Skip to content

Commit 64af852

Browse files
MosenzonTalMosenzonTal
committed
Fix firewall settings for Aqua Services
added optional "resource" field for being able to add custom CIDR's Resolves: SLK-90014
1 parent cb400a0 commit 64af852

File tree

8 files changed

+56
-21
lines changed

8 files changed

+56
-21
lines changed

‎aquasec/data_service.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,11 @@ func dataSourceService() *schema.Resource {
134134
Description: "The resource type for the inbound network rule (e.g., anywhere).",
135135
Required: true,
136136
},
137+
"resource": {
138+
Type: schema.TypeString,
139+
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
140+
Optional: true,
141+
},
137142
"allow": {
138143
Type: schema.TypeBool,
139144
Description: "Whether the inbound network rule is allowed.",
@@ -158,6 +163,11 @@ func dataSourceService() *schema.Resource {
158163
Description: "The resource type for the outbound network rule (e.g., anywhere).",
159164
Required: true,
160165
},
166+
"resource": {
167+
Type: schema.TypeString,
168+
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
169+
Optional: true,
170+
},
161171
"allow": {
162172
Type: schema.TypeBool,
163173
Description: "Whether the outbound network rule is allowed.",
@@ -303,6 +313,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
303313
inboundNetworks = append(inboundNetworks, map[string]interface{}{
304314
"port_range": inbound.PortRange,
305315
"resource_type": inbound.ResourceType,
316+
"resource": inbound.Resource,
306317
"allow": inbound.Allow,
307318
})
308319
}
@@ -314,6 +325,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
314325
outboundNetworks = append(outboundNetworks, map[string]interface{}{
315326
"port_range": outbound.PortRange,
316327
"resource_type": outbound.ResourceType,
328+
"resource": outbound.Resource,
317329
"allow": outbound.Allow,
318330
})
319331
}

‎aquasec/data_service_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,12 +84,14 @@ func TestDataSourceServiceComplex(t *testing.T) {
8484
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.port_range", "22-80"),
8585
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource_type", "anywhere"),
8686
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.allow", "true"),
87+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource", "192.168.1.0/24"),
8788

8889
// Outbound Networks
8990
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.#", "1"),
9091
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.port_range", "443"),
9192
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource_type", "anywhere"),
9293
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.allow", "false"),
94+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource", "10.0.0.0/16"),
9395

9496
resource.TestCheckResourceAttr(rootRef, "priority", "1"),
9597
resource.TestCheckResourceAttr(rootRef, "target", "container"),

‎aquasec/resource_service.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,11 @@ func resourceService() *schema.Resource {
146146
Description: "The resource type for the inbound network rule (e.g., anywhere).",
147147
Required: true,
148148
},
149+
"resource": {
150+
Type: schema.TypeString,
151+
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
152+
Optional: true,
153+
},
149154
"allow": {
150155
Type: schema.TypeBool,
151156
Description: "Whether the inbound network rule is allowed.",
@@ -170,6 +175,11 @@ func resourceService() *schema.Resource {
170175
Description: "The resource type for the outbound network rule (e.g., anywhere).",
171176
Required: true,
172177
},
178+
"resource": {
179+
Type: schema.TypeString,
180+
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
181+
Optional: true,
182+
},
173183
"allow": {
174184
Type: schema.TypeBool,
175185
Description: "Whether the outbound network rule is allowed.",
@@ -333,6 +343,7 @@ func convertNetworkRulesToNetworks(networkRules []client.NetworkRule) []map[stri
333343
"allow": networkRule.Allow,
334344
"port_range": networkRule.PortRange,
335345
"resource_type": networkRule.ResourceType,
346+
"resource": networkRule.Resource,
336347
})
337348
}
338349
return networkMaps
@@ -539,6 +550,7 @@ func expandNetworks(networks []interface{}) []client.NetworkRule {
539550
networkRules = append(networkRules, client.NetworkRule{
540551
PortRange: rule["port_range"].(string),
541552
ResourceType: rule["resource_type"].(string),
553+
Resource: rule["resource"].(string),
542554
Allow: rule["allow"].(bool),
543555
})
544556
}

‎aquasec/resource_service_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,12 +141,14 @@ func TestResourceAquasecServiceComplexCreate(t *testing.T) {
141141
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.port_range", "22-80"),
142142
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource_type", "anywhere"),
143143
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.allow", "true"),
144+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.inbound_networks.0.resource", "190.1.2.3/12"),
144145

145146
// Outbound Networks
146147
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.#", "1"),
147148
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.port_range", "443"),
148149
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource_type", "anywhere"),
149150
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.allow", "false"),
151+
resource.TestCheckResourceAttr(rootRef, "local_policies.0.outbound_networks.0.resource", "190.1.2.3/12"),
150152
),
151153
},
152154
},

‎client/service.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ type LocalPolicy struct {
4242
type NetworkRule struct {
4343
PortRange string `json:"port_range"`
4444
ResourceType string `json:"resource_type"`
45+
Resource string `json:"resource"`
4546
Allow bool `json:"allow"`
4647
}
4748
type VulnerabilitiesTypes struct {

‎docs/data-sources/service.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ Required:
7373

7474
- `allow` (Boolean) Whether the inbound network rule is allowed.
7575
- `port_range` (String) The port range for the inbound network rule.
76+
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
7677
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).
7778

7879

@@ -83,6 +84,7 @@ Required:
8384

8485
- `allow` (Boolean) Whether the outbound network rule is allowed.
8586
- `port_range` (String) The port range for the outbound network rule.
87+
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
8688
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).
8789

8890

‎docs/resources/service.md‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -29,41 +29,41 @@ resource "aquasec_service" "example_service" {
2929
name = "policy1"
3030
type = "access.control"
3131
description = "Local policy 1 for inbound and outbound control"
32-
32+
3333
inbound_networks {
34-
port_range = "22/22" # Allow SSH traffic
35-
resource_type = "anywhere" # Allow from any source
36-
allow = true # Permit traffic
34+
port_range = "22/22" # Allow SSH traffic
35+
resource_type = "anywhere" # Allow from any source
36+
allow = true # Permit traffic
3737
}
38-
38+
3939
outbound_networks {
40-
port_range = "80/80" # Allow HTTP traffic
41-
resource_type = "anywhere" # Allow to any destination
42-
allow = true # Permit traffic
40+
port_range = "80/80" # Allow HTTP traffic
41+
resource_type = "anywhere" # Allow to any destination
42+
allow = true # Permit traffic
4343
}
4444
45-
block_metadata_service = false # Do not block metadata service
45+
block_metadata_service = false # Do not block metadata service
4646
}
4747
4848
// Local policy 2
4949
local_policies {
5050
name = "policy2"
5151
type = "access.control"
5252
description = "Local policy 2 with stricter outbound control"
53-
53+
5454
inbound_networks {
55-
port_range = "443/443" # Allow HTTPS traffic
56-
resource_type = "anywhere" # Allow from any source
57-
allow = true # Permit traffic
55+
port_range = "443/443" # Allow HTTPS traffic
56+
resource_type = "anywhere" # Allow from any source
57+
allow = true # Permit traffic
5858
}
5959
6060
outbound_networks {
61-
port_range = "8080/8080" # Allow specific application traffic
62-
resource_type = "specific" # Allow only to specific destinations
63-
allow = false # Block traffic to unspecified destinations
61+
port_range = "8080/8080" # Allow specific application traffic
62+
resource_type = "specific" # Allow only to specific destinations
63+
allow = false # Block traffic to unspecified destinations
6464
}
6565
66-
block_metadata_service = true # Block metadata service access for security
66+
block_metadata_service = true # Block metadata service access for security
6767
}
6868
}
6969
```
@@ -129,6 +129,7 @@ Required:
129129

130130
- `allow` (Boolean) Whether the inbound network rule is allowed.
131131
- `port_range` (String) The port range for the inbound network rule.
132+
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
132133
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).
133134

134135

@@ -139,6 +140,7 @@ Required:
139140

140141
- `allow` (Boolean) Whether the outbound network rule is allowed.
141142
- `port_range` (String) The port range for the outbound network rule.
143+
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
142144
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).
143145

144146

‎examples/resources/aquasec_service/resource.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,16 @@ resource "aquasec_service" "example_service" {
3737
description = "Local policy 2 with stricter outbound control"
3838

3939
inbound_networks {
40-
port_range = "443/443" # Allow HTTPS traffic
41-
resource_type = "anywhere" # Allow from any source
42-
allow = true # Permit traffic
40+
port_range = "443/443" # Allow HTTPS traffic
41+
resource_type = "custom" # Allow from specific source
42+
resource = "190.1.2.3/12" # Specific source
43+
allow = true # Permit traffic
4344
}
4445

4546
outbound_networks {
4647
port_range = "8080/8080" # Allow specific application traffic
47-
resource_type = "specific" # Allow only to specific destinations
48+
resource_type = "custom" # Allow from specific source
49+
resource = "190.1.2.3/12" # Specific source
4850
allow = false # Block traffic to unspecified destinations
4951
}
5052

0 commit comments

Comments
 (0)