Skip to content

fix!: Fix for hierarchical firewall policy #1354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 19, 2024
Merged

fix!: Fix for hierarchical firewall policy #1354

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1708c12
Fix for hierarchical firewall policy
renato-rudnicki Dec 10, 2024
77796c9
fix integration test
renato-rudnicki Dec 11, 2024
85f30d4
remove auditLogsProjectNumber
renato-rudnicki Dec 11, 2024
03507ea
Merge branch 'master' into fix-hierarchical-firewall
apeabody Dec 18, 2024
822c35d
updated minimum cosntraint for hierarchical firewall policy
renato-rudnicki Dec 18, 2024
41d20f9
update minimum constraint for hierarchical firewall policy - hub-and-…
renato-rudnicki Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 21 additions & 24 deletions 3-networks-dual-svpc/modules/hierarchical_firewall_policy/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
*/

locals {
policy_id = google_compute_organization_security_policy.policy.id
policy_id = google_compute_firewall_policy.policy.id
}

resource "random_string" "suffix" {
Expand All @@ -24,17 +24,15 @@ resource "random_string" "suffix" {
special = false
}

resource "google_compute_organization_security_policy" "policy" {
provider = google-beta
display_name = "${var.name}-${random_string.suffix.result}"
parent = var.parent
resource "google_compute_firewall_policy" "policy" {
short_name = "${var.name}-${random_string.suffix.result}"
parent = var.parent
}

resource "google_compute_organization_security_policy_rule" "rule" {
provider = google-beta
resource "google_compute_firewall_policy_rule" "rule" {
for_each = var.rules

policy_id = google_compute_organization_security_policy.policy.id
firewall_policy = google_compute_firewall_policy.policy.id
action = each.value.action
direction = each.value.direction
priority = each.value.priority
Expand All @@ -44,25 +42,24 @@ resource "google_compute_organization_security_policy_rule" "rule" {
# preview = each.value.preview
match {
# description = each.value.description
config {
src_ip_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null
dest_ip_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
dynamic "layer4_config" {
for_each = each.value.ports
iterator = port
content {
ip_protocol = port.key
ports = port.value
}

src_ip_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null
dest_ip_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
dynamic "layer4_configs" {
for_each = each.value.ports
iterator = port
content {
ip_protocol = port.key
ports = port.value
}
}
}
}

resource "google_compute_organization_security_policy_association" "association" {
provider = google-beta
for_each = toset(var.associations)
name = "${local.policy_id}-${each.value}"
policy_id = local.policy_id
attachment_id = each.value
resource "google_compute_firewall_policy_association" "association" {
for_each = toset(var.associations)

name = replace("${local.policy_id}-${each.value}", "/", "-")
firewall_policy = google_compute_firewall_policy.policy.id
attachment_target = each.value
}
2 changes: 1 addition & 1 deletion 3-networks-dual-svpc/modules/hierarchical_firewall_policy/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,5 @@
*/

output "id" {
value = google_compute_organization_security_policy.policy.id
value = google_compute_firewall_policy.policy.id
}
47 changes: 22 additions & 25 deletions 3-networks-hub-and-spoke/modules/hierarchical_firewall_policy/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2021 Google LLC
Copy link
Contributor

@apeabody apeabody Dec 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason for this change?

Copy link
Contributor Author

@renato-rudnicki renato-rudnicki Dec 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No reason, Probably a mistake. Fixing.

*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand All @@ -15,7 +15,7 @@
*/

locals {
policy_id = google_compute_organization_security_policy.policy.id
policy_id = google_compute_firewall_policy.policy.id
}

resource "random_string" "suffix" {
Expand All @@ -24,17 +24,15 @@ resource "random_string" "suffix" {
special = false
}

resource "google_compute_organization_security_policy" "policy" {
provider = google-beta
display_name = "${var.name}-${random_string.suffix.result}"
parent = var.parent
resource "google_compute_firewall_policy" "policy" {
short_name = "${var.name}-${random_string.suffix.result}"
parent = var.parent
}

resource "google_compute_organization_security_policy_rule" "rule" {
provider = google-beta
resource "google_compute_firewall_policy_rule" "rule" {
for_each = var.rules

policy_id = google_compute_organization_security_policy.policy.id
firewall_policy = google_compute_firewall_policy.policy.id
action = each.value.action
direction = each.value.direction
priority = each.value.priority
Expand All @@ -44,25 +42,24 @@ resource "google_compute_organization_security_policy_rule" "rule" {
# preview = each.value.preview
match {
# description = each.value.description
config {
src_ip_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null
dest_ip_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
dynamic "layer4_config" {
for_each = each.value.ports
iterator = port
content {
ip_protocol = port.key
ports = port.value
}

src_ip_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null
dest_ip_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
dynamic "layer4_configs" {
for_each = each.value.ports
iterator = port
content {
ip_protocol = port.key
ports = port.value
}
}
}
}

resource "google_compute_organization_security_policy_association" "association" {
provider = google-beta
for_each = toset(var.associations)
name = "${local.policy_id}-${each.value}"
policy_id = local.policy_id
attachment_id = each.value
resource "google_compute_firewall_policy_association" "association" {
for_each = toset(var.associations)

name = replace("${local.policy_id}-${each.value}", "/", "-")
firewall_policy = google_compute_firewall_policy.policy.id
attachment_target = each.value
}
2 changes: 1 addition & 1 deletion 3-networks-hub-and-spoke/modules/hierarchical_firewall_policy/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,5 @@
*/

output "id" {
value = google_compute_organization_security_policy.policy.id
value = google_compute_firewall_policy.policy.id
}
3 changes: 1 addition & 2 deletions test/integration/org/org_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,6 @@ func TestOrg(t *testing.T) {
assert.Equal(billingDatasetFullName, billingDataset.Get("id").String(), fmt.Sprintf("dataset %s should exist", billingDatasetFullName))

auditLogsProjectID := org.GetStringOutput("org_audit_logs_project_id")
auditLogsProjectNumber := gcloud.Runf(t, "projects describe %s", auditLogsProjectID).Get("projectNumber").String()

// Bucket destination
logsExportStorageBucketName := org.GetStringOutput("logs_export_storage_bucket_name")
Expand All @@ -247,7 +246,7 @@ func TestOrg(t *testing.T) {
prjLinkedDsName := org.GetStringOutput("logs_export_project_linked_dataset_name")
prjLinkedDs := gcloud.Runf(t, "logging links describe %s --bucket=%s --location=%s --project=%s", prjLinkedDatasetID, prjLogsExportLogBktName, defaultRegion, auditLogsProjectID)
assert.Equal(prjLinkedDsName, prjLinkedDs.Get("name").String(), "log bucket linked dataset name should match")
prjBigqueryDatasetID := fmt.Sprintf("bigquery.googleapis.com/projects/%s/datasets/%s", auditLogsProjectNumber, prjLinkedDatasetID)
prjBigqueryDatasetID := fmt.Sprintf("bigquery.googleapis.com/projects/%s/datasets/%s", auditLogsProjectID, prjLinkedDatasetID)
assert.Equal(prjBigqueryDatasetID, prjLinkedDs.Get("bigqueryDataset.datasetId").String(), "log bucket BigQuery dataset ID should match")

// add filter exclusion
Expand Down
Loading