Add security value list resource

Author: nick-benoit

docs/resources/kibana_security_list.md

@@ -0,0 +1,110 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "elasticstack_kibana_security_list Resource - terraform-provider-elasticstack"
+subcategory: "Kibana"
+description: |-
+  Manages Kibana security lists (also known as value lists). Security lists are used by exception items to define sets of values for matching or excluding in security rules.
+  Example Usage
+  
+  resource "elasticstack_kibana_security_list" "ip_list" {
+    space_id    = "default"
+    name        = "Trusted IP Addresses"
+    description = "List of trusted IP addresses for security rules"
+    type        = "ip"
+  }
+  
+  resource "elasticstack_kibana_security_list" "keyword_list" {
+    space_id    = "security"
+    list_id     = "custom-keywords"
+    name        = "Custom Keywords"
+    description = "Custom keyword list for detection rules"
+    type        = "keyword"
+  }
+  
+  Notes
+  Security lists define the type of data they can contain via the type attributeOnce created, the type of a list cannot be changedLists can be referenced by exception items to create more sophisticated matching rulesThe list_id is auto-generated if not provided
+---
+
+# elasticstack_kibana_security_list (Resource)
+
+Manages Kibana security lists (also known as value lists). Security lists are used by exception items to define sets of values for matching or excluding in security rules.
+
+## Example Usage
+
+```terraform
+resource "elasticstack_kibana_security_list" "ip_list" {
+  space_id    = "default"
+  name        = "Trusted IP Addresses"
+  description = "List of trusted IP addresses for security rules"
+  type        = "ip"
+}
+
+resource "elasticstack_kibana_security_list" "keyword_list" {
+  space_id    = "security"
+  list_id     = "custom-keywords"
+  name        = "Custom Keywords"
+  description = "Custom keyword list for detection rules"
+  type        = "keyword"
+}
+```
+
+## Notes
+
+- Security lists define the type of data they can contain via the `type` attribute
+- Once created, the `type` of a list cannot be changed
+- Lists can be referenced by exception items to create more sophisticated matching rules
+- The `list_id` is auto-generated if not provided
+
+## Example Usage
+
+### IP address list
+
+```terraform
+resource "elasticstack_kibana_security_list" "ip_list" {
+  space_id    = "default"
+  name        = "Trusted IP Addresses"
+  description = "List of trusted IP addresses for security rules"
+  type        = "ip"
+}
+```
+
+### Keyword list with custom list_id
+
+```terraform
+resource "elasticstack_kibana_security_list" "keyword_list" {
+  space_id    = "security"
+  list_id     = "custom-keywords"
+  name        = "Custom Keywords"
+  description = "Custom keyword list for detection rules"
+  type        = "keyword"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `description` (String) Describes the security list.
+- `name` (String) The name of the security list.
+- `type` (String) Specifies the Elasticsearch data type of values the list contains. Valid values include: `binary`, `boolean`, `byte`, `date`, `date_nanos`, `date_range`, `double`, `double_range`, `float`, `float_range`, `geo_point`, `geo_shape`, `half_float`, `integer`, `integer_range`, `ip`, `ip_range`, `keyword`, `long`, `long_range`, `shape`, `short`, `text`.
+
+### Optional
+
+- `deserializer` (String) Determines how retrieved list item values are presented. By default, list items are presented using Handlebars expressions based on the type.
+- `id` (String) The unique identifier of the security list (auto-generated by Kibana if not specified).
+- `list_id` (String) The value list's human-readable identifier.
+- `meta` (String) Placeholder for metadata about the value list as JSON string.
+- `serializer` (String) Determines how uploaded list item values are parsed. By default, list items are parsed using named regex groups based on the type.
+- `space_id` (String) An identifier for the space. If space_id is not provided, the default space is used.
+- `version` (Number) The document version number.
+
+### Read-Only
+
+- `created_at` (String) The timestamp of when the list was created.
+- `created_by` (String) The user who created the list.
+- `immutable` (Boolean) Whether the list is immutable.
+- `tie_breaker_id` (String) Field used in search to ensure all containers are sorted and returned correctly.
+- `updated_at` (String) The timestamp of when the list was last updated.
+- `updated_by` (String) The user who last updated the list.
+- `version_id` (String) The version id, normally returned by the API when the document is retrieved.

examples/resources/elasticstack_kibana_security_exception_item/resource.tf

@@ -16,14 +16,14 @@ resource "elasticstack_kibana_security_exception_item" "example" {
   type           = "simple"
   namespace_type = "single"
 
-  entries = jsonencode([
+  entries = [
     {
+      type     = "match"
       field    = "process.name"
       operator = "included"
-      type     = "match"
       value    = "trusted-process"
     }
-  ])
+  ]
 
   tags = ["trusted", "whitelisted"]
 }

examples/resources/elasticstack_kibana_security_exception_item/resource_complex.tf

@@ -15,20 +15,20 @@ resource "elasticstack_kibana_security_exception_item" "complex_entry" {
   namespace_type = "single"
 
   # Multiple entries with different operators
-  entries = jsonencode([
+  entries = [
     {
+      type     = "match"
       field    = "host.name"
       operator = "included"
-      type     = "match"
       value    = "trusted-host"
     },
     {
+      type     = "match_any"
       field    = "user.name"
       operator = "excluded"
-      type     = "match_any"
-      value    = ["admin", "root"]
+      values   = ["admin", "root"]
     }
-  ])
+  ]
 
   os_types = ["linux"]
   tags     = ["complex", "multi-condition"]

examples/resources/elasticstack_kibana_security_list/resource.tf

@@ -0,0 +1,6 @@
+resource "elasticstack_kibana_security_list" "ip_list" {
+  space_id    = "default"
+  name        = "Trusted IP Addresses"
+  description = "List of trusted IP addresses for security rules"
+  type        = "ip"
+}

examples/resources/elasticstack_kibana_security_list/resource_keyword.tf

@@ -0,0 +1,7 @@
+resource "elasticstack_kibana_security_list" "keyword_list" {
+  space_id    = "security"
+  list_id     = "custom-keywords"
+  name        = "Custom Keywords"
+  description = "Custom keyword list for detection rules"
+  type        = "keyword"
+}