feat: add V2 feed support

[b3ngriffiths]

Note

Claude Code Implementation: This PR was developed using Claude Code, which implemented new Chronicle V2 feed resources with complete CRUD operations, comprehensive test coverage including unit tests and acceptance tests for all feed types, and proper schema validation following Terraform provider best practices. All code was iteratively reviewed and refined through Claude Code's autonomous feedback loop, with particular attention to authentication handling, state management, and error scenarios, before final human review as part of this PR.

Summary

This PR implements support for Chronicle's GA-released V2 feed connectors, which use Google Cloud Storage Transfer Service for improved performance and reliability.

Release Notes: https://docs.cloud.google.com/chronicle/docs/secops/release-notes#January_30_2026

New Resources

• chronicle_feed_amazon_s3_v2 - S3 bucket ingestion via STS
• chronicle_feed_amazon_sqs_v2 - SQS-based push ingestion from S3
• chronicle_feed_google_cloud_storage_v2 - GCS bucket ingestion via STS
• chronicle_feed_google_cloud_storage_event_driven - Event-driven GCS ingestion
• chronicle_feed_azure_blobstore_v2 - Azure Blob Storage ingestion via STS

Key Features

• Modern Authentication: Support for federated authentication (AWS IAM roles, Azure Workload Identity, GCP service accounts)
• Enhanced Control: Configurable source deletion options and lookback periods (1-180 days)
• Resource Tagging: Namespace and labels support for asset correlation and organization
• API Compliance: All implementations match Chronicle Feed Management API GA specifications

Quick Examples

AWS S3 V2 with IAM Role:

resource "chronicle_feed_amazon_s3_v2" "example" {
  display_name = "AWS S3 V2 Feed"
  log_type     = "AWS_CLOUDTRAIL"
  
  details {
    s3_uri                = "s3://my-logs/cloudtrail/"
    source_delete_options = "ON_SUCCESS"
    
    authentication {
      aws_iam_role_arn = "arn:aws:iam::123456789012:role/chronicle-role"
    }
  }
}

Important Notes

• V2 feeds require appropriate IAM permissions for cross-cloud access
• Federated authentication is recommended for production environments
• See examples/resources/ for complete configuration examples
• All feeds include comprehensive acceptance tests

References

• Chronicle Feed Management API
• Google Cloud Storage Transfer Service
• Existing V1 Implementation
• Provider Schema

[ben-f3]

Acceptance Test Report – Terraform Provider Chronicle (V1 & V2)

Test Scope:
Acceptance testing of Chronicle Terraform provider feeds using make testacc-v1 and make testacc-v2, including runs with real credentials and real source details.

V1 Feed Tests (make testacc-v1)

Result: ✅ Pass

• All V1 acceptance tests completed successfully.
• Create, update, import, and destroy behaviour aligns with expectations.
• Authentication fields are intentionally excluded from import verification due to API non-round-tripping.
• Test harness behaviour is well understood and stable.
• Confirms V1 provider implementation is correct and production-ready.

V2 Feed Tests (make testacc-v2)

Result: ✅ Functionally Correct; Test Harness Limitations Observed

• With real credentials and valid source configuration:
  • V2 feeds were successfully created and updated.
  • Confirms correct request schema, authentication handling, and live Chronicle API interaction.
• Observed failures relate to acceptance test mechanics, not provider functionality:
  • ImportStateVerify differences for optional authentication fields (e.g. aws_iam_role_arn) that are not returned by the API.
  • Post-test destroy warnings caused by simplistic state-based destroy checks rather than API verification.
• These behaviours are consistent with existing V1 test patterns and reflect known limitations of the test framework rather than issues in the V2 implementation.

Conclusion

• V1 remains the proven baseline with stable acceptance coverage.
• V2 implementation is functionally sound and behaves consistently with V1 when interacting with the live Chronicle service.
• Acceptance testing confirms that V2 feeds are correctly created and managed by the API.
• Remaining test failures are attributable to expected import and teardown semantics, not defects in provider logic.

Overall: Acceptance testing is complete and effective. The V2 Terraform implementation is working as intended and aligns with established V1 behaviour.

[markhowardform3]

Could you commit the docs - make docs should generate them.