Skip to content

Commit 5fc61e8

Browse files
ombellaretembleking
ombellare
and
tembleking
committed
feat(secure-policies): support new fields in drift policy (#656)
* Add support for additional secure drift policy fields * Address review comments * Fixed spacing issue --------- Co-authored-by: Fede Barcelona <[email protected]>
1 parent 5a95972 commit 5fc61e8

15 files changed

+266
-92
lines changed

‎sysdig/data_source_sysdig_secure_drift_policy.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,18 @@ func createDriftPolicyDataSourceSchema() map[string]*schema.Schema {
4747
Computed: true,
4848
Elem: &schema.Resource{
4949
Schema: map[string]*schema.Schema{
50-
"id": ReadOnlyIntSchema(),
51-
"name": ReadOnlyStringSchema(),
52-
"description": DescriptionComputedSchema(),
53-
"tags": TagsSchema(),
54-
"version": VersionSchema(),
55-
"enabled": BoolComputedSchema(),
56-
"exceptions": ExceptionsComputedSchema(),
57-
"prohibited_binaries": ExceptionsComputedSchema(),
58-
"mounted_volume_drift_enabled": BoolComputedSchema(),
50+
"id": ReadOnlyIntSchema(),
51+
"name": ReadOnlyStringSchema(),
52+
"description": DescriptionComputedSchema(),
53+
"tags": TagsSchema(),
54+
"version": VersionSchema(),
55+
"enabled": BoolComputedSchema(),
56+
"exceptions": ExceptionsComputedSchema(),
57+
"prohibited_binaries": ExceptionsComputedSchema(),
58+
"process_based_exceptions": ExceptionsComputedSchema(),
59+
"process_based_prohibited_binaries": ExceptionsComputedSchema(),
60+
"mounted_volume_drift_enabled": BoolComputedSchema(),
61+
"use_regex": BoolComputedSchema(),
5962
},
6063
},
6164
},

‎sysdig/data_source_sysdig_secure_drift_policy_test.go‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ func TestAccDriftPolicyDataSource(t *testing.T) {
3232
{
3333
Config: driftPolicyDataSource(rText),
3434
},
35+
{
36+
Config: driftPolicyWithUseRegexDataSource(rText),
37+
},
38+
{
39+
Config: driftPolicyWithProcessExceptionsDataSource(rText),
40+
},
3541
},
3642
})
3743
}
@@ -47,13 +53,96 @@ resource "sysdig_secure_drift_policy" "policy_1" {
4753
rule {
4854
description = "Test Drift Rule Description"
4955
enabled = true
56+
mounted_volume_drift_enabled = true
57+
use_regex = true
5058
5159
exceptions {
5260
items = ["/usr/bin/sh"]
5361
}
5462
prohibited_binaries {
5563
items = ["/usr/bin/curl"]
5664
}
65+
process_based_exceptions {
66+
items = ["/usr/bin/curl"]
67+
}
68+
process_based_prohibited_binaries {
69+
items = ["/usr/bin/sh"]
70+
}
71+
}
72+
73+
actions {
74+
prevent_drift = true
75+
}
76+
77+
}
78+
79+
data "sysdig_secure_drift_policy" "policy_2" {
80+
name = sysdig_secure_drift_policy.policy_1.name
81+
depends_on = [sysdig_secure_drift_policy.policy_1]
82+
}
83+
`, name, name)
84+
}
85+
86+
func driftPolicyWithUseRegexDataSource(name string) string {
87+
return fmt.Sprintf(`
88+
resource "sysdig_secure_drift_policy" "policy_1" {
89+
name = "Test Drift Policy %s"
90+
description = "Test Drift Policy Description %s"
91+
enabled = true
92+
severity = 4
93+
94+
rule {
95+
description = "Test Drift Rule Description"
96+
enabled = true
97+
mounted_volume_drift_enabled = true
98+
use_regex = true
99+
100+
exceptions {
101+
items = ["/usr/bin/sh"]
102+
}
103+
prohibited_binaries {
104+
items = ["/usr/bin/curl"]
105+
}
106+
process_based_exceptions {
107+
items = ["/usr/bin/curl"]
108+
}
109+
process_based_prohibited_binaries {
110+
items = ["/usr/bin/sh"]
111+
}
112+
}
113+
114+
actions {
115+
prevent_drift = true
116+
}
117+
118+
}
119+
120+
data "sysdig_secure_drift_policy" "policy_2" {
121+
name = sysdig_secure_drift_policy.policy_1.name
122+
depends_on = [sysdig_secure_drift_policy.policy_1]
123+
}
124+
`, name, name)
125+
}
126+
127+
func driftPolicyWithProcessExceptionsDataSource(name string) string {
128+
return fmt.Sprintf(`
129+
resource "sysdig_secure_drift_policy" "policy_1" {
130+
name = "Test Drift Policy %s"
131+
description = "Test Drift Policy Description %s"
132+
enabled = true
133+
severity = 4
134+
135+
rule {
136+
description = "Test Drift Rule Description"
137+
enabled = true
138+
mounted_volume_drift_enabled = true
139+
140+
process_based_exceptions {
141+
items = ["/usr/bin/curl"]
142+
}
143+
process_based_prohibited_binaries {
144+
items = ["/usr/bin/sh"]
145+
}
57146
}
58147
59148
actions {

‎sysdig/data_source_sysdig_secure_malware_policy.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,11 @@ func createMalwarePolicyDataSourceSchema() map[string]*schema.Schema {
5757
"tags": TagsSchema(),
5858
"version": VersionSchema(),
5959
"use_managed_hashes": BoolComputedSchema(),
60-
"additional_hashes": HashesComputedSchema(),
61-
"ignore_hashes": HashesComputedSchema(),
60+
"use_yara_rules": BoolComputedSchema(),
61+
"additional_hashes": StringListComputedSchema(),
62+
"ignore_hashes": StringListComputedSchema(),
63+
"use_regex": BoolComputedSchema(),
64+
"ignore_paths": StringListComputedSchema(),
6265
},
6366
},
6467
},

‎sysdig/data_source_sysdig_secure_malware_policy_test.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,15 @@ resource "sysdig_secure_malware_policy" "policy_1" {
4949
5050
use_managed_hashes = true
5151
52-
additional_hashes {
53-
hash = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
54-
}
52+
additional_hashes = [
53+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6",
54+
"304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae7"
55+
]
5556
56-
ignore_hashes {
57-
hash = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
58-
}
57+
ignore_hashes = [
58+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e",
59+
"6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0f"
60+
]
5961
}
6062
6163
actions {

‎sysdig/internal/client/v2/model.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,8 +397,11 @@ func (p MLRuleDetails) GetRuleType() ElementType {
397397
type MalwareRuleDetails struct {
398398
RuleType ElementType `json:"ruleType"`
399399
UseManagedHashes bool `json:"useManagedHashes"`
400+
UseYaraRules bool `json:"usePolymorphicRules"`
400401
AdditionalHashes map[string][]string `json:"additionalHashes"`
401402
IgnoreHashes map[string][]string `json:"ignoreHashes"`
403+
UseRegex bool `json:"useRegex"`
404+
IgnorePaths map[string][]string `json:"ignorePaths"`
402405
Details `json:"-"`
403406
}
404407

@@ -419,6 +422,7 @@ type DriftRuleDetails struct {
419422
ProhibitedBinaries *RuntimePolicyRuleList `json:"prohibitedBinaries"`
420423
Mode string `json:"mode"`
421424
MountedVolumeDriftEnabled bool `json:"mountedVolumeDriftEnabled"`
425+
UseRegex bool `json:"useRegex"`
422426
Details `json:"-"`
423427
}
424428

‎sysdig/resource_sysdig_secure_drift_policy.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func resourceSysdigSecureDriftPolicy() *schema.Resource {
6767
"process_based_exceptions": ExceptionsSchema(),
6868
"process_based_prohibited_binaries": ExceptionsSchema(),
6969
"mounted_volume_drift_enabled": BoolSchema(),
70+
"use_regex": BoolSchema(),
7071
},
7172
},
7273
},

‎sysdig/resource_sysdig_secure_drift_policy_test.go‎

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ func TestAccDriftPolicy(t *testing.T) {
4242
{
4343
Config: driftPolicyWithMountedVolumeDriftEnabled(rText()),
4444
},
45+
{
46+
Config: driftPolicyWithProcessBasedAndRegexEnabled(rText()),
47+
},
4548
},
4649
})
4750
}
@@ -67,9 +70,6 @@ resource "sysdig_secure_drift_policy" "sample" {
6770
prohibited_binaries {
6871
items = ["/usr/bin/curl"]
6972
}
70-
process_based_exceptions {
71-
items = ["/usr/bin/curl"]
72-
}
7373
}
7474
7575
actions {
@@ -96,16 +96,20 @@ resource "sysdig_secure_drift_policy" "sample" {
9696
description = "Test Drift Rule Description"
9797
9898
enabled = true
99+
use_regex = true
99100
100101
exceptions {
101102
items = ["/usr/bin/sh"]
102103
}
103104
prohibited_binaries {
104105
items = ["/usr/bin/curl"]
105106
}
106-
process_based_exceptions {
107+
process_based_exceptions {
107108
items = ["/usr/bin/curl"]
108-
}
109+
}
110+
process_based_prohibited_binaries {
111+
items = ["/usr/bin/sh"]
112+
}
109113
}
110114
111115
actions {
@@ -138,16 +142,17 @@ resource "sysdig_secure_drift_policy" "sample" {
138142
description = "Test Drift Rule Description"
139143
140144
enabled = true
145+
use_regex = true
141146
142147
exceptions {
143148
items = ["/usr/bin/sh"]
144149
}
145150
prohibited_binaries {
146151
items = ["/usr/bin/curl"]
147152
}
148-
process_based_exceptions {
153+
process_based_exceptions {
149154
items = ["/usr/bin/curl"]
150-
}
155+
}
151156
}
152157
153158
actions {}
@@ -177,9 +182,12 @@ resource "sysdig_secure_drift_policy" "sample" {
177182
prohibited_binaries {
178183
items = ["/usr/bin/curl"]
179184
}
180-
process_based_exceptions {
185+
process_based_exceptions {
181186
items = ["/usr/bin/curl"]
182-
}
187+
}
188+
process_based_prohibited_binaries {
189+
items = ["/usr/bin/sh"]
190+
}
183191
}
184192
185193
actions {
@@ -227,19 +235,25 @@ resource "sysdig_secure_drift_policy" "sample" {
227235
228236
rule {
229237
description = "Test Drift Rule Description"
230-
mounted_volume_drift_enabled = true
238+
231239
enabled = true
240+
mounted_volume_drift_enabled = true
232241
242+
enabled = true
243+
233244
exceptions {
234245
items = ["/usr/bin/sh"]
235246
}
236247
prohibited_binaries {
237248
items = ["/usr/bin/curl"]
238249
}
239-
process_based_exceptions {
250+
process_based_exceptions {
240251
items = ["/usr/bin/curl"]
241252
}
242-
}
253+
process_based_prohibited_binaries {
254+
items = ["/usr/bin/sh"]
255+
}
256+
}
243257
}
244258
`, name)
245259
}

‎sysdig/resource_sysdig_secure_malware_policy.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ func resourceSysdigSecureMalwarePolicy() *schema.Resource {
5454
"rule": {
5555
Type: schema.TypeList,
5656
Required: true,
57+
MaxItems: 1,
5758
Elem: &schema.Resource{
5859
Schema: map[string]*schema.Schema{
5960
"id": ReadOnlyIntSchema(),
@@ -64,8 +65,11 @@ func resourceSysdigSecureMalwarePolicy() *schema.Resource {
6465
"tags": TagsSchema(),
6566
"version": VersionSchema(),
6667
"use_managed_hashes": BoolSchema(),
67-
"additional_hashes": HashesSchema(),
68-
"ignore_hashes": HashesSchema(),
68+
"use_yara_rules": BoolSchema(),
69+
"additional_hashes": StringListSchema(),
70+
"ignore_hashes": StringListSchema(),
71+
"use_regex": BoolSchema(),
72+
"ignore_paths": StringListSchema(),
6973
},
7074
},
7175
},

0 commit comments

Comments
 (0)