Skip to content

Commit ec3ae65

Browse files
dstephens5dstephens5
committed
SUMO-196857: fixing merge conflicts
2 parents a5af0cc + b5e9830 commit ec3ae65

File tree

4 files changed

+367
-3
lines changed

4 files changed

+367
-3
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ FEATURES:
44
* **New Resource:** sumologic_cse_inventory_entity_group_configuration (GH-376)
55
* Add new optional `notification_group_fields` field to resource/sumologic_monitor (GH-390)
66

7+
* Add new optional `obj_permission` set to resource/sumologic_monitor for Fine Grain Permission (FGP) support (GH-397)
8+
79
## 2.16.2 (June 12, 2022)
810

911
BUG FIXES:

‎sumologic/resource_sumologic_monitors_library_monitor.go‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,7 @@ func resourceSumologicMonitorsLibraryMonitor() *schema.Resource {
360360
Type: schema.TypeString,
361361
},
362362
},
363+
"obj_permission": GetCmfFgpObjPermSetSchema(),
363364
},
364365
}
365366
}
@@ -576,6 +577,16 @@ func resourceSumologicMonitorsLibraryMonitorCreate(d *schema.ResourceData, meta
576577
return err
577578
}
578579

580+
permStmts, convErr := ResourceToCmfFgpPermStmts(d, monitorDefinitionID)
581+
if convErr != nil {
582+
return convErr
583+
}
584+
_, fgpErr := c.SetCmfFgp(fgpTargetType, CmfFgpRequest{
585+
PermissionStatements: permStmts,
586+
})
587+
if fgpErr != nil {
588+
return fgpErr
589+
}
579590
d.SetId(monitorDefinitionID)
580591
}
581592
return resourceSumologicMonitorsLibraryMonitorRead(d, meta)
@@ -595,6 +606,18 @@ func resourceSumologicMonitorsLibraryMonitorRead(d *schema.ResourceData, meta in
595606
return nil
596607
}
597608

609+
fgpResponse, fgpErr := c.GetCmfFgp(fgpTargetType, monitor.ID)
610+
if fgpErr != nil {
611+
suppressedErrorCode := HasErrorCode(fgpErr.Error(), []string{"not_implemented_yet", "api_not_enabled"})
612+
if suppressedErrorCode == "" {
613+
return fgpErr
614+
} else {
615+
log.Printf("[WARN] FGP Feature has not been enabled yet. Suppressing \"%s\" error under GetCmfFgp operation.", suppressedErrorCode)
616+
}
617+
} else {
618+
CmfFgpPermStmtsSetToResource(d, fgpResponse.PermissionStatements)
619+
}
620+
598621
d.Set("created_by", monitor.CreatedBy)
599622
d.Set("created_at", monitor.CreatedAt)
600623
d.Set("monitor_type", monitor.MonitorType)
@@ -723,6 +746,43 @@ func resourceSumologicMonitorsLibraryMonitorUpdate(d *schema.ResourceData, meta
723746
if err != nil {
724747
return err
725748
}
749+
750+
// converting Resource FGP to Struct
751+
permStmts, convErr := ResourceToCmfFgpPermStmts(d, monitor.ID)
752+
if convErr != nil {
753+
return convErr
754+
}
755+
756+
// reading FGP from Backend to reconcile
757+
fgpGetResponse, fgpGetErr := c.GetCmfFgp(fgpTargetType, monitor.ID)
758+
if fgpGetErr != nil {
759+
/*
760+
|errCode | len | logic |
761+
|--------------------------------------------------|
762+
|server_error | 0 | return err at Get |
763+
|server_error | 1 | warn; return err at Set |
764+
|not_enabled | 0 | warn |
765+
|not_enabled | 1 | warn; return err at Set |
766+
*/
767+
suppressedErrorCode := HasErrorCode(fgpGetErr.Error(), []string{"not_implemented_yet", "api_not_enabled"})
768+
if suppressedErrorCode == "" && len(permStmts) == 0 {
769+
return fgpGetErr
770+
} else {
771+
log.Printf("[WARN] FGP Feature has not been enabled yet. Suppressing \"%s\" error under GetCmfFgp operation.", suppressedErrorCode)
772+
}
773+
}
774+
775+
if len(permStmts) > 0 || fgpGetResponse != nil {
776+
_, fgpSetErr := c.SetCmfFgp(fgpTargetType, CmfFgpRequest{
777+
PermissionStatements: ReconcileFgpPermStmtsWithEmptyPerms(
778+
permStmts, fgpGetResponse.PermissionStatements,
779+
),
780+
})
781+
if fgpSetErr != nil {
782+
return fgpSetErr
783+
}
784+
}
785+
726786
updatedMonitor := resourceSumologicMonitorsLibraryMonitorRead(d, meta)
727787

728788
return updatedMonitor

‎sumologic/resource_sumologic_monitors_library_monitor_test.go‎

Lines changed: 261 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,8 @@ func TestAccSumologicMonitorsLibraryMonitor_create(t *testing.T) {
215215
resource.TestCheckResourceAttr("sumologic_monitor.test", "alert_name", testAlertName),
216216
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.0", testGroupFields[0]),
217217
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.1", testGroupFields[1]),
218+
resource.TestCheckResourceAttr("sumologic_monitor.test", "obj_permission.#", "2"),
219+
testAccCheckMonitorsLibraryMonitorFGPBackend("sumologic_monitor.test", t, genExpectedPermStmtsMonitor),
218220
),
219221
},
220222
},
@@ -397,6 +399,8 @@ func TestAccSumologicMonitorsLibraryMonitor_update(t *testing.T) {
397399
resource.TestCheckResourceAttr("sumologic_monitor.test", "alert_name", testAlertName),
398400
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.0", testGroupFields[0]),
399401
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.1", testGroupFields[1]),
402+
resource.TestCheckResourceAttr("sumologic_monitor.test", "obj_permission.#", "2"),
403+
testAccCheckMonitorsLibraryMonitorFGPBackend("sumologic_monitor.test", t, genExpectedPermStmtsMonitor),
400404
),
401405
},
402406
{
@@ -417,6 +421,61 @@ func TestAccSumologicMonitorsLibraryMonitor_update(t *testing.T) {
417421
resource.TestCheckResourceAttr("sumologic_monitor.test", "alert_name", testUpdatedAlertName),
418422
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.0", testUpdatedGroupFields[0]),
419423
resource.TestCheckResourceAttr("sumologic_monitor.test", "notification_group_fields.1", testUpdatedGroupFields[1]),
424+
resource.TestCheckResourceAttr("sumologic_monitor.test", "obj_permission.#", "1"),
425+
// 1, instead of 2
426+
testAccCheckMonitorsLibraryMonitorFGPBackend("sumologic_monitor.test", t, genExpectedPermStmtsForMonitorUpdate),
427+
),
428+
},
429+
},
430+
})
431+
}
432+
433+
func TestAccSumologicMonitorsLibraryMonitor_driftingCorrectionFGP(t *testing.T) {
434+
var monitorsLibraryMonitor MonitorsLibraryMonitor
435+
testNameSuffix := acctest.RandString(16)
436+
tfResourceKey := "sumologic_monitor.test"
437+
testName := "terraform_test_monitor_" + testNameSuffix
438+
439+
resource.Test(t, resource.TestCase{
440+
PreCheck: func() { testAccPreCheck(t) },
441+
Providers: testAccProviders,
442+
CheckDestroy: testAccCheckMonitorsLibraryMonitorDestroy(monitorsLibraryMonitor),
443+
Steps: []resource.TestStep{
444+
{
445+
Config: testAccSumologicMonitorsLibraryMonitor(testNameSuffix),
446+
Check: resource.ComposeTestCheckFunc(
447+
testAccCheckMonitorsLibraryMonitorExists(tfResourceKey, &monitorsLibraryMonitor, t),
448+
testAccCheckMonitorsLibraryMonitorAttributes(tfResourceKey),
449+
450+
resource.TestCheckResourceAttr("sumologic_monitor.test", "name", testName),
451+
resource.TestCheckResourceAttr("sumologic_monitor.test", "description",
452+
"terraform_test_monitor_description"),
453+
454+
resource.TestCheckResourceAttr("sumologic_monitor.test",
455+
"obj_permission.#", "2"),
456+
testAccCheckMonitorsLibraryMonitorFGPBackend(tfResourceKey, t, genExpectedPermStmtsMonitor),
457+
// Emulating Drifting at the Backend
458+
testAccEmulateFGPDriftingMonitor(t),
459+
),
460+
// "After applying this step and refreshing, the plan was not empty"
461+
// Non-Empty Plan would occur, after the above step that emulates FGP drifting
462+
ExpectNonEmptyPlan: true,
463+
},
464+
// the following Test Step emulates running "terraform apply" again.
465+
// This step would detect and correct Drifting
466+
{
467+
Config: testAccSumologicMonitorsLibraryMonitor(testNameSuffix),
468+
Check: resource.ComposeTestCheckFunc(
469+
testAccCheckMonitorsLibraryMonitorExists(tfResourceKey, &monitorsLibraryMonitor, t),
470+
testAccCheckMonitorsLibraryMonitorAttributes(tfResourceKey),
471+
472+
resource.TestCheckResourceAttr("sumologic_monitor.test", "name", testName),
473+
resource.TestCheckResourceAttr("sumologic_monitor.test", "description",
474+
"terraform_test_monitor_description"),
475+
476+
resource.TestCheckResourceAttr("sumologic_monitor.test",
477+
"obj_permission.#", "2"),
478+
testAccCheckMonitorsLibraryFolderFGPBackend(tfResourceKey, t, genExpectedPermStmtsMonitor),
420479
),
421480
},
422481
},
@@ -533,7 +592,44 @@ resource "sumologic_monitor" "test" {
533592
playbook = "This is a test playbook"
534593
alert_name = "Alert from {{Name}}"
535594
notification_group_fields = ["groupingField1", "groupingField2"]
536-
}`, testName)
595+
obj_permission {
596+
subject_type = "role"
597+
subject_id = sumologic_role.tf_test_role_01.id
598+
permissions = ["Read","Update","Delete"]
599+
}
600+
obj_permission {
601+
subject_type = "role"
602+
subject_id = sumologic_role.tf_test_role_02.id
603+
permissions = ["Read"]
604+
}
605+
}
606+
resource "sumologic_role" "tf_test_role_01" {
607+
name = "tf_test_role_01_%s"
608+
description = "Testing resource sumologic_role"
609+
capabilities = [
610+
"viewAlerts",
611+
"viewMonitorsV2",
612+
"manageMonitorsV2"
613+
]
614+
}
615+
resource "sumologic_role" "tf_test_role_02" {
616+
name = "tf_test_role_02_%s"
617+
description = "Testing resource sumologic_role"
618+
capabilities = [
619+
"viewAlerts",
620+
"viewMonitorsV2",
621+
"manageMonitorsV2"
622+
]
623+
}
624+
resource "sumologic_role" "tf_test_role_03" {
625+
name = "tf_test_role_03_%s"
626+
description = "Testing resource sumologic_role"
627+
capabilities = [
628+
"viewAlerts",
629+
"viewMonitorsV2",
630+
"manageMonitorsV2"
631+
]
632+
}`, testName, testName, testName, testName)
537633
}
538634

539635
func testAccSumologicMonitorsLibraryMonitorUpdate(testName string) string {
@@ -581,7 +677,92 @@ resource "sumologic_monitor" "test" {
581677
playbook = "This is an updated test playbook"
582678
alert_name = "Updated Alert from {{Name}}"
583679
notification_group_fields = ["groupingField3", "groupingField4"]
584-
}`, testName)
680+
obj_permission {
681+
subject_type = "role"
682+
subject_id = sumologic_role.tf_test_role_01.id
683+
permissions = ["Read","Update"]
684+
}
685+
}
686+
resource "sumologic_role" "tf_test_role_01" {
687+
name = "tf_test_role_01_%s"
688+
description = "Testing resource sumologic_role"
689+
capabilities = [
690+
"viewAlerts",
691+
"viewMonitorsV2",
692+
"manageMonitorsV2"
693+
]
694+
}`, testName, testName)
695+
}
696+
697+
func testAccEmulateFGPDriftingMonitor(
698+
t *testing.T,
699+
// expectedFGPFunc func(*terraform.State, string) ([]CmfFgpPermStatement, error),
700+
) resource.TestCheckFunc {
701+
702+
return func(s *terraform.State) error {
703+
704+
monitorTargetId, resIdErr := getResourceID(s, "sumologic_monitor.test")
705+
if resIdErr != nil {
706+
return resIdErr
707+
}
708+
role01Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_01")
709+
if resIdErr != nil {
710+
return resIdErr
711+
}
712+
role02Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_02")
713+
if resIdErr != nil {
714+
return resIdErr
715+
}
716+
role03Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_03")
717+
if resIdErr != nil {
718+
return resIdErr
719+
}
720+
721+
client := testAccProvider.Meta().(*Client)
722+
expectedReadPermStmts := []CmfFgpPermStatement{
723+
{SubjectType: "role", SubjectId: role01Id, TargetId: monitorTargetId,
724+
Permissions: []string{"Read", "Update"}},
725+
{SubjectType: "role", SubjectId: role03Id, TargetId: monitorTargetId,
726+
Permissions: []string{"Read"}},
727+
}
728+
// using an empty Permissions array to achieve the effect of FGP Revocation
729+
setFGPPermStmts := append(expectedReadPermStmts,
730+
CmfFgpPermStatement{SubjectType: "role", SubjectId: role02Id, TargetId: monitorTargetId,
731+
Permissions: []string{}})
732+
733+
_, setFgpErr := client.SetCmfFgp("monitors", CmfFgpRequest{
734+
PermissionStatements: setFGPPermStmts})
735+
if setFgpErr != nil {
736+
return setFgpErr
737+
}
738+
739+
readfgpResult, readFgpErr := client.GetCmfFgp("monitors", monitorTargetId)
740+
if readFgpErr != nil {
741+
return readFgpErr
742+
}
743+
744+
var expectedPermStmts []CmfFgpPermStatement
745+
expectedPermStmts = append(expectedPermStmts,
746+
CmfFgpPermStatement{
747+
SubjectId: role01Id,
748+
SubjectType: "role",
749+
TargetId: monitorTargetId,
750+
Permissions: []string{"Read", "Update"},
751+
},
752+
CmfFgpPermStatement{
753+
SubjectId: role03Id,
754+
SubjectType: "role",
755+
TargetId: monitorTargetId,
756+
Permissions: []string{"Read"},
757+
},
758+
)
759+
760+
if !CmfFgpPermStmtSetEqual(readfgpResult.PermissionStatements, expectedPermStmts) {
761+
return fmt.Errorf("Permission Statements are different:\n %+v\n %+v\n",
762+
readfgpResult.PermissionStatements, expectedPermStmts)
763+
}
764+
return nil
765+
}
585766
}
586767

587768
func exampleMonitorWithTriggerCondition(
@@ -811,3 +992,81 @@ func exampleMetricsMissingDataTriggerCondition(triggerType string) TriggerCondit
811992
DetectionMethod: "MetricsMissingDataCondition",
812993
}
813994
}
995+
996+
func genExpectedPermStmtsMonitor(s *terraform.State, targetId string) ([]CmfFgpPermStatement, error) {
997+
role01Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_01")
998+
if resIdErr != nil {
999+
return nil, resIdErr
1000+
}
1001+
role02Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_02")
1002+
if resIdErr != nil {
1003+
return nil, resIdErr
1004+
}
1005+
1006+
var expectedPermStmts []CmfFgpPermStatement
1007+
expectedPermStmts = append(expectedPermStmts,
1008+
CmfFgpPermStatement{
1009+
SubjectId: role01Id,
1010+
SubjectType: "role",
1011+
TargetId: targetId,
1012+
Permissions: []string{"Read", "Update", "Delete"},
1013+
},
1014+
CmfFgpPermStatement{
1015+
SubjectId: role02Id,
1016+
SubjectType: "role",
1017+
TargetId: targetId,
1018+
Permissions: []string{"Read"},
1019+
},
1020+
)
1021+
return expectedPermStmts, nil
1022+
}
1023+
1024+
func genExpectedPermStmtsForMonitorUpdate(s *terraform.State, targetId string) ([]CmfFgpPermStatement, error) {
1025+
role01Id, resIdErr := getResourceID(s, "sumologic_role.tf_test_role_01")
1026+
if resIdErr != nil {
1027+
return nil, resIdErr
1028+
}
1029+
1030+
var expectedPermStmts []CmfFgpPermStatement
1031+
expectedPermStmts = append(expectedPermStmts,
1032+
CmfFgpPermStatement{
1033+
SubjectId: role01Id,
1034+
SubjectType: "role",
1035+
TargetId: targetId,
1036+
Permissions: []string{"Read", "Update"},
1037+
},
1038+
)
1039+
return expectedPermStmts, nil
1040+
}
1041+
1042+
func testAccCheckMonitorsLibraryMonitorFGPBackend(
1043+
name string,
1044+
t *testing.T,
1045+
expectedFGPFunc func(*terraform.State, string) ([]CmfFgpPermStatement, error),
1046+
) resource.TestCheckFunc {
1047+
1048+
return func(s *terraform.State) error {
1049+
targetId, resIdErr := getResourceID(s, name)
1050+
if resIdErr != nil {
1051+
return resIdErr
1052+
}
1053+
1054+
expectedPermStmts, resIdErr := expectedFGPFunc(s, targetId)
1055+
if resIdErr != nil {
1056+
return resIdErr
1057+
}
1058+
1059+
client := testAccProvider.Meta().(*Client)
1060+
1061+
fgpResult, fgpErr := client.GetCmfFgp("monitors", targetId)
1062+
if fgpErr != nil {
1063+
return fgpErr
1064+
}
1065+
1066+
if !CmfFgpPermStmtSetEqual(fgpResult.PermissionStatements, expectedPermStmts) {
1067+
return fmt.Errorf("Permission Statements are different:\n %+v\n %+v\n",
1068+
fgpResult.PermissionStatements, expectedPermStmts)
1069+
}
1070+
return nil
1071+
}
1072+
}

0 commit comments

Comments
 (0)