Skip to content

Commit 7f7a750

Browse files
ewbankkitewbankkit
authored
Merge pull request #44515 from tabito-hara/f-aws_networkfirewall_logging_configuration-add_enable_monitoring_dashboard
[Enhancement]: aws_networkfirewall_logging_configuration: Add `enable_monitoring_dashboard` argument
2 parents a17a256 + 2e0cec0 commit 7f7a750

File tree

4 files changed

+188
-1
lines changed

4 files changed

+188
-1
lines changed

‎.changelog/44515.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/aws_networkfirewall_logging_configuration: Add `enable_monitoring_dashboard` argument
3+
```

‎internal/service/networkfirewall/logging_configuration.go‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,11 @@ func resourceLoggingConfiguration() *schema.Resource {
3838
},
3939

4040
Schema: map[string]*schema.Schema{
41+
"enable_monitoring_dashboard": {
42+
Type: schema.TypeBool,
43+
Optional: true,
44+
Computed: true,
45+
},
4146
"firewall_arn": {
4247
Type: schema.TypeString,
4348
Required: true,
@@ -114,6 +119,19 @@ func resourceLoggingConfigurationCreate(ctx context.Context, d *schema.ResourceD
114119

115120
firewallARN := d.Get("firewall_arn").(string)
116121

122+
if v := d.Get("enable_monitoring_dashboard"); v != nil {
123+
input := &networkfirewall.UpdateLoggingConfigurationInput{
124+
FirewallArn: aws.String(firewallARN),
125+
EnableMonitoringDashboard: aws.Bool(v.(bool)),
126+
}
127+
128+
_, err := conn.UpdateLoggingConfiguration(ctx, input)
129+
130+
if err != nil {
131+
return sdkdiag.AppendFromErr(diags, err)
132+
}
133+
}
134+
117135
if v, ok := d.GetOk(names.AttrLoggingConfiguration); ok && len(v.([]any)) > 0 && v.([]any)[0] != nil {
118136
tfMap := v.([]any)[0].(map[string]any)
119137

@@ -145,6 +163,7 @@ func resourceLoggingConfigurationRead(ctx context.Context, d *schema.ResourceDat
145163
return sdkdiag.AppendErrorf(diags, "reading NetworkFirewall Logging Configuration (%s): %s", d.Id(), err)
146164
}
147165

166+
d.Set("enable_monitoring_dashboard", output.EnableMonitoringDashboard)
148167
d.Set("firewall_arn", output.FirewallArn)
149168
if err := d.Set(names.AttrLoggingConfiguration, flattenLoggingConfiguration(output.LoggingConfiguration)); err != nil {
150169
return sdkdiag.AppendErrorf(diags, "setting logging_configuration: %s", err)
@@ -165,12 +184,32 @@ func resourceLoggingConfigurationUpdate(ctx context.Context, d *schema.ResourceD
165184

166185
o, n := d.GetChange("logging_configuration.0.log_destination_config")
167186
os, ns := o.(*schema.Set), n.(*schema.Set)
168-
add, del := ns.Difference(os), os.Difference(ns)
187+
188+
var add, del *schema.Set
189+
// To change enable_monitoring_dashboard, all log_destination_config must first be removed.
190+
// Then enable_monitoring_dashboard can be changed, followed by adding log_destination_config back.
191+
if d.HasChanges("enable_monitoring_dashboard") {
192+
add, del = ns, os
193+
} else {
194+
add, del = ns.Difference(os), os.Difference(ns)
195+
}
169196

170197
if err := deleteLogDestinationConfigs(ctx, conn, d.Id(), output.LoggingConfiguration, expandLogDestinationConfigs(del.List())); err != nil {
171198
return sdkdiag.AppendFromErr(diags, err)
172199
}
173200

201+
if d.HasChanges("enable_monitoring_dashboard") {
202+
input := &networkfirewall.UpdateLoggingConfigurationInput{
203+
FirewallArn: output.FirewallArn,
204+
EnableMonitoringDashboard: aws.Bool(d.Get("enable_monitoring_dashboard").(bool)),
205+
}
206+
_, err := conn.UpdateLoggingConfiguration(ctx, input)
207+
208+
if err != nil {
209+
return sdkdiag.AppendFromErr(diags, err)
210+
}
211+
}
212+
174213
if err := addLogDestinationConfigs(ctx, conn, d.Id(), output.LoggingConfiguration, expandLogDestinationConfigs(add.List())); err != nil {
175214
return sdkdiag.AppendFromErr(diags, err)
176215
}

‎internal/service/networkfirewall/logging_configuration_test.go‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ func TestAccNetworkFirewallLoggingConfiguration_CloudWatchLogDestination_logGrou
3636
Config: testAccLoggingConfigurationConfig_cloudWatch(logGroupName, rName, string(awstypes.LogDestinationTypeCloudwatchLogs), string(awstypes.LogTypeFlow)),
3737
Check: resource.ComposeTestCheckFunc(
3838
testAccCheckLoggingConfigurationExists(ctx, resourceName),
39+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtFalse),
3940
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
4041
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "1"),
4142
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
@@ -49,6 +50,7 @@ func TestAccNetworkFirewallLoggingConfiguration_CloudWatchLogDestination_logGrou
4950
Config: testAccLoggingConfigurationConfig_cloudWatch(updatedLogGroupName, rName, string(awstypes.LogDestinationTypeCloudwatchLogs), string(awstypes.LogTypeFlow)),
5051
Check: resource.ComposeTestCheckFunc(
5152
testAccCheckLoggingConfigurationExists(ctx, resourceName),
53+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtFalse),
5254
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
5355
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "1"),
5456
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
@@ -62,6 +64,7 @@ func TestAccNetworkFirewallLoggingConfiguration_CloudWatchLogDestination_logGrou
6264
Config: testAccLoggingConfigurationConfig_cloudWatch(updatedLogGroupName, rName, string(awstypes.LogDestinationTypeCloudwatchLogs), string(awstypes.LogTypeTls)),
6365
Check: resource.ComposeTestCheckFunc(
6466
testAccCheckLoggingConfigurationExists(ctx, resourceName),
67+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtFalse),
6568
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
6669
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "1"),
6770
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
@@ -742,6 +745,115 @@ func TestAccNetworkFirewallLoggingConfiguration_updateToSingleTLSTypeLogDestinat
742745
})
743746
}
744747

748+
func TestAccNetworkFirewallLoggingConfiguration_enableMonitoringDashboard(t *testing.T) {
749+
ctx := acctest.Context(t)
750+
bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
751+
logGroupName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
752+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
753+
resourceName := "aws_networkfirewall_logging_configuration.test"
754+
755+
resource.ParallelTest(t, resource.TestCase{
756+
PreCheck: func() { acctest.PreCheck(ctx, t); testAccPreCheck(ctx, t) },
757+
ErrorCheck: acctest.ErrorCheck(t, names.NetworkFirewallServiceID),
758+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
759+
CheckDestroy: testAccCheckLoggingConfigurationDestroy(ctx),
760+
Steps: []resource.TestStep{
761+
{
762+
Config: testAccLoggingConfigurationConfig_s3AndCloudWatchEnableMonitoringDashboard(bucketName, logGroupName, rName, string(awstypes.LogTypeAlert), string(awstypes.LogTypeFlow), true),
763+
Check: resource.ComposeTestCheckFunc(
764+
testAccCheckLoggingConfigurationExists(ctx, resourceName),
765+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtTrue),
766+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
767+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "2"),
768+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
769+
"log_destination.%": "1",
770+
"log_destination.logGroup": logGroupName,
771+
"log_destination_type": string(awstypes.LogDestinationTypeCloudwatchLogs),
772+
"log_type": string(awstypes.LogTypeFlow),
773+
}),
774+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
775+
"log_destination.%": "1",
776+
"log_destination.bucketName": bucketName,
777+
"log_destination_type": string(awstypes.LogDestinationTypeS3),
778+
"log_type": string(awstypes.LogTypeAlert),
779+
}),
780+
),
781+
},
782+
{
783+
ResourceName: resourceName,
784+
ImportState: true,
785+
ImportStateVerify: true,
786+
},
787+
{
788+
// Disable Monitoring Dashboard
789+
Config: testAccLoggingConfigurationConfig_s3AndCloudWatchEnableMonitoringDashboard(bucketName, logGroupName, rName, string(awstypes.LogTypeAlert), string(awstypes.LogTypeFlow), false),
790+
Check: resource.ComposeTestCheckFunc(
791+
testAccCheckLoggingConfigurationExists(ctx, resourceName),
792+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtFalse),
793+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
794+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "2"),
795+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
796+
"log_destination.%": "1",
797+
"log_destination.logGroup": logGroupName,
798+
"log_destination_type": string(awstypes.LogDestinationTypeCloudwatchLogs),
799+
"log_type": string(awstypes.LogTypeFlow),
800+
}),
801+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
802+
"log_destination.%": "1",
803+
"log_destination.bucketName": bucketName,
804+
"log_destination_type": string(awstypes.LogDestinationTypeS3),
805+
"log_type": string(awstypes.LogTypeAlert),
806+
}),
807+
),
808+
},
809+
{
810+
// Re-Enable Monitoring Dashboard and change log types at the same time
811+
Config: testAccLoggingConfigurationConfig_s3AndCloudWatchEnableMonitoringDashboard(bucketName, logGroupName, rName, string(awstypes.LogTypeTls), string(awstypes.LogTypeFlow), true),
812+
Check: resource.ComposeTestCheckFunc(
813+
testAccCheckLoggingConfigurationExists(ctx, resourceName),
814+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtTrue),
815+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
816+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "2"),
817+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
818+
"log_destination.%": "1",
819+
"log_destination.logGroup": logGroupName,
820+
"log_destination_type": string(awstypes.LogDestinationTypeCloudwatchLogs),
821+
"log_type": string(awstypes.LogTypeFlow),
822+
}),
823+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
824+
"log_destination.%": "1",
825+
"log_destination.bucketName": bucketName,
826+
"log_destination_type": string(awstypes.LogDestinationTypeS3),
827+
"log_type": string(awstypes.LogTypeTls),
828+
}),
829+
),
830+
},
831+
{
832+
// Omit enable_monitoring_dashboard (inherit previous value)
833+
Config: testAccLoggingConfigurationConfig_s3AndCloudWatch(bucketName, logGroupName, rName, string(awstypes.LogTypeTls), string(awstypes.LogTypeFlow)),
834+
Check: resource.ComposeTestCheckFunc(
835+
testAccCheckLoggingConfigurationExists(ctx, resourceName),
836+
resource.TestCheckResourceAttr(resourceName, "enable_monitoring_dashboard", acctest.CtTrue),
837+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.#", "1"),
838+
resource.TestCheckResourceAttr(resourceName, "logging_configuration.0.log_destination_config.#", "2"),
839+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
840+
"log_destination.%": "1",
841+
"log_destination.logGroup": logGroupName,
842+
"log_destination_type": string(awstypes.LogDestinationTypeCloudwatchLogs),
843+
"log_type": string(awstypes.LogTypeFlow),
844+
}),
845+
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "logging_configuration.0.log_destination_config.*", map[string]string{
846+
"log_destination.%": "1",
847+
"log_destination.bucketName": bucketName,
848+
"log_destination_type": string(awstypes.LogDestinationTypeS3),
849+
"log_type": string(awstypes.LogTypeTls),
850+
}),
851+
),
852+
},
853+
},
854+
})
855+
}
856+
745857
func TestAccNetworkFirewallLoggingConfiguration_disappears(t *testing.T) {
746858
ctx := acctest.Context(t)
747859
bucketName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
@@ -1151,3 +1263,35 @@ resource "aws_networkfirewall_logging_configuration" "test" {
11511263
}
11521264
`, logTypeS3, logTypeCloudWatch))
11531265
}
1266+
1267+
func testAccLoggingConfigurationConfig_s3AndCloudWatchEnableMonitoringDashboard(bucketName, logGroupName, rName, logTypeS3, logTypeCloudWatch string, enableMonitoringDashboard bool) string {
1268+
return acctest.ConfigCompose(
1269+
testAccLoggingConfigurationConfig_base(rName),
1270+
testAccLoggingConfigurationConfig_baseS3Bucket(bucketName),
1271+
testAccLoggingConfigurationConfig_baseCloudWatch(logGroupName),
1272+
fmt.Sprintf(`
1273+
resource "aws_networkfirewall_logging_configuration" "test" {
1274+
firewall_arn = aws_networkfirewall_firewall.test.arn
1275+
1276+
enable_monitoring_dashboard = %[3]t
1277+
1278+
logging_configuration {
1279+
log_destination_config {
1280+
log_destination = {
1281+
bucketName = aws_s3_bucket.test.bucket
1282+
}
1283+
log_destination_type = "S3"
1284+
log_type = %[1]q
1285+
}
1286+
1287+
log_destination_config {
1288+
log_destination = {
1289+
logGroup = aws_cloudwatch_log_group.test.name
1290+
}
1291+
log_destination_type = "CloudWatchLogs"
1292+
log_type = %[2]q
1293+
}
1294+
}
1295+
}
1296+
`, logTypeS3, logTypeCloudWatch, enableMonitoringDashboard))
1297+
}

‎website/docs/r/networkfirewall_logging_configuration.html.markdown‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ This resource supports the following arguments:
7070

7171
* `region` - (Optional) Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the [provider configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#aws-configuration-reference).
7272
* `firewall_arn` - (Required, Forces new resource) The Amazon Resource Name (ARN) of the Network Firewall firewall.
73+
* `enable_monitoring_dashboard` - (Optional) Whether to enable the detailed firewall monitoring dashboard on the firewall. Defaults to `false`.
7374
* `logging_configuration` - (Required) A configuration block describing how AWS Network Firewall performs logging for a firewall. See [Logging Configuration](#logging-configuration) below for details.
7475

7576
### Logging Configuration

0 commit comments

Comments
 (0)