Skip to content

Commit 83730c0

Browse files
thoufic67mthoufic
thoufic67
and
mthoufic
authored
cloudsecuritycompliace: add google_cloud_security_compliance_cloud_control resource (#15598)
Co-authored-by: Thoufic <[email protected]>
1 parent 113a962 commit 83730c0

File tree

4 files changed

+617
-0
lines changed

4 files changed

+617
-0
lines changed

‎mmv1/products/cloudsecuritycompliance/CloudControl.yaml‎

Lines changed: 301 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: CloudControl
16+
description: Cloud controls are the building blocks that make up frameworks. Each cloud control is a unit encapsulating various platform-specific logic for prevention, detection, and audit.
17+
references:
18+
api: https://docs.cloud.google.com/security-command-center/docs/reference/cloudsecuritycompliance/rest/v1/organizations.locations.cloudControls
19+
base_url: organizations/{{organization}}/locations/{{location}}/cloudControls
20+
update_mask: true
21+
self_link: organizations/{{organization}}/locations/{{location}}/cloudControls/{{cloud_control_id}}
22+
create_url: organizations/{{organization}}/locations/{{location}}/cloudControls?cloudControlId={{cloud_control_id}}
23+
update_verb: PATCH
24+
id_format: organizations/{{organization}}/locations/{{location}}/cloudControls/{{cloud_control_id}}
25+
import_format:
26+
- organizations/{{organization}}/locations/{{location}}/cloudControls/{{cloud_control_id}}
27+
examples:
28+
- name: "cloudsecuritycompliance_cloudcontrol_basic"
29+
primary_resource_id: "example"
30+
vars:
31+
cloudcontrol_name: "example-cloudcontrol"
32+
test_env_vars:
33+
org_id: "ORG_ID"
34+
autogen_status: Q2xvdWRDb250cm9s
35+
custom_code:
36+
encoder: "templates/terraform/encoders/cloudsecuritycompliance_cloudcontrol.go.tmpl"
37+
parameters:
38+
- name: organization
39+
type: String
40+
description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122.
41+
immutable: true
42+
url_param_only: true
43+
required: true
44+
- name: location
45+
type: String
46+
description: Resource ID segment making up resource `name`. It identifies the resource within its parent collection as described in https://google.aip.dev/122. Currently, only "global" is supported as a location.
47+
immutable: true
48+
url_param_only: true
49+
required: true
50+
- name: cloudControlId
51+
type: String
52+
description: |-
53+
ID of the CloudControl.
54+
This is the last segment of the CloudControl resource name.
55+
Format: `^a-zA-Z{0,61}[a-zA-Z0-9]$`.
56+
immutable: true
57+
url_param_only: true
58+
required: true
59+
properties:
60+
- name: categories
61+
type: Array
62+
description: The categories of the cloud control.
63+
immutable: true
64+
item_type:
65+
type: String
66+
- name: createTime
67+
type: String
68+
description: |-
69+
The last updated time of the cloud control.
70+
The create_time is used because a new CC is created whenever we update an
71+
existing CC.
72+
output: true
73+
- name: description
74+
type: String
75+
description: A description of the cloud control. The maximum length is 2000 characters.
76+
- name: displayName
77+
type: String
78+
description: |-
79+
The display name of the cloud control. The maximum length is 200
80+
characters.
81+
- name: findingCategory
82+
type: String
83+
description: |-
84+
The finding_category of the cloud control. The maximum length is 255
85+
characters.
86+
immutable: true
87+
- name: majorRevisionId
88+
type: String
89+
description: Major revision of the cloud control incremented in ascending order.
90+
output: true
91+
- name: name
92+
type: String
93+
description: |-
94+
Identifier. The resource name of the cloud control.
95+
Format:
96+
organizations/{organization}/locations/{location}/cloudControls/{cloud_control_id}
97+
output: true
98+
- name: parameterSpec
99+
type: Array
100+
description: The parameter spec of the cloud control.
101+
item_type:
102+
type: NestedObject
103+
properties:
104+
- name: defaultValue
105+
type: NestedObject
106+
description: Possible parameter value types.
107+
properties:
108+
- name: boolValue
109+
type: Boolean
110+
description: Represents a boolean value.
111+
- name: numberValue
112+
type: Double
113+
description: Represents a double value.
114+
- name: stringListValue
115+
type: NestedObject
116+
description: A list of strings.
117+
properties:
118+
- name: values
119+
type: Array
120+
description: The strings in the list.
121+
required: true
122+
item_type:
123+
type: String
124+
- name: stringValue
125+
type: String
126+
description: Represents a string value.
127+
- name: description
128+
type: String
129+
description: The description of the parameter. The maximum length is 2000 characters.
130+
- name: displayName
131+
type: String
132+
description: The display name of the parameter. The maximum length is 200 characters.
133+
- name: isRequired
134+
type: Boolean
135+
description: if the parameter is required
136+
required: true
137+
- name: name
138+
type: String
139+
description: The name of the parameter.
140+
required: true
141+
- name: substitutionRules
142+
type: Array
143+
description: List of parameter substitutions.
144+
item_type:
145+
type: NestedObject
146+
properties:
147+
- name: attributeSubstitutionRule
148+
type: NestedObject
149+
description: Attribute at the given path is substituted entirely.
150+
properties:
151+
- name: attribute
152+
type: String
153+
description: |-
154+
Fully qualified proto attribute path (in dot notation).
155+
Example: rules[0].cel_expression.resource_types_values
156+
- name: placeholderSubstitutionRule
157+
type: NestedObject
158+
description: Placeholder is substituted in the rendered string.
159+
properties:
160+
- name: attribute
161+
type: String
162+
description: Fully qualified proto attribute path (e.g., dot notation)
163+
- name: validation
164+
type: NestedObject
165+
description: Validation of the parameter.
166+
properties:
167+
- name: allowedValues
168+
type: NestedObject
169+
description: Allowed set of values for the parameter.
170+
properties:
171+
- name: values
172+
type: Array
173+
description: List of allowed values for the parameter.
174+
required: true
175+
item_type:
176+
type: NestedObject
177+
properties:
178+
- name: boolValue
179+
type: Boolean
180+
description: Represents a boolean value.
181+
- name: numberValue
182+
type: Double
183+
description: Represents a double value.
184+
- name: stringListValue
185+
type: NestedObject
186+
description: A list of strings.
187+
properties:
188+
- name: values
189+
type: Array
190+
description: The strings in the list.
191+
required: true
192+
item_type:
193+
type: String
194+
- name: stringValue
195+
type: String
196+
description: Represents a string value.
197+
- name: intRange
198+
type: NestedObject
199+
description: Number range for number parameters.
200+
properties:
201+
- name: max
202+
type: String
203+
description: Maximum allowed value for the numeric parameter (inclusive).
204+
required: true
205+
- name: min
206+
type: String
207+
description: Minimum allowed value for the numeric parameter (inclusive).
208+
required: true
209+
- name: regexpPattern
210+
type: NestedObject
211+
description: Regular Expression Validator for parameter values.
212+
properties:
213+
- name: pattern
214+
type: String
215+
description: Regex Pattern to match the value(s) of parameter.
216+
required: true
217+
- name: valueType
218+
type: String
219+
description: |-
220+
Parameter value type.
221+
Possible values:
222+
STRING
223+
BOOLEAN
224+
STRINGLIST
225+
NUMBER
226+
ONEOF
227+
required: true
228+
- name: relatedFrameworks
229+
type: Array
230+
description: The Frameworks that include this CloudControl
231+
output: true
232+
item_type:
233+
type: String
234+
- name: remediationSteps
235+
type: String
236+
description: |-
237+
The remediation steps for the findings generated by the cloud control. The
238+
maximum length is 400 characters.
239+
- name: rules
240+
type: Array
241+
description: The Policy to be enforced to prevent/detect resource non-compliance.
242+
item_type:
243+
type: NestedObject
244+
properties:
245+
- name: celExpression
246+
type: NestedObject
247+
description: |-
248+
A [CEL
249+
expression](https://cloud.google.com/certificate-authority-service/docs/using-cel).
250+
properties:
251+
- name: expression
252+
type: String
253+
description: |-
254+
Logic expression in CEL language.
255+
The max length of the condition is 1000 characters.
256+
required: true
257+
- name: resourceTypesValues
258+
type: NestedObject
259+
description: A list of strings.
260+
properties:
261+
- name: values
262+
type: Array
263+
description: The strings in the list.
264+
required: true
265+
item_type:
266+
type: String
267+
- name: description
268+
type: String
269+
description: Description of the Rule. The maximum length is 2000 characters.
270+
- name: ruleActionTypes
271+
type: Array
272+
description: The functionality enabled by the Rule.
273+
required: true
274+
item_type:
275+
type: String
276+
- name: severity
277+
type: String
278+
description: |-
279+
Possible values:
280+
CRITICAL
281+
HIGH
282+
MEDIUM
283+
LOW
284+
- name: supportedCloudProviders
285+
type: Array
286+
description: cloud providers supported
287+
immutable: true
288+
item_type:
289+
type: String
290+
- name: supportedEnforcementModes
291+
type: Array
292+
description: The supported enforcement mode of the cloud control. Default is DETECTIVE.
293+
output: true
294+
item_type:
295+
type: String
296+
- name: supportedTargetResourceTypes
297+
type: Array
298+
description: target resource types supported by the CloudControl.
299+
output: true
300+
item_type:
301+
type: String

‎mmv1/templates/terraform/encoders/cloudsecuritycompliance_cloudcontrol.go.tmpl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// Build the fullname for the CloudControl resource from the provided
2+
// organization, location and cloud_control_id fields and set it on the
3+
// API object that will be sent in the request.
4+
org, ok := d.Get("organization").(string)
5+
if !ok || org == "" {
6+
return nil, fmt.Errorf("organization is required and must be a non-empty string")
7+
}
8+
loc, ok := d.Get("location").(string)
9+
if !ok || loc == "" {
10+
return nil, fmt.Errorf("location is required and must be a non-empty string")
11+
}
12+
ccid, ok := d.Get("cloud_control_id").(string)
13+
if !ok || ccid == "" {
14+
return nil, fmt.Errorf("cloud_control_id is required and must be a non-empty string")
15+
}
16+
// Compose the resource name in the expected API format.
17+
name := fmt.Sprintf("organizations/%s/locations/%s/cloudControls/%s", org, loc, ccid)
18+
obj["name"] = name
19+
return obj, nil

0 commit comments

Comments
 (0)