[datadog_compliance_custom_framework] Terraform Provider for Custom Frameworks #2975

nkonjeti · 2025-04-16T22:27:54Z

Motivation:

We wanted a terraform provider to interact with our Custom Framework APIs. The terraform resources will remain as the source of truth so whenever a resource is updated/created/deleted this will be reflected in the database and UI.

Testing

I built the Terrraform provider locally.

Tested the following:

Creating

Updating

Deleting/Destroying

Changing order of rules

no changes in state so no action taken

Terraform Provider Immutable Fields (Handle And Version)

if handle or version is changed in a framework this will delete the old framework and create a new one with the new handle and version

in this example, updating the version to 2 deleted the old framework (version 1) and created a new framework with version 2

in this example updating the handle and version deleted the old framework with the old handle and version, and created a new framework with the new handle and version

Testing Large Input
Created this Framework: https://dd.datad0g.com/security/compliance/home/custom/my-custom-framework-terraform-3/3.0.0?previousUrl=%2Fsecurity%2Fcompliance%2Fhome&timestamp=1747948011353&live=true
one control with over 200 rule ids (seconds to complete)

Commands:

cd examples/resources/datadog_custom_framework 
terraform init
terraform plan -var="datadog_api_key=<>" -var="datadog_app_key=<>"
terraform apply

also added unit tests!

datadog/tests/resource_datadog_custom_framework_test.go

docs/resources/custom_framework.md

datadog/fwprovider/resource_datadog_custom_framework.go

datadog/internal/validators/duplicate_control_validator.go

datadog/internal/validators/duplicate_requirement_validator.go

datadog/fwprovider/resource_datadog_compliance_custom_framework.go

datadog/internal/validators/duplicate_requirement_validator.go

examples/resources/datadog_compliance_custom_framework/resource.tf

This reverts commit 367c92c.

nkonjeti · 2025-05-29T18:19:12Z

/merge

dd-devflow · 2025-05-29T18:19:16Z

View all feedbacks in Devflow UI.

2025-05-29 18:19:16 UTC ℹ️ Start processing command /merge

2025-05-29 18:19:21 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 25m (p90).

2025-05-29 18:45:48 UTC ℹ️ MergeQueue: This merge request was merged

…rameworks (#2975) * provider for custom frameworks * passed set create test * clean up code and add tests * add invalid create framework tests * test files * add import state functionality * update mod file * clean up code * update tests * test update is not triggered if order is changed * change retrieve custom framework to get custom framework * update api spec in go mod * add docs for terraform provider * remove unstable endpoint * add more tests * add validators * change tests to use same handle and version * add test for 409 conflict * add a resource file * add example in doc and remove comments * fix required requirements and control block * changeexample to compliance custom framework * fix docs * make icon url optional and remove description * add comment to describe why requirements is a set * remove description from resource example * remove comments and extra cassettes * fix description of icon url * fix format * delete framework in conflict test * remove import resource and update when create conflicts * use real rule ids in the example resource * remove logs * test same state framework id * add better comments for delete after delete case * add cassetes for same config no update test * move around error handling * Revert "move around error handling" This reverts commit 367c92c. * remove err check * add invalidcreate cassettes * use real rule ids * RecreateAfterAPIDelete cassettes * add immutable fields edge case * change requirements and controls to lists' * fix modify plan * fix the apply issue * remove modify plan because read API response order is changed * remove import file * check for rule ids length and update docs * remove same config no update test * use one validator and add test for duplicate handle * edit validator file name * update doc * updateifframework exists casettes

nkonjeti requested review from a team as code owners April 16, 2025 22:27

nkonjeti changed the title ~~provider for custom frameworks~~ Terraform Provider for Custom Frameworks Apr 24, 2025

nkonjeti force-pushed the neha.konjeti/framework-provider branch from ccaf302 to f8a90fe Compare April 25, 2025 18:59

nkonjeti added the changelog/no-changelog label Apr 25, 2025

nkonjeti marked this pull request as draft April 25, 2025 20:34

nkonjeti commented Apr 30, 2025

View reviewed changes

datadog/tests/resource_datadog_custom_framework_test.go Outdated Show resolved Hide resolved

nkonjeti changed the title ~~Terraform Provider for Custom Frameworks~~ [K9VULN-4477]: Terraform Provider for Custom Frameworks Apr 30, 2025

nkonjeti marked this pull request as ready for review May 1, 2025 21:14

nkonjeti requested a review from a team as a code owner May 1, 2025 21:14

brett0000FF approved these changes May 1, 2025

View reviewed changes

nkonjeti changed the title ~~[K9VULN-4477]: Terraform Provider for Custom Frameworks~~ Terraform Provider for Custom Frameworks May 2, 2025

nkonjeti commented May 5, 2025

View reviewed changes

docs/resources/custom_framework.md Outdated Show resolved Hide resolved