Skip to content

Commit a1e1de4

Browse files
modular-magicianmodular-magician
authored
fix(securitypolicy): add ja4 fingerprint (#14151) (#23270)
[upstream:881671452a3bac0a948cae138f02663a91654343] Signed-off-by: Modular Magician <[email protected]>
1 parent cc0862f commit a1e1de4

12 files changed

+203
-20
lines changed

‎.changelog/14151.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
compute: added `TLS_JA4_FINGERPRINT` option to `enforce_on_key` field in `google_compute_region_security_policy`, `google_compute_security_policy`, and `google_compute_security_policy_rule` resources
3+
```

‎google/services/compute/resource_compute_region_security_policy.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -501,7 +501,7 @@ Valid option is "allow" only.`,
501501
"enforce_on_key": {
502502
Type: schema.TypeString,
503503
Optional: true,
504-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
504+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
505505
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
506506
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.
507507
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -512,7 +512,8 @@ Valid option is "allow" only.`,
512512
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
513513
* REGION_CODE: The country/region from which the request originates.
514514
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
515-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
515+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
516+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
516517
},
517518
"enforce_on_key_configs": {
518519
Type: schema.TypeList,
@@ -532,7 +533,7 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
532533
"enforce_on_key_type": {
533534
Type: schema.TypeString,
534535
Optional: true,
535-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
536+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
536537
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
537538
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.
538539
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -543,7 +544,8 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
543544
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
544545
* REGION_CODE: The country/region from which the request originates.
545546
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
546-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
547+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
548+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
547549
},
548550
},
549551
},

‎google/services/compute/resource_compute_region_security_policy_rule.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -436,7 +436,7 @@ Valid option is "allow" only.`,
436436
"enforce_on_key": {
437437
Type: schema.TypeString,
438438
Optional: true,
439-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
439+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
440440
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
441441
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.
442442
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -447,7 +447,8 @@ Valid option is "allow" only.`,
447447
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
448448
* REGION_CODE: The country/region from which the request originates.
449449
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
450-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
450+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
451+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
451452
},
452453
"enforce_on_key_configs": {
453454
Type: schema.TypeList,
@@ -467,7 +468,7 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
467468
"enforce_on_key_type": {
468469
Type: schema.TypeString,
469470
Optional: true,
470-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
471+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
471472
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
472473
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.
473474
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -478,7 +479,8 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
478479
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
479480
* REGION_CODE: The country/region from which the request originates.
480481
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
481-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
482+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
483+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
482484
},
483485
},
484486
},

‎google/services/compute/resource_compute_region_security_policy_test.go

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -735,6 +735,63 @@ func testAccComputeRegionSecurityPolicy_withMultipleEnforceOnKeyConfigs_update(c
735735
`, context)
736736
}
737737

738+
func testAccComputeRegionSecurityPolicy_withMultipleEnforceOnKeyConfigs_ja4(context map[string]interface{}) string {
739+
return acctest.Nprintf(`
740+
resource "google_compute_region_security_policy" "policy" {
741+
name = "tf-test%{random_suffix}"
742+
type = "CLOUD_ARMOR"
743+
region = "us-west2"
744+
745+
rules {
746+
priority = "100"
747+
action = "throttle"
748+
rate_limit_options {
749+
conform_action = "allow"
750+
exceed_action = "deny(429)"
751+
752+
rate_limit_threshold {
753+
count = 10
754+
interval_sec = 60
755+
}
756+
757+
enforce_on_key_configs {
758+
enforce_on_key_type = "USER_IP"
759+
}
760+
761+
enforce_on_key_configs {
762+
enforce_on_key_type = "TLS_JA4_FINGERPRINT"
763+
}
764+
765+
enforce_on_key_configs {
766+
enforce_on_key_type = "REGION_CODE"
767+
}
768+
}
769+
match {
770+
config {
771+
src_ip_ranges = [
772+
"*"
773+
]
774+
}
775+
versioned_expr = "SRC_IPS_V1"
776+
}
777+
}
778+
779+
rules {
780+
action = "allow"
781+
priority = "2147483647"
782+
preview = false
783+
match {
784+
versioned_expr = "SRC_IPS_V1"
785+
config {
786+
src_ip_ranges = ["*"]
787+
}
788+
}
789+
description = "default rule"
790+
}
791+
}
792+
`, context)
793+
}
794+
738795
func TestAccComputeRegionSecurityPolicy_regionSecurityPolicyRuleOrderingWithMultipleRules(t *testing.T) {
739796
t.Parallel()
740797

‎google/services/compute/resource_compute_security_policy.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,7 @@ func ResourceComputeSecurityPolicy() *schema.Resource {
350350
Type: schema.TypeString,
351351
Optional: true,
352352
Description: `Determines the key to enforce the rateLimitThreshold on`,
353-
ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}, false),
353+
ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}, false),
354354
},
355355

356356
"enforce_on_key_name": {
@@ -369,7 +369,7 @@ func ResourceComputeSecurityPolicy() *schema.Resource {
369369
Type: schema.TypeString,
370370
Optional: true,
371371
Description: `Determines the key to enforce the rate_limit_threshold on`,
372-
ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"}, false),
372+
ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"}, false),
373373
},
374374
"enforce_on_key_name": {
375375
Type: schema.TypeString,

‎google/services/compute/resource_compute_security_policy_rule.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ Valid option is "allow" only.`,
401401
"enforce_on_key": {
402402
Type: schema.TypeString,
403403
Optional: true,
404-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
404+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
405405
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
406406
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.
407407
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -412,7 +412,8 @@ Valid option is "allow" only.`,
412412
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
413413
* REGION_CODE: The country/region from which the request originates.
414414
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
415-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
415+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
416+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
416417
},
417418
"enforce_on_key_configs": {
418419
Type: schema.TypeList,
@@ -432,7 +433,7 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
432433
"enforce_on_key_type": {
433434
Type: schema.TypeString,
434435
Optional: true,
435-
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP", ""}),
436+
ValidateFunc: verify.ValidateEnum([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP", ""}),
436437
Description: `Determines the key to enforce the rateLimitThreshold on. Possible values are:
437438
* ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.
438439
* IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
@@ -443,7 +444,8 @@ HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.`,
443444
* SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
444445
* REGION_CODE: The country/region from which the request originates.
445446
* TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
446-
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "USER_IP"]`,
447+
* TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
448+
* USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. Possible values: ["ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE", "HTTP_PATH", "SNI", "REGION_CODE", "TLS_JA3_FINGERPRINT", "TLS_JA4_FINGERPRINT", "USER_IP"]`,
447449
},
448450
},
449451
},

‎google/services/compute/resource_compute_security_policy_rule_test.go

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,14 @@ func TestAccComputeSecurityPolicyRule_withRateLimitOption_withMultipleEnforceOnK
253253
ImportState: true,
254254
ImportStateVerify: true,
255255
},
256+
{
257+
Config: testAccComputeSecurityPolicyRule_withRateLimitOption_withMultipleEnforceOnKeyConfigs3(spName),
258+
},
259+
{
260+
ResourceName: "google_compute_security_policy_rule.policy_rule",
261+
ImportState: true,
262+
ImportStateVerify: true,
263+
},
256264
},
257265
})
258266
}
@@ -1038,6 +1046,54 @@ resource "google_compute_security_policy_rule" "policy_rule" {
10381046
`, spName)
10391047
}
10401048

1049+
func testAccComputeSecurityPolicyRule_withRateLimitOption_withMultipleEnforceOnKeyConfigs3(spName string) string {
1050+
return fmt.Sprintf(`
1051+
resource "google_compute_security_policy" "policy" {
1052+
name = "%s"
1053+
description = "basic policy base"
1054+
}
1055+
1056+
resource "google_compute_security_policy_rule" "policy_rule" {
1057+
security_policy = google_compute_security_policy.policy.name
1058+
description = "throttle rule withMultipleEnforceOnKeyConfigs3"
1059+
action = "throttle"
1060+
priority = "100"
1061+
1062+
match {
1063+
versioned_expr = "SRC_IPS_V1"
1064+
config {
1065+
src_ip_ranges = ["*"]
1066+
}
1067+
}
1068+
1069+
rate_limit_options {
1070+
conform_action = "allow"
1071+
exceed_action = "deny(429)"
1072+
1073+
rate_limit_threshold {
1074+
count = 10
1075+
interval_sec = 60
1076+
}
1077+
1078+
enforce_on_key = ""
1079+
1080+
enforce_on_key_configs {
1081+
enforce_on_key_type = "REGION_CODE"
1082+
}
1083+
1084+
enforce_on_key_configs {
1085+
enforce_on_key_type = "TLS_JA4_FINGERPRINT"
1086+
}
1087+
1088+
enforce_on_key_configs {
1089+
enforce_on_key_type = "USER_IP"
1090+
}
1091+
}
1092+
}
1093+
1094+
`, spName)
1095+
}
1096+
10411097
func testAccComputeSecurityPolicyRule_withRateLimitOptions_withoutRateLimitOptions(spName string) string {
10421098
return fmt.Sprintf(`
10431099
resource "google_compute_security_policy" "policy" {

0 commit comments

Comments
 (0)