Skip to content

Commit

Permalink
Fix firewall settings for Aqua Services
Browse files Browse the repository at this point in the history 
added optional "resource" field for being able to add custom CIDR's

Resolves: SLK-90014
  • Loading branch information
Tal Mosenzon committed Jan 16, 2025
1 parent cb400a0 commit 82a54da
Show file tree
Hide file tree
Showing 8 changed files with 64 additions and 24 deletions.
12 changes: 12 additions & 0 deletions aquasec/data_service.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,11 @@ func dataSourceService() *schema.Resource {
Description: "The resource type for the inbound network rule (e.g., anywhere).",
Required: true,
},
"resource": {
Type: schema.TypeString,
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
Optional: true,
},
"allow": {
Type: schema.TypeBool,
Description: "Whether the inbound network rule is allowed.",
Expand All @@ -158,6 +163,11 @@ func dataSourceService() *schema.Resource {
Description: "The resource type for the outbound network rule (e.g., anywhere).",
Required: true,
},
"resource": {
Type: schema.TypeString,
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
Optional: true,
},
"allow": {
Type: schema.TypeBool,
Description: "Whether the outbound network rule is allowed.",
Expand Down Expand Up @@ -303,6 +313,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
inboundNetworks = append(inboundNetworks, map[string]interface{}{
"port_range": inbound.PortRange,
"resource_type": inbound.ResourceType,
"resource": inbound.Resource,
"allow": inbound.Allow,
})
}
Expand All @@ -314,6 +325,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
outboundNetworks = append(outboundNetworks, map[string]interface{}{
"port_range": outbound.PortRange,
"resource_type": outbound.ResourceType,
"resource": outbound.Resource,
"allow": outbound.Allow,
})
}
Expand Down
2 changes: 2 additions & 0 deletions aquasec/data_service_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,12 +84,14 @@ func TestDataSourceServiceComplex(t *testing.T) {
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.port_range", "22-80"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource_type", "anywhere"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.allow", "true"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource", "192.168.1.0/24"),

// Outbound Networks
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.#", "1"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.port_range", "443"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource_type", "anywhere"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.allow", "false"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource", "10.0.0.0/16"),

resource.TestCheckResourceAttr(rootRef, "priority", "1"),
resource.TestCheckResourceAttr(rootRef, "target", "container"),
Expand Down
12 changes: 12 additions & 0 deletions aquasec/resource_service.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,11 @@ func resourceService() *schema.Resource {
Description: "The resource type for the inbound network rule (e.g., anywhere).",
Required: true,
},
"resource": {
Type: schema.TypeString,
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
Optional: true,
},
"allow": {
Type: schema.TypeBool,
Description: "Whether the inbound network rule is allowed.",
Expand All @@ -170,6 +175,11 @@ func resourceService() *schema.Resource {
Description: "The resource type for the outbound network rule (e.g., anywhere).",
Required: true,
},
"resource": {
Type: schema.TypeString,
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
Optional: true,
},
"allow": {
Type: schema.TypeBool,
Description: "Whether the outbound network rule is allowed.",
Expand Down Expand Up @@ -333,6 +343,7 @@ func convertNetworkRulesToNetworks(networkRules []client.NetworkRule) []map[stri
"allow": networkRule.Allow,
"port_range": networkRule.PortRange,
"resource_type": networkRule.ResourceType,
"resource": networkRule.Resource,
})
}
return networkMaps
Expand Down Expand Up @@ -539,6 +550,7 @@ func expandNetworks(networks []interface{}) []client.NetworkRule {
networkRules = append(networkRules, client.NetworkRule{
PortRange: rule["port_range"].(string),
ResourceType: rule["resource_type"].(string),
Resource: rule["resource"].(string),
Allow: rule["allow"].(bool),
})
}
Expand Down
2 changes: 2 additions & 0 deletions aquasec/resource_service_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -141,12 +141,14 @@ func TestResourceAquasecServiceComplexCreate(t *testing.T) {
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.port_range", "22-80"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource_type", "anywhere"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.allow", "true"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource", "190.1.2.3/12"),

// Outbound Networks
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.#", "1"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.port_range", "443"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource_type", "anywhere"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.allow", "false"),
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource", "190.1.2.3/12"),
),
},
},
Expand Down
1 change: 1 addition & 0 deletions client/service.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ type LocalPolicy struct {
type NetworkRule struct {
PortRange string `json:"port_range"`
ResourceType string `json:"resource_type"`
Resource string `json:"resource"`
Allow bool `json:"allow"`
}
type VulnerabilitiesTypes struct {
Expand Down
2 changes: 2 additions & 0 deletions docs/data-sources/service.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ Required:

- `allow` (Boolean) Whether the inbound network rule is allowed.
- `port_range` (String) The port range for the inbound network rule.
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).


Expand All @@ -83,6 +84,7 @@ Required:

- `allow` (Boolean) Whether the outbound network rule is allowed.
- `port_range` (String) The port range for the outbound network rule.
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).


Expand Down
47 changes: 27 additions & 20 deletions docs/resources/service.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,41 +29,41 @@ resource "aquasec_service" "example_service" {
name = "policy1"
type = "access.control"
description = "Local policy 1 for inbound and outbound control"
inbound_networks {
port_range = "22/22" # Allow SSH traffic
resource_type = "anywhere" # Allow from any source
allow = true # Permit traffic
port_range = "22/22" # Allow SSH traffic
resource_type = "anywhere" # Allow from any source
allow = true # Permit traffic
}
outbound_networks {
port_range = "80/80" # Allow HTTP traffic
resource_type = "anywhere" # Allow to any destination
allow = true # Permit traffic
port_range = "80/80" # Allow HTTP traffic
resource_type = "anywhere" # Allow to any destination
allow = true # Permit traffic
}
block_metadata_service = false # Do not block metadata service
block_metadata_service = false # Do not block metadata service
}
// Local policy 2
local_policies {
name = "policy2"
type = "access.control"
description = "Local policy 2 with stricter outbound control"
inbound_networks {
port_range = "443/443" # Allow HTTPS traffic
resource_type = "anywhere" # Allow from any source
allow = true # Permit traffic
port_range = "443/443" # Allow HTTPS traffic
resource_type = "anywhere" # Allow from any source
allow = true # Permit traffic
}
outbound_networks {
port_range = "8080/8080" # Allow specific application traffic
resource_type = "specific" # Allow only to specific destinations
allow = false # Block traffic to unspecified destinations
port_range = "8080/8080" # Allow specific application traffic
resource_type = "specific" # Allow only to specific destinations
allow = false # Block traffic to unspecified destinations
}
block_metadata_service = true # Block metadata service access for security
block_metadata_service = true # Block metadata service access for security
}
}
```
Expand Down Expand Up @@ -129,8 +129,12 @@ Required:

- `allow` (Boolean) Whether the inbound network rule is allowed.
- `port_range` (String) The port range for the inbound network rule.
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).

* "anywhere" (equivalent to Anywhere in the UI)
* "custom" (equivalent to Custom IP in the UI)
* "application" (equivalent to Service in the UI)
* "domain" (equivalent to Domain in the UI)

<a id="nestedblock--local_policies--outbound_networks"></a>
### Nested Schema for `local_policies.outbound_networks`
Expand All @@ -139,9 +143,12 @@ Required:

- `allow` (Boolean) Whether the outbound network rule is allowed.
- `port_range` (String) The port range for the outbound network rule.
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).


* "anywhere" (equivalent to Anywhere in the UI)
* "custom" (equivalent to Custom IP in the UI)
* "application" (equivalent to Service in the UI)
* "domain" (equivalent to Domain in the UI)

<a id="nestedblock--scope_variables"></a>
### Nested Schema for `scope_variables`
Expand Down
10 changes: 6 additions & 4 deletions examples/resources/aquasec_service/resource.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,14 +37,16 @@ resource "aquasec_service" "example_service" {
description = "Local policy 2 with stricter outbound control"

inbound_networks {
port_range = "443/443" # Allow HTTPS traffic
resource_type = "anywhere" # Allow from any source
allow = true # Permit traffic
port_range = "443/443" # Allow HTTPS traffic
resource_type = "custom" # Allow from specific source
resource = "190.1.2.3/12" # Specific source
allow = true # Permit traffic
}

outbound_networks {
port_range = "8080/8080" # Allow specific application traffic
resource_type = "specific" # Allow only to specific destinations
resource_type = "custom" # Allow from specific source
resource = "190.1.2.3/12" # Specific source
allow = false # Block traffic to unspecified destinations
}

Expand Down

0 comments on commit 82a54da

Please sign in to comment.