Skip to content

Commit 084d79f

Browse files
nick-benoitnick-benoit
committed
Add kibana security list
1 parent 2d6c2ef commit 084d79f

File tree

21 files changed

+1009
-2
lines changed

21 files changed

+1009
-2
lines changed

‎docs/resources/kibana_security_exception_item.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,13 +126,13 @@ resource "elasticstack_kibana_security_exception_item" "complex_entry" {
126126
Required:
127127

128128
- `field` (String) The field name. Required for all entry types.
129-
- `operator` (String) The operator to use. Valid values: `included`, `excluded`.
130129
- `type` (String) The type of entry. Valid values: `match`, `match_any`, `list`, `exists`, `nested`, `wildcard`.
131130

132131
Optional:
133132

134133
- `entries` (Attributes List) Nested entries (for `nested` type). Only `match`, `match_any`, and `exists` entry types are allowed as nested entries. (see [below for nested schema](#nestedatt--entries--entries))
135134
- `list` (Attributes) Value list reference (for `list` type). (see [below for nested schema](#nestedatt--entries--list))
135+
- `operator` (String) The operator to use. Valid values: `included`, `excluded`. Note: The operator field is not supported for nested entry types and will be ignored if specified.
136136
- `value` (String) The value to match (for `match` and `wildcard` types).
137137
- `values` (List of String) Array of values to match (for `match_any` type).
138138

‎docs/resources/kibana_security_list_item.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "elasticstack_kibana_security_list_item Resource - terraform-provider-elasticstack"
4+
subcategory: "Kibana"
5+
description: |-
6+
subcategory: "Kibana"
7+
layout: ""
8+
page_title: "Elasticstack: elasticstack_kibana_security_list_item Resource"
9+
description: |-
10+
Manages items within Kibana security value lists.
11+
Resource: elasticstack_kibana_security_list_item
12+
Manages items within Kibana security value lists. Value lists are containers for values that can be used within exception lists to define conditions. This resource allows you to add, update, and remove individual values (items) in those lists.
13+
Value list items are used to store data values that match the type of their parent security list (e.g., IP addresses, keywords, etc.). These items can then be referenced in exception list entries to define exception conditions.
14+
Example Usage
15+
16+
# First create a security list
17+
resource "elasticstack_kibana_security_list" "ip_list" {
18+
list_id = "allowed_ips"
19+
name = "Allowed IP Addresses"
20+
description = "List of IP addresses that are allowed"
21+
type = "ip"
22+
}
23+
24+
# Add an IP address to the list
25+
resource "elasticstack_kibana_security_list_item" "ip_item_1" {
26+
list_id = elasticstack_kibana_security_list.ip_list.list_id
27+
value = "192.168.1.1"
28+
}
29+
30+
# Add another IP address
31+
resource "elasticstack_kibana_security_list_item" "ip_item_2" {
32+
list_id = elasticstack_kibana_security_list.ip_list.list_id
33+
value = "10.0.0.1"
34+
}
35+
36+
# Add a keyword item with metadata
37+
resource "elasticstack_kibana_security_list" "keyword_list" {
38+
list_id = "allowed_domains"
39+
name = "Allowed Domains"
40+
description = "List of domains that are allowed"
41+
type = "keyword"
42+
}
43+
44+
resource "elasticstack_kibana_security_list_item" "domain_item" {
45+
list_id = elasticstack_kibana_security_list.keyword_list.list_id
46+
value = "example.com"
47+
meta = jsonencode({
48+
note = "Primary corporate domain"
49+
})
50+
}
51+
52+
Note on Space Support
53+
Important: The generated Kibana API client does not currently support space_id for list item operations. While the space_id attribute is available in the schema for future compatibility, list items currently operate in the default space only. This is a known limitation that will be addressed in a future update when the API client is regenerated with proper space support.
54+
---
55+
56+
# elasticstack_kibana_security_list_item (Resource)
57+
58+
---
59+
subcategory: "Kibana"
60+
layout: ""
61+
page_title: "Elasticstack: elasticstack_kibana_security_list_item Resource"
62+
description: |-
63+
Manages items within Kibana security value lists.
64+
---
65+
66+
# Resource: elasticstack_kibana_security_list_item
67+
68+
Manages items within Kibana security value lists. Value lists are containers for values that can be used within exception lists to define conditions. This resource allows you to add, update, and remove individual values (items) in those lists.
69+
70+
Value list items are used to store data values that match the type of their parent security list (e.g., IP addresses, keywords, etc.). These items can then be referenced in exception list entries to define exception conditions.
71+
72+
## Example Usage
73+
74+
```terraform
75+
# First create a security list
76+
resource "elasticstack_kibana_security_list" "ip_list" {
77+
list_id = "allowed_ips"
78+
name = "Allowed IP Addresses"
79+
description = "List of IP addresses that are allowed"
80+
type = "ip"
81+
}
82+
83+
# Add an IP address to the list
84+
resource "elasticstack_kibana_security_list_item" "ip_item_1" {
85+
list_id = elasticstack_kibana_security_list.ip_list.list_id
86+
value = "192.168.1.1"
87+
}
88+
89+
# Add another IP address
90+
resource "elasticstack_kibana_security_list_item" "ip_item_2" {
91+
list_id = elasticstack_kibana_security_list.ip_list.list_id
92+
value = "10.0.0.1"
93+
}
94+
95+
# Add a keyword item with metadata
96+
resource "elasticstack_kibana_security_list" "keyword_list" {
97+
list_id = "allowed_domains"
98+
name = "Allowed Domains"
99+
description = "List of domains that are allowed"
100+
type = "keyword"
101+
}
102+
103+
resource "elasticstack_kibana_security_list_item" "domain_item" {
104+
list_id = elasticstack_kibana_security_list.keyword_list.list_id
105+
value = "example.com"
106+
meta = jsonencode({
107+
note = "Primary corporate domain"
108+
})
109+
}
110+
```
111+
112+
## Note on Space Support
113+
114+
**Important**: The generated Kibana API client does not currently support space_id for list item operations. While the `space_id` attribute is available in the schema for future compatibility, list items currently operate in the default space only. This is a known limitation that will be addressed in a future update when the API client is regenerated with proper space support.
115+
116+
## Example Usage
117+
118+
### Basic keyword value
119+
120+
```terraform
121+
# First create a security list
122+
resource "elasticstack_kibana_security_list" "my_list" {
123+
list_id = "allowed_domains"
124+
name = "Allowed Domains"
125+
description = "List of allowed domains"
126+
type = "keyword"
127+
}
128+
129+
# Add an item to the list
130+
resource "elasticstack_kibana_security_list_item" "domain_example" {
131+
list_id = elasticstack_kibana_security_list.my_list.list_id
132+
value = "example.com"
133+
}
134+
```
135+
136+
### IP address value
137+
138+
```terraform
139+
# First create an IP address list
140+
resource "elasticstack_kibana_security_list" "ip_list" {
141+
list_id = "allowed_ips"
142+
name = "Allowed IP Addresses"
143+
description = "List of allowed IP addresses"
144+
type = "ip"
145+
}
146+
147+
# Add an IP address to the list
148+
resource "elasticstack_kibana_security_list_item" "ip_example" {
149+
list_id = elasticstack_kibana_security_list.ip_list.list_id
150+
value = "192.168.1.1"
151+
}
152+
```
153+
154+
### Value with metadata
155+
156+
```terraform
157+
# First create a security list
158+
resource "elasticstack_kibana_security_list" "tagged_domains" {
159+
list_id = "tagged_domains"
160+
name = "Tagged Domains"
161+
description = "Domains with associated metadata"
162+
type = "keyword"
163+
}
164+
165+
# Add an item with metadata
166+
resource "elasticstack_kibana_security_list_item" "domain_with_meta" {
167+
list_id = elasticstack_kibana_security_list.tagged_domains.list_id
168+
value = "internal.example.com"
169+
meta = jsonencode({
170+
category = "internal"
171+
owner = "infrastructure-team"
172+
note = "Primary internal domain"
173+
})
174+
}
175+
```
176+
177+
<!-- schema generated by tfplugindocs -->
178+
## Schema
179+
180+
### Required
181+
182+
- `list_id` (String) The value list's identifier that this item belongs to.
183+
- `value` (String) The value used to evaluate exceptions. The value's data type must match the list's type.
184+
185+
### Optional
186+
187+
- `id` (String) The value list item's identifier (auto-generated by Kibana if not specified).
188+
- `meta` (String) Placeholder for metadata about the value list item as JSON string.
189+
- `space_id` (String) An identifier for the space. If space_id is not provided, the default space is used.
190+
191+
### Read-Only
192+
193+
- `created_at` (String) The timestamp of when the list item was created.
194+
- `created_by` (String) The user who created the list item.
195+
- `updated_at` (String) The timestamp of when the list item was last updated.
196+
- `updated_by` (String) The user who last updated the list item.
197+
- `version` (String) The version id, normally returned by the API when the document is retrieved. Used to ensure updates are done against the latest version.

‎examples/resources/elasticstack_kibana_security_list_item/resource.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# First create a security list
2+
resource "elasticstack_kibana_security_list" "my_list" {
3+
list_id = "allowed_domains"
4+
name = "Allowed Domains"
5+
description = "List of allowed domains"
6+
type = "keyword"
7+
}
8+
9+
# Add an item to the list
10+
resource "elasticstack_kibana_security_list_item" "domain_example" {
11+
list_id = elasticstack_kibana_security_list.my_list.list_id
12+
value = "example.com"
13+
}

‎examples/resources/elasticstack_kibana_security_list_item/resource_ip.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# First create an IP address list
2+
resource "elasticstack_kibana_security_list" "ip_list" {
3+
list_id = "allowed_ips"
4+
name = "Allowed IP Addresses"
5+
description = "List of allowed IP addresses"
6+
type = "ip"
7+
}
8+
9+
# Add an IP address to the list
10+
resource "elasticstack_kibana_security_list_item" "ip_example" {
11+
list_id = elasticstack_kibana_security_list.ip_list.list_id
12+
value = "192.168.1.1"
13+
}

‎examples/resources/elasticstack_kibana_security_list_item/resource_with_meta.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# First create a security list
2+
resource "elasticstack_kibana_security_list" "tagged_domains" {
3+
list_id = "tagged_domains"
4+
name = "Tagged Domains"
5+
description = "Domains with associated metadata"
6+
type = "keyword"
7+
}
8+
9+
# Add an item with metadata
10+
resource "elasticstack_kibana_security_list_item" "domain_with_meta" {
11+
list_id = elasticstack_kibana_security_list.tagged_domains.list_id
12+
value = "internal.example.com"
13+
meta = jsonencode({
14+
category = "internal"
15+
owner = "infrastructure-team"
16+
note = "Primary internal domain"
17+
})
18+
}

‎internal/clients/kibana_oapi/security_lists.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,3 +88,75 @@ func DeleteList(ctx context.Context, client *Client, spaceId string, params *kba
8888
return reportUnknownError(resp.StatusCode(), resp.Body)
8989
}
9090
}
91+
92+
// GetListItem reads a security list item from the API by ID or list_id and value
93+
// Note: The generated Kibana API client does not support space_id for list items yet,
94+
// so this function operates in the default space only.
95+
func GetListItem(ctx context.Context, client *Client, params *kbapi.ReadListItemParams) (*kbapi.ReadListItemResponse, diag.Diagnostics) {
96+
resp, err := client.API.ReadListItemWithResponse(ctx, params)
97+
if err != nil {
98+
return nil, diagutil.FrameworkDiagFromError(err)
99+
}
100+
101+
switch resp.StatusCode() {
102+
case http.StatusOK:
103+
return resp, nil
104+
case http.StatusNotFound:
105+
return nil, nil
106+
default:
107+
return nil, reportUnknownError(resp.StatusCode(), resp.Body)
108+
}
109+
}
110+
111+
// CreateListItem creates a new security list item.
112+
// Note: The generated Kibana API client does not support space_id for list items yet,
113+
// so this function operates in the default space only.
114+
func CreateListItem(ctx context.Context, client *Client, body kbapi.CreateListItemJSONRequestBody) (*kbapi.CreateListItemResponse, diag.Diagnostics) {
115+
resp, err := client.API.CreateListItemWithResponse(ctx, body)
116+
if err != nil {
117+
return nil, diagutil.FrameworkDiagFromError(err)
118+
}
119+
120+
switch resp.StatusCode() {
121+
case http.StatusOK:
122+
return resp, nil
123+
default:
124+
return nil, reportUnknownError(resp.StatusCode(), resp.Body)
125+
}
126+
}
127+
128+
// UpdateListItem updates an existing security list item.
129+
// Note: The generated Kibana API client does not support space_id for list items yet,
130+
// so this function operates in the default space only.
131+
func UpdateListItem(ctx context.Context, client *Client, body kbapi.UpdateListItemJSONRequestBody) (*kbapi.UpdateListItemResponse, diag.Diagnostics) {
132+
resp, err := client.API.UpdateListItemWithResponse(ctx, body)
133+
if err != nil {
134+
return nil, diagutil.FrameworkDiagFromError(err)
135+
}
136+
137+
switch resp.StatusCode() {
138+
case http.StatusOK:
139+
return resp, nil
140+
default:
141+
return nil, reportUnknownError(resp.StatusCode(), resp.Body)
142+
}
143+
}
144+
145+
// DeleteListItem deletes an existing security list item.
146+
// Note: The generated Kibana API client does not support space_id for list items yet,
147+
// so this function operates in the default space only.
148+
func DeleteListItem(ctx context.Context, client *Client, params *kbapi.DeleteListItemParams) diag.Diagnostics {
149+
resp, err := client.API.DeleteListItemWithResponse(ctx, params)
150+
if err != nil {
151+
return diagutil.FrameworkDiagFromError(err)
152+
}
153+
154+
switch resp.StatusCode() {
155+
case http.StatusOK:
156+
return nil
157+
case http.StatusNotFound:
158+
return nil
159+
default:
160+
return reportUnknownError(resp.StatusCode(), resp.Body)
161+
}
162+
}

‎internal/kibana/security/exception_item/acc_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ func TestAccResourceExceptionItemEntryType_List(t *testing.T) {
199199
exceptionListID := fmt.Sprintf("test-exception-list-list-entry-%s", uuid.New().String()[:8])
200200
itemID := fmt.Sprintf("test-exception-item-list-entry-%s", uuid.New().String()[:8])
201201
valueListID := fmt.Sprintf("test-value-list-%s", uuid.New().String()[:8])
202+
valueListValue := "192.168.1.1"
202203

203204
resource.Test(t, resource.TestCase{
204205
PreCheck: func() { acctest.PreCheck(t) },
@@ -211,6 +212,7 @@ func TestAccResourceExceptionItemEntryType_List(t *testing.T) {
211212
"exception_list_id": config.StringVariable(exceptionListID),
212213
"item_id": config.StringVariable(itemID),
213214
"value_list_id": config.StringVariable(valueListID),
215+
"value_list_value": config.StringVariable(valueListValue),
214216
},
215217
Check: resource.ComposeTestCheckFunc(
216218
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "entries.0.type", "list"),

‎internal/kibana/security/exception_item/testdata/TestAccResourceExceptionItemEntryType_List/list/exception_item.tf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ variable "value_list_id" {
1212
description = "The value list ID"
1313
type = string
1414
}
15+
variable "value_list_value" {
16+
description = "The value list value"
17+
type = string
18+
}
1519

1620
provider "elasticstack" {
1721
elasticsearch {}
@@ -25,14 +29,17 @@ resource "elasticstack_kibana_security_exception_list" "test" {
2529
type = "detection"
2630
namespace_type = "single"
2731
}
32+
resource "elasticstack_kibana_security_list_item" "test-item" {
33+
list_id = elasticstack_kibana_security_list.test.list_id
34+
value = var.value_list_value
35+
}
2836

2937
# Create a value list to reference in the exception item
3038
resource "elasticstack_kibana_security_list" "test" {
3139
list_id = var.value_list_id
3240
name = "Test Value List"
3341
description = "Test value list for list entry type"
3442
type = "ip"
35-
# values = ["192.168.1.1", "192.168.1.2", "10.0.0.1"]
3643
}
3744

3845
resource "elasticstack_kibana_security_exception_item" "test" {

0 commit comments

Comments
 (0)