Merge pull request #29 from wallarm/release-v1.1.0

Release v1.1.0

Author: wallarm-akalashnikov

.github/workflows/acceptance-tests.yml

@@ -2,14 +2,19 @@ name: Acceptance Tests
 on:
   push:
     branches: [master, develop]
+  pull_request:
+    types:
+      - opened
+      - synchronize
+  schedule:
+    - cron: 0 12 * * 5
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
     env:
       WALLARM_API_HOST: ${{ secrets.WALLARM_API_HOST }}
-      WALLARM_API_UUID: ${{ secrets.WALLARM_API_UUID }}
-      WALLARM_API_SECRET: ${{ secrets.WALLARM_API_SECRET }}
+      WALLARM_API_TOKEN: ${{ secrets.WALLARM_API_TOKEN }}
     steps:
     - name: Set up Go
       uses: actions/setup-go@v2

CHANGELOG.md

@@ -1,3 +1,17 @@
+# v1.1.0 (May 24, 2023)
+
+## BUG FIXES:
+
+* Fixed intergation api methods
+* Fixed rule api methods
+* Fixed trigger api methods
+
+## NOTES:
+
+* Added support for the following new resources: `wallarm_allowlist`, `wallarm_graylist`
+* Added support of the query field in rules
+* Change api authentication method using X-WallarmAPI-Token
+
 # v1.0.0 (November 3, 2022)
 
 ## BUG FIXES:

README.md

@@ -59,8 +59,7 @@ then run `terraform init`
 
 To start using this provider you have to set up you environment with the required variables:
 ```sh
-WALLARM_API_UUID
-WALLARM_API_SECRET
+WALLARM_API_TOKEN
 ```
 Optional:
 `WALLARM_API_HOST` with the default value `https://api.wallarm.com`
@@ -70,8 +69,7 @@ Another variant is to define the provider attributes within HCL files:
 ```hcl
 provider "wallarm" {
   api_host = var.api_host
-  api_uuid = var.api_uuid
-  api_secret = var.api_secret
+  api_token = var.api_token
 }
 ```
 Create the files `variables.tf` and `variables.auto.tfvars`
@@ -83,19 +81,14 @@ variable "api_host" {
   default = "https://us1.api.wallarm.com"
 }
 
-variable "api_uuid" {
-  type    = string
-}
-
-variable "api_secret" {
+variable "api_token" {
   type    = string
 }
 
 ```
 `variables.auto.tfvars`:
 ```
-api_uuid = "00000000-0000-0000-0000-000000000000"
-api_secret = "000000000000000000000000000000000000000000"
+api_token = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 ```
 
 ## Using The Provider

docs/index.md

@@ -17,8 +17,7 @@ Use the navigation to the left to read about the available resources.
 # Sets up Wallarm authentication credentials
 # You can use environment variables instead
 provider "wallarm" {
-  api_uuid = "4f6b8ace-9502-48c5-b1ad-526a230c2203"
-  api_secret = "e3f929a2eeb4f0fe6a453fee0f81e36d935b03a5f002d740ff8aa425f6cf4647"
+  api_token = "yXccqbq8o0zznJ5wMxzGmjvQ2RvmFAJZ6mFKF5Ka6n8fFpYaZBJHWIFBNXdeDhIG"
   api_host = "https://api.wallarm.com"
   client_id = 1111
 }
@@ -40,10 +39,9 @@ resource "wallarm_rule_vpatch" "vpatch" {
 
 The following arguments are supported in `provider "wallarm"`:
 
-* `api_uuid` - (**required**) your Wallarm user UUID, obtain it in the Wallarm Console → **Settings** → **Profile** → **API credentials**. Note that the most operations with Wallarm API are allowed only for the users with the **Administrator** role. This can also be specified with the `WALLARM_API_UUID` shell environment variable.
-* `api_secret` - (**required**) your Wallarm secret key. Note that the most operations with Wallarm API are allowed only for the users with the **Administrator** role. To get secret key, please follow the [instruction](https://docs.wallarm.com/admin-en/api-en/#your-own-client). This can also be specified with the `WALLARM_API_SECRET` shell environment variable.
+* `api_token` - (**required**) your Wallarm api token. Note that the most operations with Wallarm API are allowed only for the users with the **Administrator** role. To get api token, please follow the [instruction](https://docs.wallarm.com/api/overview/#your-own-client). This can also be specified with the `WALLARM_API_TOKEN` shell environment variable.
 * `api_host` - (optional) Wallarm API URL. Can be: `https://us1.api.wallarm.com` for the [US Cloud](https://docs.wallarm.com/about-wallarm/overview/#us-cloud), `https://api.wallarm.com` for the [EU Cloud](https://docs.wallarm.com/about-wallarm/overview/#eu-cloud). This can also be specified with the `WALLARM_API_HOST` shell environment variable. Default: `https://api.wallarm.com`.
-* `client_id` - (optional) ID of the client (tenant). The value is required for [multi-tenant scenarios][2]. This can also be specified with the `WALLARM_API_CLIENT_ID` shell environment variable. Default: client ID of the authenticated user defined by UUID and SECRET.
+* `client_id` - (optional) ID of the client (tenant). The value is required for [multi-tenant scenarios][2]. This can also be specified with the `WALLARM_API_CLIENT_ID` shell environment variable. Default: client ID of the authenticated user defined by api_token.
 * `retries` - (optional) maximum number of retries to perform when an API request fails. Default: 3. This can also be specified with the `WALLARM_API_RETRIES` shell environment variable.
 * `min_backoff` - (optional) minimum backoff period in seconds after failed API calls. Default: 1. This can also be specified with the `WALLARM_API_MIN_BACKOFF` shell environment variable.
 * `max_backoff` - (optional) maximum backoff period in seconds after failed API calls Default: 30. This can also be specified with the `WALLARM_API_MAX_BACKOFF` shell environment variable.

docs/resources/allowlist.md

@@ -0,0 +1,59 @@
+---
+layout: "wallarm"
+page_title: "Wallarm: wallarm_allowlist"
+subcategory: "Common"
+description: |-
+  Provides the resource to manage allowlist in the account.
+---
+
+# wallarm_allowlist
+
+Provides the resource to manage [allowlist][1] in the account providing functionality to block all requests originated from allowlisted IP addresses for a desired time either via `RFC3339` or `Minutes` formats.
+
+## Example Usage
+
+```hcl
+# Creates two new allowlist entries for the specific application
+# with the determined block time (60 minutes) and until the 2nd of January 2026
+
+resource "wallarm_allowlist" "allowlist_minutes" {
+  ip_range = ["1.1.1.1/32"]
+  application = [1]
+  reason = "TEST ALLOWLIST MINUTES"
+  time_format = "Minutes"
+  time = 60
+}
+
+resource "wallarm_allowlist" "allowlist_date" {
+  ip_range = ["2.2.2.2/32"]
+  application = [1]
+  reason = "TEST ALLOWLIST DATE"
+  time_format = "RFC3339"
+  time = "2026-01-02T15:04:05+07:00"
+}
+```
+
+## Argument Reference
+
+* `ip_range` - (**required**) IP range to be blocked. Can be defined as an array of ranges. Accept:
+  - distinct IP addresses (e.g. `1.1.1.1`, `2.2.2.2`)
+  - subnets (e.g. `1.1.1.1/24`, `2.2.2.2/30`)
+* `time_format` - (**required**) block time format.
+  Can be:
+  - `Minutes` - Time in minutes (e.g. `60` is to block for 60 minutes)
+  - `RFC3339` - RFC3339 time (e.g. `2021-06-01T15:04:05+07:00`)
+* `time` - (**required**) time for (or until) which the IP address should be blocked.
+* `application` - (optional) list of application IDs.
+  Default: all applications.
+* `reason` - (optional) arbitrary reason for blocking these IP addresses.
+* `client_id` - (optional) ID of the client (tenant). The value is required for [multi-tenant scenarios][2].
+
+## Attributes Reference
+
+`address_id` - ID of the address, composed of the following parts:
+
+- `ip_addr` - discrete IP address.
+- `ip_id` - ID of the entry with the certain IP address.
+
+[1]: https://docs.wallarm.com/user-guides/ip-lists/allowlist/
+[2]: https://docs.wallarm.com/installation/multi-tenant/overview/

docs/resources/graylist.md

@@ -0,0 +1,59 @@
+---
+layout: "wallarm"
+page_title: "Wallarm: wallarm_graylist"
+subcategory: "Common"
+description: |-
+  Provides the resource to manage graylist in the account.
+---
+
+# wallarm_graylist
+
+Provides the resource to manage [graylist][1] in the account providing functionality to block all requests originated from graylisted IP addresses for a desired time either via `RFC3339` or `Minutes` formats.
+
+## Example Usage
+
+```hcl
+# Creates two new graylist entries for the specific application
+# with the determined block time (60 minutes) and until the 2nd of January 2026
+
+resource "wallarm_graylist" "graylist_minutes" {
+  ip_range = ["1.1.1.1/32"]
+  application = [1]
+  reason = "TEST GRAYLIST MINUTES"
+  time_format = "Minutes"
+  time = 60
+}
+
+resource "wallarm_graylist" "graylist_date" {
+  ip_range = ["2.2.2.2/32"]
+  application = [1]
+  reason = "TEST GRAYLIST DATE"
+  time_format = "RFC3339"
+  time = "2026-01-02T15:04:05+07:00"
+}
+```
+
+## Argument Reference
+
+* `ip_range` - (**required**) IP range to be blocked. Can be defined as an array of ranges. Accept:
+  - distinct IP addresses (e.g. `1.1.1.1`, `2.2.2.2`)
+  - subnets (e.g. `1.1.1.1/24`, `2.2.2.2/30`)
+* `time_format` - (**required**) block time format.
+  Can be:
+  - `Minutes` - Time in minutes (e.g. `60` is to block for 60 minutes)
+  - `RFC3339` - RFC3339 time (e.g. `2021-06-01T15:04:05+07:00`)
+* `time` - (**required**) time for (or until) which the IP address should be blocked.
+* `application` - (optional) list of application IDs.
+  Default: all applications.
+* `reason` - (optional) arbitrary reason for blocking these IP addresses.
+* `client_id` - (optional) ID of the client (tenant). The value is required for [multi-tenant scenarios][2].
+
+## Attributes Reference
+
+`address_id` - ID of the address, composed of the following parts:
+
+- `ip_addr` - discrete IP address.
+- `ip_id` - ID of the entry with the certain IP address.
+
+[1]: https://docs.wallarm.com/user-guides/ip-lists/graylist/
+[2]: https://docs.wallarm.com/installation/multi-tenant/overview/

docs/resources/rule_attack_rechecker.md

@@ -65,15 +65,18 @@ The **point** attribute supports the following fields:
   * `action_ext` - (optional) the part of the URL after the last period `.`. It may be missing in the request.
   Example:
   `action_ext = "php"`
+  * `query` - (optional) the query parameter name.
+  Example:
+  `query = "user"`
   * `proto` - (optional) version of the HTTP Protocol.
   Example:
   `proto = "1.1"`
   * `scheme` - (optional) http/https.
   Example:
-  `scheme = "https"` 
+  `scheme = "https"`
   * `uri` - (optional) String with the original URL value.
   Example:
-  `uri = "/api/login"` 
+  `uri = "/api/login"`
   * `instance` - (optional) ID of the application.
   Example:
   `instance = 42`
@@ -95,7 +98,7 @@ Example:
       instance = 9
     }
   }
-  
+
   action {
     type = "absent"
     point = {
@@ -125,6 +128,14 @@ Example:
     }
   }
 
+  action {
+    type = "equal"
+    value = "admin"
+    point = {
+      query = "user"
+    }
+  }
+
   # ... skipped
   ```
 
@@ -134,7 +145,7 @@ See below what limitations apply
 `type` must be omitted when:
 - `point` is made up for `instance`
 
-`value` must be omitted when: 
+`value` must be omitted when:
 - `type` is `absent`
 - `point` is made up for `instance`
 

docs/resources/rule_attack_rechecker_rewrite.md

@@ -79,15 +79,18 @@ resource "wallarm_rule_attack_rechecker_rewrite" "default_rewrite" {
   * `action_ext` - (optional) the part of the URL after the last period (`.`). It may be missing in the request.
   Example:
   `action_ext = "php"`
+  * `query` - (optional) the query parameter name.
+  Example:
+  `query = "user"`
   * `proto` - (optional) version of the HTTP Protocol.
   Example:
   `proto = "1.1"`
   * `scheme` - (optional) `http`/`https`.
   Example:
-  `scheme = "https"` 
+  `scheme = "https"`
   * `uri` - (optional) part of the request URL without domain.
   Example:
-  `uri = "/api/login"` 
+  `uri = "/api/login"`
   * `instance` - (optional) ID of the application.
   Example:
   `instance = 42`
@@ -109,7 +112,7 @@ Example:
       instance = 9
     }
   }
-  
+
   action {
     type = "absent"
     point = {
@@ -139,6 +142,14 @@ Example:
     }
   }
 
+  action {
+    type = "equal"
+    value = "admin"
+    point = {
+      query = "user"
+    }
+  }
+
   # ... omitted
   ```
 
@@ -154,4 +165,4 @@ When `type` is `absent`, `point` must contain key with the default value. For `a
 * `rule_type` - type of the created rule. For example, `rule_type = "ignore_regex"`.
 
 [1]: https://docs.wallarm.com/user-guides/rules/change-request-for-active-verification/#rewriting-the-request-before-attack-replaying
-[2]: https://docs.wallarm.com/user-guides/scanner/intro/#active-threat-verification
+[2]: https://docs.wallarm.com/user-guides/scanner/intro/#active-threat-verification

docs/resources/rule_binary_data.md

@@ -61,15 +61,18 @@ resource "wallarm_rule_binary_data" "allow_bin_in_body" {
   * `action_ext` - (optional) the part of the URL after the last period (`.`). It may be missing in the request.
   Example:
   `action_ext = "php"`
+  * `query` - (optional) the query parameter name.
+  Example:
+  `query = "user"`
   * `proto` - (optional) version of the HTTP Protocol.
   Example:
   `proto = "1.1"`
   * `scheme` - (optional) `http`/`https`.
   Example:
-  `scheme = "https"` 
+  `scheme = "https"`
   * `uri` - (optional) part of the request URL without domain.
   Example:
-  `uri = "/api/login"` 
+  `uri = "/api/login"`
   * `instance` - (optional) ID of the application.
   Example:
   `instance = 42`
@@ -91,7 +94,7 @@ Example:
       instance = 9
     }
   }
-  
+
   action {
     type = "absent"
     point = {
@@ -121,6 +124,14 @@ Example:
     }
   }
 
+  action {
+    type = "equal"
+    value = "admin"
+    point = {
+      query = "user"
+    }
+  }
+
   # ... omitted
   ```