Skip to content

Commit 0b0403f

Browse files
hila-krut-sysdighila-krut-sysdig
authored
SSPROD-42234 | posture policy - add data source to get policy by id (#515)
* add data soucre to get policy by id * add test * add return * remove ibm * fix test * fix * fix * fix test and err handling * add err check * add zohar to codeowner
1 parent 825f2dd commit 0b0403f

9 files changed

+258
-8
lines changed

‎CODEOWNERS

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*monitor*groupmapping* @shadow649
1212

1313
# policies/rules
14-
*secure*policy* @kmvachhani @rosenbloomb-sysdig @ombellare @miguelgordo @ivanlysiuk-sysdig @daniel-almeida @jbainbridgesysdig @IvanNik @hila1608 @yaminSapir @chen-shmilovich-sysdig
14+
*secure*policy* @kmvachhani @rosenbloomb-sysdig @ombellare @miguelgordo @ivanlysiuk-sysdig @daniel-almeida @jbainbridgesysdig @IvanNik @hila1608 @yaminSapir @chen-shmilovich-sysdig @zohar-arad
1515

1616
# internal components
1717
/sysdig/internal/client/v2/client.go @filiptubic @mbarbieri @draraksysdig

‎sysdig/data_source_sysdig_secure_posture_policy.go

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
package sysdig
2+
3+
import (
4+
"context"
5+
"strconv"
6+
"time"
7+
8+
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
9+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
10+
)
11+
12+
func dataSourceSysdigSecurePosturePolicy() *schema.Resource {
13+
return &schema.Resource{
14+
ReadContext: dataSourceSysdigSecurePosturePolicyRead,
15+
Timeouts: &schema.ResourceTimeout{
16+
Read: schema.DefaultTimeout(5 * time.Minute),
17+
},
18+
Schema: map[string]*schema.Schema{
19+
SchemaIDKey: {
20+
Type: schema.TypeString,
21+
Required: true,
22+
},
23+
SchemaNameKey: {
24+
Type: schema.TypeString,
25+
Computed: true,
26+
},
27+
SchemaDescriptionKey: {
28+
Type: schema.TypeString,
29+
Computed: true,
30+
},
31+
SchemaTypeKey: {
32+
Type: schema.TypeString,
33+
Computed: true,
34+
},
35+
SchemaLinkKey: {
36+
Type: schema.TypeString,
37+
Computed: true,
38+
},
39+
SchemaMinKubeVersionKey: {
40+
Type: schema.TypeFloat,
41+
Computed: true,
42+
},
43+
SchemaMaxKubeVersionKey: {
44+
Type: schema.TypeFloat,
45+
Computed: true,
46+
},
47+
SchemaIsActiveKey: {
48+
Type: schema.TypeBool,
49+
Computed: true,
50+
},
51+
SchemaPlatformKey: {
52+
Type: schema.TypeString,
53+
Computed: true,
54+
},
55+
SchemaGroupKey: {
56+
Type: schema.TypeList,
57+
Optional: true,
58+
Elem: createGroupSchema(1),
59+
},
60+
},
61+
}
62+
}
63+
64+
func dataSourceSysdigSecurePosturePolicyRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
65+
client, err := getPosturePolicyClient(meta.(SysdigClients))
66+
if err != nil {
67+
return diag.FromErr(err)
68+
}
69+
70+
id, err := strconv.ParseInt(d.Get("id").(string), 10, 64)
71+
if err != nil {
72+
return diag.FromErr(err)
73+
}
74+
policy, err := client.GetPosturePolicy(ctx, id)
75+
if err != nil {
76+
return diag.FromErr(err)
77+
}
78+
err = d.Set(SchemaIDKey, policy.ID)
79+
if err != nil {
80+
return diag.FromErr(err)
81+
}
82+
83+
err = d.Set(SchemaNameKey, policy.Name)
84+
if err != nil {
85+
return diag.FromErr(err)
86+
}
87+
88+
err = d.Set(SchemaDescriptionKey, policy.Description)
89+
if err != nil {
90+
return diag.FromErr(err)
91+
}
92+
93+
err = d.Set(SchemaTypeKey, policy.Type)
94+
if err != nil {
95+
return diag.FromErr(err)
96+
}
97+
98+
err = d.Set(SchemaLinkKey, policy.Link)
99+
if err != nil {
100+
return diag.FromErr(err)
101+
}
102+
103+
err = d.Set(SchemaMinKubeVersionKey, policy.MinKubeVersion)
104+
if err != nil {
105+
return diag.FromErr(err)
106+
}
107+
108+
err = d.Set(SchemaMaxKubeVersionKey, policy.MaxKubeVersion)
109+
if err != nil {
110+
return diag.FromErr(err)
111+
}
112+
113+
err = d.Set(SchemaIsActiveKey, policy.IsActive)
114+
if err != nil {
115+
return diag.FromErr(err)
116+
}
117+
118+
err = d.Set(SchemaPlatformKey, policy.Platform)
119+
if err != nil {
120+
return diag.FromErr(err)
121+
}
122+
123+
// Set groups
124+
if err := setGroups(d, policy.RequirementsGroup); err != nil {
125+
return diag.FromErr(err)
126+
}
127+
128+
d.SetId(policy.ID)
129+
return nil
130+
}

‎sysdig/data_source_sysdig_secure_posture_policy_test.go

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
//go:build tf_acc_sysdig_secure
2+
3+
package sysdig_test
4+
5+
import (
6+
"fmt"
7+
"testing"
8+
9+
"github.com/draios/terraform-provider-sysdig/sysdig"
10+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
11+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
12+
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
13+
)
14+
15+
func TestAccPosturePolicyDataSource(t *testing.T) {
16+
resource.ParallelTest(t, resource.TestCase{
17+
PreCheck: preCheckAnyEnv(t, SysdigSecureApiTokenEnv),
18+
ProviderFactories: map[string]func() (*schema.Provider, error){
19+
"sysdig": func() (*schema.Provider, error) {
20+
return sysdig.Provider(), nil
21+
},
22+
},
23+
Steps: []resource.TestStep{
24+
{
25+
Config: `
26+
data "sysdig_secure_posture_policy" "policy" {
27+
id = 2
28+
}`,
29+
Check: func(state *terraform.State) error {
30+
policyRef := "data.sysdig_secure_posture_policy.policy"
31+
s, ok := state.RootModule().Resources[policyRef]
32+
if !ok {
33+
return fmt.Errorf("%s not found", policyRef)
34+
}
35+
if s.Primary.ID != "2" {
36+
return fmt.Errorf("expected policy ID to be 2")
37+
}
38+
if s.Primary.Attributes["name"] != "Sysdig Kubernetes" {
39+
return fmt.Errorf("expected policy name to be `Sysdig Kubernetes`")
40+
}
41+
return nil
42+
},
43+
},
44+
},
45+
})
46+
}

‎sysdig/internal/client/v2/model.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -979,8 +979,8 @@ type Requirement struct {
979979
}
980980

981981
type Control struct {
982-
Name string `json:"name,omitempty"`
983-
Enabled bool `json:"enabled,omitempty"`
982+
Name string `json:"name,omitempty"`
983+
Status bool `json:"status,omitempty"`
984984
}
985985

986986
type CreatePosturePolicy struct {

‎sysdig/provider.go

+1
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,7 @@ func (p *SysdigProvider) Provider() *schema.Provider {
245245
"sysdig_monitor_notification_channel_ibm_event_notification": dataSourceSysdigMonitorNotificationChannelIBMEventNotification(),
246246
"sysdig_monitor_notification_channel_ibm_function": dataSourceSysdigMonitorNotificationChannelIBMFunction(),
247247
"sysdig_monitor_custom_role_permissions": dataSourceSysdigMonitorCustomRolePermissions(),
248+
"sysdig_secure_posture_policy": dataSourceSysdigSecurePosturePolicy(),
248249
},
249250
ConfigureContextFunc: p.providerConfigure,
250251
}

‎sysdig/resource_sysdig_secure_posture_policy.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,6 @@ func resourceSysdigSecurePosturePolicy() *schema.Resource {
156156
SchemaTypeKey: {
157157
Type: schema.TypeString,
158158
Optional: true,
159-
Default: "",
160159
},
161160
SchemaLinkKey: {
162161
Type: schema.TypeString,
@@ -284,7 +283,9 @@ func resourceSysdigSecurePosturePolicyRead(ctx context.Context, d *schema.Resour
284283
if err := setGroups(d, policy.RequirementsGroup); err != nil {
285284
return diag.FromErr(err)
286285
}
287-
286+
if err != nil {
287+
return diag.FromErr(err)
288+
}
288289
return nil
289290
}
290291

@@ -356,7 +357,7 @@ func setControls(controls []v2.Control) []interface{} {
356357
for _, ctrl := range controls {
357358
ctrlData := map[string]interface{}{
358359
"name": ctrl.Name,
359-
"enabled": ctrl.Enabled,
360+
"enabled": ctrl.Status,
360361
}
361362
controlsData = append(controlsData, ctrlData)
362363
}

‎website/docs/d/secure_posture_policy.md

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
subcategory: "Sysdig Secure"
3+
layout: "sysdig"
4+
page_title: "Sysdig: sysdig_secure_posture_policy"
5+
description: |-
6+
Retrieves Posture policy by ID.
7+
---
8+
9+
# Data Source: sysdig_secure_posture_policies
10+
11+
Retrieves the information of all Posture policies.
12+
13+
-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository.
14+
15+
## Example Usage
16+
17+
```terraform
18+
data sysdig_secure_posture_policies policy {
19+
id = "454678"
20+
}
21+
```
22+
23+
## Argument Reference
24+
25+
- `id` - (Required) The ID of the Posture Policy, eg. `2`
26+
27+
## Attributes Reference
28+
29+
In addition to all arguments above, the following attributes are exported:
30+
31+
- `id` - The ID of the Posture Policy, eg. `452`
32+
- `name` - The name of the Posture Policy, eg. `CIS Docker Benchmark`
33+
- `description` - The description of the Posture Poliy, eg. `CIS Docker Benchmark`
34+
* `link` - Policy link
35+
* `type` - Policy type:
36+
- AWS - `aws`
37+
- GCP - `gcp`
38+
- Azure - `azure`
39+
- Kubernetes - `kubernetes`
40+
- Linux - `linux`
41+
- Docker - `docker`
42+
- OCI = `oci`
43+
* `min_kube_version` - Policy minimum Kubernetes version, eg. `1.24`
44+
* `max_kube_version` - Policy maximum Kubernetes version, eg. `1.26`
45+
* `is_active` - Policy is active flag (active means policy is published, not active means policy is draft). by default is true.
46+
* `platform` - Policy platform:
47+
- IKS - `iks`,
48+
- GKE - `gke`,
49+
- Vanilla - `vanilla`,
50+
- AKS - `aks`,
51+
- RKE2 - `rke2`,
52+
- OCP4 - `ocp4`,
53+
- MKE - `mke`,
54+
- EKS - `eks`,
55+
* `groups` - Group block defines list of groups attached to Policy
56+
57+
### Groups block
58+
- `id` - The ID of the Group, eg. `15000`
59+
- `name` - The name of the Posture Policy Group.
60+
- `description` - The description of the Posture Policy Group.
61+
- `requirements` - Requirements block defines list of requirements attached to Group
62+
63+
### Requirements block
64+
- `id` - The ID of the Requirement, eg. `15000`
65+
- `name` - The name of the Posture Policy Requirement.
66+
- `description` - The description of the Posture Policy Requirement.
67+
- `controls` - Controls block defines list of controls linked to requirments
68+
69+
### Controls block
70+
- `name` - The name of the Posture Control.
71+
- `enabled` - The 'Control is enabled' flag indicates whether the control will affect the policy evaluation or not. By default, it is set to true

‎website/docs/index.md

+1
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,7 @@ When IBM Workload Protection resources are to be created, this authentication mu
261261
> - `sysdig_current_user`
262262
> - `sysdig_secure_notification_channel`
263263
> - `sysdig_secure_posture_policies`
264+
> - `sysdig_secure_posture_policy`
264265
265266
### Others
266267
* `extra_headers` - (Optional) Defines extra HTTP headers that will be added to the client

‎website/docs/r/secure_posture_policy.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Creates a Sysdig Secure Posture Policy.
1717
```terraform
1818
resource "sysdig_secure_posture_policy" "example" {
1919
name = "demo policy"
20-
type = "kuberenetes"
20+
type = "kubernetes"
2121
platform = "vanilla"
2222
max_kube_version = 2.0
2323
description = "demo create policy from terraform"
@@ -65,7 +65,7 @@ resource "sysdig_secure_posture_policy" "example" {
6565
- Kubernetes - `kubernetes`
6666
- Linux - `linux`
6767
- Docker - `docker`
68-
- OCI = `oci`
68+
- OCI - `oci`
6969
* `min_kube_version` - (Optional) Policy minimum Kubernetes version, eg. `1.24`
7070
* `max_kube_version` - (Optional) Policy maximum Kubernetes version, eg. `1.26`
7171
* `is_active` - (Optional) Policy is active flag (active means policy is published, not active means policy is draft). by default is true.

0 commit comments

Comments
 (0)