" {}
1932+
1933+
resource "aws_networkfirewall_firewall_policy" "test" {
1934+
name = %[1]q
1935+
1936+
firewall_policy {
1937+
stateless_fragment_default_actions = ["aws:drop"]
1938+
stateless_default_actions = ["aws:pass"]
1939+
1940+
stateful_rule_group_reference {
1941+
resource_arn = "arn:${data.aws_partition.current.partition}:network-firewall:${data.aws_region.current.region}:aws-managed:stateful-rulegroup/AttackInfrastructureActionOrder"
1942+
}
1943+
}
1944+
}
1945+
`, rName))
1946+
}
1947+
1948+
func testAccFirewallPolicyConfig_activeThreatDefense_actionOrder(rName string, deepThreatInspection bool) string {
1949+
return acctest.ConfigCompose(testAccFirewallPolicyConfig_baseStatelessRuleGroup(rName, 1), fmt.Sprintf(`
1950+
data "aws_region" "current" {}
1951+
data "aws_partition" "current" {}
1952+
1953+
resource "aws_networkfirewall_firewall_policy" "test" {
1954+
name = %[1]q
1955+
1956+
firewall_policy {
1957+
stateless_fragment_default_actions = ["aws:drop"]
1958+
stateless_default_actions = ["aws:pass"]
1959+
1960+
stateful_rule_group_reference {
1961+
deep_threat_inspection = %[2]t
1962+
resource_arn = "arn:${data.aws_partition.current.partition}:network-firewall:${data.aws_region.current.region}:aws-managed:stateful-rulegroup/AttackInfrastructureActionOrder"
1963+
}
1964+
}
1965+
}
1966+
`, rName, deepThreatInspection))
1967+
}
1968+
1969+
func testAccFirewallPolicyConfig_activeThreatDefense_strictOrder(rName string, deepThreatInspection bool) string {
1970+
return acctest.ConfigCompose(testAccFirewallPolicyConfig_baseStatelessRuleGroup(rName, 1), fmt.Sprintf(`
1971+
data "aws_region" "current" {}
1972+
data "aws_partition" "current" {}
1973+
1974+
resource "aws_networkfirewall_firewall_policy" "test" {
1975+
name = %[1]q
1976+
1977+
firewall_policy {
1978+
stateless_fragment_default_actions = ["aws:drop"]
1979+
stateless_default_actions = ["aws:pass"]
1980+
1981+
stateful_engine_options {
1982+
rule_order = "STRICT_ORDER"
1983+
}
1984+
1985+
stateful_rule_group_reference {
1986+
deep_threat_inspection = %[2]t
1987+
priority = 1
1988+
resource_arn = "arn:${data.aws_partition.current.partition}:network-firewall:${data.aws_region.current.region}:aws-managed:stateful-rulegroup/AttackInfrastructureStrictOrder"
1989+
}
1990+
}
1991+
}
1992+
`, rName, deepThreatInspection))
1993+
}

0 commit comments

Comments
 (0)