Skip to content

Commit 3a60a67

Browse files
semyonm0rsemyonm0r
authored
Merge pull request #281 from aquasecurity/SLK-90014-local-policies
bug: fix firewall settings for Aqua Services
2 parents cb400a0 + 3f8614e commit 3a60a67

File tree

6 files changed

+59
-24
lines changed

6 files changed

+59
-24
lines changed

‎aquasec/data_service.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,11 @@ func dataSourceService() *schema.Resource {
134134
Description: "The resource type for the inbound network rule (e.g., anywhere).",
135135
Required: true,
136136
},
137+
"resource": {
138+
Type: schema.TypeString,
139+
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
140+
Optional: true,
141+
},
137142
"allow": {
138143
Type: schema.TypeBool,
139144
Description: "Whether the inbound network rule is allowed.",
@@ -158,6 +163,11 @@ func dataSourceService() *schema.Resource {
158163
Description: "The resource type for the outbound network rule (e.g., anywhere).",
159164
Required: true,
160165
},
166+
"resource": {
167+
Type: schema.TypeString,
168+
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
169+
Optional: true,
170+
},
161171
"allow": {
162172
Type: schema.TypeBool,
163173
Description: "Whether the outbound network rule is allowed.",
@@ -303,6 +313,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
303313
inboundNetworks = append(inboundNetworks, map[string]interface{}{
304314
"port_range": inbound.PortRange,
305315
"resource_type": inbound.ResourceType,
316+
"resource": inbound.Resource,
306317
"allow": inbound.Allow,
307318
})
308319
}
@@ -314,6 +325,7 @@ func flattenLocalPolicies(policies []client.LocalPolicy) []map[string]interface{
314325
outboundNetworks = append(outboundNetworks, map[string]interface{}{
315326
"port_range": outbound.PortRange,
316327
"resource_type": outbound.ResourceType,
328+
"resource": outbound.Resource,
317329
"allow": outbound.Allow,
318330
})
319331
}

‎aquasec/resource_service.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,11 @@ func resourceService() *schema.Resource {
146146
Description: "The resource type for the inbound network rule (e.g., anywhere).",
147147
Required: true,
148148
},
149+
"resource": {
150+
Type: schema.TypeString,
151+
Description: "Custom ip for the inbound network rule (e.g., 190.1.2.3/12).",
152+
Optional: true,
153+
},
149154
"allow": {
150155
Type: schema.TypeBool,
151156
Description: "Whether the inbound network rule is allowed.",
@@ -170,6 +175,11 @@ func resourceService() *schema.Resource {
170175
Description: "The resource type for the outbound network rule (e.g., anywhere).",
171176
Required: true,
172177
},
178+
"resource": {
179+
Type: schema.TypeString,
180+
Description: "Custom ip for the outbound network rule (e.g., 190.1.2.3/12).",
181+
Optional: true,
182+
},
173183
"allow": {
174184
Type: schema.TypeBool,
175185
Description: "Whether the outbound network rule is allowed.",
@@ -333,6 +343,7 @@ func convertNetworkRulesToNetworks(networkRules []client.NetworkRule) []map[stri
333343
"allow": networkRule.Allow,
334344
"port_range": networkRule.PortRange,
335345
"resource_type": networkRule.ResourceType,
346+
"resource": networkRule.Resource,
336347
})
337348
}
338349
return networkMaps
@@ -539,6 +550,7 @@ func expandNetworks(networks []interface{}) []client.NetworkRule {
539550
networkRules = append(networkRules, client.NetworkRule{
540551
PortRange: rule["port_range"].(string),
541552
ResourceType: rule["resource_type"].(string),
553+
Resource: rule["resource"].(string),
542554
Allow: rule["allow"].(bool),
543555
})
544556
}

‎client/service.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ type LocalPolicy struct {
4242
type NetworkRule struct {
4343
PortRange string `json:"port_range"`
4444
ResourceType string `json:"resource_type"`
45+
Resource string `json:"resource"`
4546
Allow bool `json:"allow"`
4647
}
4748
type VulnerabilitiesTypes struct {

‎docs/data-sources/service.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ Required:
7373

7474
- `allow` (Boolean) Whether the inbound network rule is allowed.
7575
- `port_range` (String) The port range for the inbound network rule.
76+
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
7677
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).
7778

7879

@@ -83,6 +84,7 @@ Required:
8384

8485
- `allow` (Boolean) Whether the outbound network rule is allowed.
8586
- `port_range` (String) The port range for the outbound network rule.
87+
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
8688
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).
8789

8890

‎docs/resources/service.md‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -29,41 +29,41 @@ resource "aquasec_service" "example_service" {
2929
name = "policy1"
3030
type = "access.control"
3131
description = "Local policy 1 for inbound and outbound control"
32-
32+
3333
inbound_networks {
34-
port_range = "22/22" # Allow SSH traffic
35-
resource_type = "anywhere" # Allow from any source
36-
allow = true # Permit traffic
34+
port_range = "22/22" # Allow SSH traffic
35+
resource_type = "anywhere" # Allow from any source
36+
allow = true # Permit traffic
3737
}
38-
38+
3939
outbound_networks {
40-
port_range = "80/80" # Allow HTTP traffic
41-
resource_type = "anywhere" # Allow to any destination
42-
allow = true # Permit traffic
40+
port_range = "80/80" # Allow HTTP traffic
41+
resource_type = "anywhere" # Allow to any destination
42+
allow = true # Permit traffic
4343
}
4444
45-
block_metadata_service = false # Do not block metadata service
45+
block_metadata_service = false # Do not block metadata service
4646
}
4747
4848
// Local policy 2
4949
local_policies {
5050
name = "policy2"
5151
type = "access.control"
5252
description = "Local policy 2 with stricter outbound control"
53-
53+
5454
inbound_networks {
55-
port_range = "443/443" # Allow HTTPS traffic
56-
resource_type = "anywhere" # Allow from any source
57-
allow = true # Permit traffic
55+
port_range = "443/443" # Allow HTTPS traffic
56+
resource_type = "anywhere" # Allow from any source
57+
allow = true # Permit traffic
5858
}
5959
6060
outbound_networks {
61-
port_range = "8080/8080" # Allow specific application traffic
62-
resource_type = "specific" # Allow only to specific destinations
63-
allow = false # Block traffic to unspecified destinations
61+
port_range = "8080/8080" # Allow specific application traffic
62+
resource_type = "specific" # Allow only to specific destinations
63+
allow = false # Block traffic to unspecified destinations
6464
}
6565
66-
block_metadata_service = true # Block metadata service access for security
66+
block_metadata_service = true # Block metadata service access for security
6767
}
6868
}
6969
```
@@ -129,8 +129,11 @@ Required:
129129

130130
- `allow` (Boolean) Whether the inbound network rule is allowed.
131131
- `port_range` (String) The port range for the inbound network rule.
132+
- `resource` (String) Custom ip for the inbound network rule (e.g., 190.1.2.3/12).
132133
- `resource_type` (String) The resource type for the inbound network rule (e.g., anywhere).
133-
134+
* "anywhere" (equivalent to Anywhere in the UI)
135+
* "custom" (equivalent to Custom IP in the UI)
136+
* "application" (equivalent to Service in the UI)
134137

135138
<a id="nestedblock--local_policies--outbound_networks"></a>
136139
### Nested Schema for `local_policies.outbound_networks`
@@ -139,9 +142,12 @@ Required:
139142

140143
- `allow` (Boolean) Whether the outbound network rule is allowed.
141144
- `port_range` (String) The port range for the outbound network rule.
145+
- `resource` (String) Custom ip for the outbound network rule (e.g., 190.1.2.3/12).
142146
- `resource_type` (String) The resource type for the outbound network rule (e.g., anywhere).
143-
144-
147+
* "anywhere" (equivalent to Anywhere in the UI)
148+
* "custom" (equivalent to Custom IP in the UI)
149+
* "application" (equivalent to Service in the UI)
150+
* "domain" (equivalent to Domain in the UI)
145151

146152
<a id="nestedblock--scope_variables"></a>
147153
### Nested Schema for `scope_variables`

‎examples/resources/aquasec_service/resource.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,16 @@ resource "aquasec_service" "example_service" {
3737
description = "Local policy 2 with stricter outbound control"
3838

3939
inbound_networks {
40-
port_range = "443/443" # Allow HTTPS traffic
41-
resource_type = "anywhere" # Allow from any source
42-
allow = true # Permit traffic
40+
port_range = "443/443" # Allow HTTPS traffic
41+
resource_type = "custom" # Allow from specific source
42+
resource = "190.1.2.3/12" # Specific source
43+
allow = true # Permit traffic
4344
}
4445

4546
outbound_networks {
4647
port_range = "8080/8080" # Allow specific application traffic
47-
resource_type = "specific" # Allow only to specific destinations
48+
resource_type = "custom" # Allow from specific source
49+
resource = "190.1.2.3/12" # Specific source
4850
allow = false # Block traffic to unspecified destinations
4951
}
5052

0 commit comments

Comments
 (0)