Skip to content

Commit 2d7850b

Browse files
Copilotnick-benoit
Copilot
and
nick-benoit
committed
Add examples, documentation templates, and acceptance tests for exception resources
Co-authored-by: nick-benoit <[email protected]>
1 parent 8815af2 commit 2d7850b

File tree

10 files changed

+481
-0
lines changed

10 files changed

+481
-0
lines changed

‎docs/resources/kibana_security_exception_item.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,81 @@ resource "elasticstack_kibana_security_exception_item" "example" {
5858
}
5959
```
6060

61+
## Example Usage
62+
63+
### Basic exception item
64+
65+
```terraform
66+
resource "elasticstack_kibana_security_exception_list" "example" {
67+
list_id = "my-exception-list"
68+
name = "My Exception List"
69+
description = "List of exceptions for security rules"
70+
type = "detection"
71+
namespace_type = "single"
72+
73+
tags = ["security", "detections"]
74+
}
75+
76+
resource "elasticstack_kibana_security_exception_item" "example" {
77+
list_id = elasticstack_kibana_security_exception_list.example.list_id
78+
item_id = "my-exception-item"
79+
name = "My Exception Item"
80+
description = "Exclude specific processes from alerts"
81+
type = "simple"
82+
namespace_type = "single"
6183
84+
entries = jsonencode([
85+
{
86+
field = "process.name"
87+
operator = "included"
88+
type = "match"
89+
value = "trusted-process"
90+
}
91+
])
92+
93+
tags = ["trusted", "whitelisted"]
94+
}
95+
```
96+
97+
### Complex exception item with multiple entries
98+
99+
```terraform
100+
resource "elasticstack_kibana_security_exception_list" "example" {
101+
list_id = "my-exception-list"
102+
name = "My Exception List"
103+
description = "List of exceptions"
104+
type = "detection"
105+
namespace_type = "single"
106+
}
107+
108+
resource "elasticstack_kibana_security_exception_item" "complex_entry" {
109+
list_id = elasticstack_kibana_security_exception_list.example.list_id
110+
item_id = "complex-exception"
111+
name = "Complex Exception with Multiple Entries"
112+
description = "Exception with multiple conditions"
113+
type = "simple"
114+
namespace_type = "single"
115+
116+
# Multiple entries with different operators
117+
entries = jsonencode([
118+
{
119+
field = "host.name"
120+
operator = "included"
121+
type = "match"
122+
value = "trusted-host"
123+
},
124+
{
125+
field = "user.name"
126+
operator = "excluded"
127+
type = "match_any"
128+
value = ["admin", "root"]
129+
}
130+
])
131+
132+
os_types = ["linux"]
133+
tags = ["complex", "multi-condition"]
134+
}
135+
```
62136

63137
<!-- schema generated by tfplugindocs -->
64138
## Schema

‎docs/resources/kibana_security_exception_list.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,36 @@ resource "elasticstack_kibana_security_exception_list" "example" {
3838
}
3939
```
4040

41+
## Example Usage
42+
43+
### Basic exception list
44+
45+
```terraform
46+
resource "elasticstack_kibana_security_exception_list" "example" {
47+
list_id = "my-detection-exception-list"
48+
name = "My Detection Exception List"
49+
description = "List of exceptions for security detection rules"
50+
type = "detection"
51+
namespace_type = "single"
52+
53+
tags = ["security", "detections"]
54+
}
55+
```
4156

57+
### Endpoint exception list with OS types
58+
59+
```terraform
60+
resource "elasticstack_kibana_security_exception_list" "endpoint" {
61+
list_id = "my-endpoint-exception-list"
62+
name = "My Endpoint Exception List"
63+
description = "List of endpoint exceptions"
64+
type = "endpoint"
65+
namespace_type = "agnostic"
66+
67+
os_types = ["linux", "windows", "macos"]
68+
tags = ["endpoint", "security"]
69+
}
70+
```
4271

4372
<!-- schema generated by tfplugindocs -->
4473
## Schema

‎examples/resources/elasticstack_kibana_security_exception_item/resource.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
resource "elasticstack_kibana_security_exception_list" "example" {
2+
list_id = "my-exception-list"
3+
name = "My Exception List"
4+
description = "List of exceptions for security rules"
5+
type = "detection"
6+
namespace_type = "single"
7+
8+
tags = ["security", "detections"]
9+
}
10+
11+
resource "elasticstack_kibana_security_exception_item" "example" {
12+
list_id = elasticstack_kibana_security_exception_list.example.list_id
13+
item_id = "my-exception-item"
14+
name = "My Exception Item"
15+
description = "Exclude specific processes from alerts"
16+
type = "simple"
17+
namespace_type = "single"
18+
19+
entries = jsonencode([
20+
{
21+
field = "process.name"
22+
operator = "included"
23+
type = "match"
24+
value = "trusted-process"
25+
}
26+
])
27+
28+
tags = ["trusted", "whitelisted"]
29+
}

‎examples/resources/elasticstack_kibana_security_exception_item/resource_complex.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "elasticstack_kibana_security_exception_list" "example" {
2+
list_id = "my-exception-list"
3+
name = "My Exception List"
4+
description = "List of exceptions"
5+
type = "detection"
6+
namespace_type = "single"
7+
}
8+
9+
resource "elasticstack_kibana_security_exception_item" "complex_entry" {
10+
list_id = elasticstack_kibana_security_exception_list.example.list_id
11+
item_id = "complex-exception"
12+
name = "Complex Exception with Multiple Entries"
13+
description = "Exception with multiple conditions"
14+
type = "simple"
15+
namespace_type = "single"
16+
17+
# Multiple entries with different operators
18+
entries = jsonencode([
19+
{
20+
field = "host.name"
21+
operator = "included"
22+
type = "match"
23+
value = "trusted-host"
24+
},
25+
{
26+
field = "user.name"
27+
operator = "excluded"
28+
type = "match_any"
29+
value = ["admin", "root"]
30+
}
31+
])
32+
33+
os_types = ["linux"]
34+
tags = ["complex", "multi-condition"]
35+
}

‎examples/resources/elasticstack_kibana_security_exception_list/resource.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "elasticstack_kibana_security_exception_list" "example" {
2+
list_id = "my-detection-exception-list"
3+
name = "My Detection Exception List"
4+
description = "List of exceptions for security detection rules"
5+
type = "detection"
6+
namespace_type = "single"
7+
8+
tags = ["security", "detections"]
9+
}

‎examples/resources/elasticstack_kibana_security_exception_list/resource_endpoint.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "elasticstack_kibana_security_exception_list" "endpoint" {
2+
list_id = "my-endpoint-exception-list"
3+
name = "My Endpoint Exception List"
4+
description = "List of endpoint exceptions"
5+
type = "endpoint"
6+
namespace_type = "agnostic"
7+
8+
os_types = ["linux", "windows", "macos"]
9+
tags = ["endpoint", "security"]
10+
}

‎internal/kibana/security/exception_item/acc_test.go‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
package exception_item_test
2+
3+
import (
4+
"testing"
5+
6+
"github.com/elastic/terraform-provider-elasticstack/internal/acctest"
7+
"github.com/elastic/terraform-provider-elasticstack/internal/versionutils"
8+
"github.com/hashicorp/go-version"
9+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
10+
)
11+
12+
var minExceptionItemAPISupport = version.Must(version.NewVersion("7.9.0"))
13+
14+
func TestAccResourceExceptionItem(t *testing.T) {
15+
resource.Test(t, resource.TestCase{
16+
PreCheck: func() { acctest.PreCheck(t) },
17+
ProtoV6ProviderFactories: acctest.Providers,
18+
Steps: []resource.TestStep{
19+
{
20+
SkipFunc: versionutils.CheckIfVersionIsUnsupported(minExceptionItemAPISupport),
21+
Config: testAccResourceExceptionItemCreate,
22+
Check: resource.ComposeTestCheckFunc(
23+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "item_id", "test-exception-item"),
24+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "name", "Test Exception Item"),
25+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "description", "Test exception item for acceptance tests"),
26+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "type", "simple"),
27+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "namespace_type", "single"),
28+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "tags.0", "test"),
29+
resource.TestCheckResourceAttrSet("elasticstack_kibana_security_exception_item.test", "id"),
30+
resource.TestCheckResourceAttrSet("elasticstack_kibana_security_exception_item.test", "entries"),
31+
resource.TestCheckResourceAttrSet("elasticstack_kibana_security_exception_item.test", "created_at"),
32+
resource.TestCheckResourceAttrSet("elasticstack_kibana_security_exception_item.test", "created_by"),
33+
),
34+
},
35+
{
36+
SkipFunc: versionutils.CheckIfVersionIsUnsupported(minExceptionItemAPISupport),
37+
Config: testAccResourceExceptionItemUpdate,
38+
Check: resource.ComposeTestCheckFunc(
39+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "name", "Test Exception Item Updated"),
40+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "description", "Updated description"),
41+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "tags.0", "test"),
42+
resource.TestCheckResourceAttr("elasticstack_kibana_security_exception_item.test", "tags.1", "updated"),
43+
),
44+
},
45+
},
46+
})
47+
}
48+
49+
const testAccResourceExceptionItemCreate = `
50+
provider "elasticstack" {
51+
elasticsearch {}
52+
kibana {}
53+
}
54+
55+
resource "elasticstack_kibana_security_exception_list" "test" {
56+
list_id = "test-exception-list-for-item"
57+
name = "Test Exception List for Item"
58+
description = "Test exception list"
59+
type = "detection"
60+
namespace_type = "single"
61+
}
62+
63+
resource "elasticstack_kibana_security_exception_item" "test" {
64+
list_id = elasticstack_kibana_security_exception_list.test.list_id
65+
item_id = "test-exception-item"
66+
name = "Test Exception Item"
67+
description = "Test exception item for acceptance tests"
68+
type = "simple"
69+
namespace_type = "single"
70+
71+
entries = jsonencode([
72+
{
73+
field = "process.name"
74+
operator = "included"
75+
type = "match"
76+
value = "test-process"
77+
}
78+
])
79+
80+
tags = ["test"]
81+
}
82+
`
83+
84+
const testAccResourceExceptionItemUpdate = `
85+
provider "elasticstack" {
86+
elasticsearch {}
87+
kibana {}
88+
}
89+
90+
resource "elasticstack_kibana_security_exception_list" "test" {
91+
list_id = "test-exception-list-for-item"
92+
name = "Test Exception List for Item"
93+
description = "Test exception list"
94+
type = "detection"
95+
namespace_type = "single"
96+
}
97+
98+
resource "elasticstack_kibana_security_exception_item" "test" {
99+
list_id = elasticstack_kibana_security_exception_list.test.list_id
100+
item_id = "test-exception-item"
101+
name = "Test Exception Item Updated"
102+
description = "Updated description"
103+
type = "simple"
104+
namespace_type = "single"
105+
106+
entries = jsonencode([
107+
{
108+
field = "process.name"
109+
operator = "included"
110+
type = "match"
111+
value = "test-process-updated"
112+
}
113+
])
114+
115+
tags = ["test", "updated"]
116+
}
117+
`

0 commit comments

Comments
 (0)