Skip to content

Commit 339e6f6

Browse files
imrannayerimrannayer
authored
feat: added security profile rule support in network firewall policy (#602)
1 parent 3ac6496 commit 339e6f6

File tree

10 files changed

+103
-38
lines changed

10 files changed

+103
-38
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
# Make will use bash instead of sh
1616
SHELL := /usr/bin/env bash
1717

18-
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.22
18+
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.23
1919
DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
2020
REGISTRY_URL := gcr.io/cloud-foundation-cicd
2121

‎build/int.cloudbuild.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -246,4 +246,4 @@ tags:
246246
- 'integration'
247247
substitutions:
248248
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
249-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'
249+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.23'

‎build/lint.cloudbuild.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ tags:
2121
- 'lint'
2222
substitutions:
2323
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
24-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'
24+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.23'

‎examples/global-network-firewall-policy/main.tf‎

Lines changed: 72 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ data "google_project" "project" {
2323
}
2424

2525
resource "random_string" "random_suffix" {
26-
length = 6
26+
length = 4
2727
special = false
2828
lower = true
2929
upper = false
@@ -39,6 +39,10 @@ resource "google_compute_network" "network_backup" {
3939
name = "${local.prefix}-network-backup"
4040
}
4141

42+
################################
43+
# Tags #
44+
################################
45+
4246
resource "google_tags_tag_key" "tag_key" {
4347

4448
description = "For keyname resources."
@@ -56,6 +60,10 @@ resource "google_tags_tag_value" "tag_value" {
5660
short_name = "yes"
5761
}
5862

63+
################################
64+
# Address group #
65+
################################
66+
5967
resource "google_network_security_address_group" "networksecurity_address_group" {
6068
provider = google-beta
6169

@@ -68,25 +76,32 @@ resource "google_network_security_address_group" "networksecurity_address_group"
6876
capacity = 100
6977
}
7078

79+
################################
80+
# Service Account #
81+
################################
82+
7183
resource "google_service_account" "service_account" {
7284
project = var.project_id
7385
account_id = "${local.prefix}-fw-test-svc-acct"
7486
display_name = "${local.prefix} firewall policy test service account"
7587
}
7688

7789
################################
78-
# VPC Spoke #
90+
# VPC #
7991
################################
92+
8093
module "vpc" {
8194
source = "terraform-google-modules/network/google//modules/vpc"
8295
version = "~> 10.0"
8396

8497
project_id = var.project_id
8598
network_name = "global-sec-policy-test-vpc"
86-
87-
# shared_vpc_host = false
8899
}
89100

101+
################################
102+
# Mirroring #
103+
################################
104+
90105
resource "google_network_security_mirroring_deployment_group" "mirroring_deployment_group" {
91106
project = var.project_id
92107
mirroring_deployment_group_id = "${local.prefix}-mirroring-dg"
@@ -104,13 +119,11 @@ resource "google_network_security_mirroring_endpoint_group" "mirroring_endpoint_
104119
mirroring_deployment_group = google_network_security_mirroring_deployment_group.mirroring_deployment_group.id
105120
}
106121

107-
108122
resource "google_network_security_security_profile" "security_profile" {
109-
provider = google-beta
110-
name = "${local.prefix}-security-profile"
111-
parent = "organizations/${var.org_id}"
112-
description = "Security profile description"
113-
type = "CUSTOM_MIRRORING"
123+
provider = google-beta
124+
name = "${local.prefix}-mirror-sp-${random_string.random_suffix.result}"
125+
parent = "organizations/${var.org_id}"
126+
type = "CUSTOM_MIRRORING"
114127

115128
custom_mirroring_profile {
116129
mirroring_endpoint_group = google_network_security_mirroring_endpoint_group.mirroring_endpoint_group.id
@@ -119,13 +132,33 @@ resource "google_network_security_security_profile" "security_profile" {
119132

120133
resource "google_network_security_security_profile_group" "security_profile_group" {
121134
provider = google-beta
122-
name = "${local.prefix}-sec-profile-group"
135+
name = "${local.prefix}-mirror-spg-${random_string.random_suffix.result}"
123136
parent = "organizations/${var.org_id}"
124-
description = "Security profile group"
125137
custom_mirroring_profile = google_network_security_security_profile.security_profile.id
126138
}
127139

140+
################################
141+
# Threat #
142+
################################
143+
144+
resource "google_network_security_security_profile" "security_profile_1" {
145+
provider = google-beta
146+
name = "${local.prefix}-threat-sp-${random_string.random_suffix.result}"
147+
type = "THREAT_PREVENTION"
148+
parent = "organizations/${var.org_id}"
149+
location = "global"
150+
}
151+
152+
resource "google_network_security_security_profile_group" "security_profile_group_1" {
153+
provider = google-beta
154+
name = "${local.prefix}-threat-spg-${random_string.random_suffix.result}"
155+
parent = "organizations/${var.org_id}"
156+
threat_prevention_profile = google_network_security_security_profile.security_profile_1.id
157+
}
128158

159+
################################
160+
# Firewall Policy #
161+
################################
129162

130163
module "firewal_policy" {
131164
source = "terraform-google-modules/network/google//modules/network-firewall-policy"
@@ -259,16 +292,14 @@ module "firewal_policy" {
259292
}
260293
},
261294
{
262-
is_mirroring = true
263-
priority = "200"
264-
direction = "EGRESS"
265-
action = "mirror"
266-
rule_name = "egress-200"
267-
disabled = false
268-
description = "test egress mirroring rule 200"
269-
target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
295+
is_mirroring = true
296+
priority = "200"
297+
direction = "EGRESS"
298+
action = "mirror"
299+
rule_name = "egress-200"
300+
disabled = false
301+
description = "test egress mirroring rule 200"
270302
match = {
271-
src_ip_ranges = ["0.0.0.0/0"]
272303
dest_ip_ranges = ["0.0.0.0/0"]
273304
layer4_configs = [
274305
{
@@ -279,6 +310,23 @@ module "firewal_policy" {
279310
}
280311
security_profile_group_id = google_network_security_security_profile_group.security_profile_group.id
281312
},
313+
{
314+
priority = "300"
315+
direction = "EGRESS"
316+
action = "apply_security_profile_group"
317+
rule_name = "egress-300"
318+
disabled = false
319+
description = "test egress threat prevention rule 300"
320+
match = {
321+
dest_ip_ranges = ["0.0.0.0/0"]
322+
layer4_configs = [
323+
{
324+
ip_protocol = "tcp"
325+
}
326+
]
327+
}
328+
security_profile_group_id = google_network_security_security_profile_group.security_profile_group_1.id
329+
},
282330

283331
]
284332

@@ -289,8 +337,9 @@ module "firewal_policy" {
289337
}
290338

291339
module "firewal_policy_no_rule" {
292-
source = "terraform-google-modules/network/google//modules/network-firewall-policy"
293-
version = "~> 11.0"
340+
source = "terraform-google-modules/network/google//modules/network-firewall-policy"
341+
version = "~> 11.0"
342+
294343
project_id = var.project_id
295344
policy_name = "${local.prefix}-firewall-policy-no-rules-${random_string.random_suffix.result}"
296345
description = "${local.prefix} test firewall policy without any rules"

‎examples/network_connectivity_center/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ module "vpn_spoke_local_vpc" {
122122

123123
module "remote_to_local_vpn" {
124124
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
125-
version = "~> 4.0"
125+
version = "~> 5.0"
126126

127127
project_id = var.project_id
128128
region = var.vpn_region
@@ -160,7 +160,7 @@ module "remote_to_local_vpn" {
160160

161161
module "local_to_remote_vpn" {
162162
source = "terraform-google-modules/vpn/google//modules/vpn_ha"
163-
version = "~> 4.0"
163+
version = "~> 5.0"
164164

165165
project_id = var.project_id
166166
region = var.vpn_region

‎modules/network-firewall-policy/main.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ resource "google_compute_network_firewall_policy_rule" "rules" {
5050
firewall_policy = google_compute_network_firewall_policy.fw_policy[0].name
5151
rule_name = each.value.rule_name
5252
target_service_accounts = each.value.target_service_accounts
53+
tls_inspect = each.value.action == "apply_security_profile_group" ? lookup(each.value, "tls_inspect", null) : null
54+
security_profile_group = each.value.action == "apply_security_profile_group" ? "//networksecurity.googleapis.com/${each.value.security_profile_group_id}" : null
5355

5456
## targetSecureTag may not be set at the same time as targetServiceAccounts
5557
dynamic "target_secure_tags" {
@@ -107,8 +109,8 @@ resource "google_compute_network_firewall_policy_packet_mirroring_rule" "rules"
107109
disabled = each.value.disabled
108110
firewall_policy = google_compute_network_firewall_policy.fw_policy[0].name
109111
rule_name = each.value.rule_name
110-
tls_inspect = lookup(each.value, "tls_inspect", null)
111-
security_profile_group = "//networksecurity.googleapis.com/${each.value.security_profile_group_id}"
112+
tls_inspect = each.value.action == "mirror" ? lookup(each.value, "tls_inspect", null) : null
113+
security_profile_group = each.value.action == "mirror" ? "//networksecurity.googleapis.com/${each.value.security_profile_group_id}" : null
112114

113115
dynamic "target_secure_tags" {
114116
for_each = each.value.target_secure_tags == null ? [] : toset(each.value.target_secure_tags)
@@ -167,6 +169,8 @@ resource "google_compute_region_network_firewall_policy_rule" "rules" {
167169
firewall_policy = google_compute_region_network_firewall_policy.fw_policy[0].name
168170
rule_name = each.value.rule_name
169171
target_service_accounts = each.value.target_service_accounts
172+
tls_inspect = each.value.action == "apply_security_profile_group" ? lookup(each.value, "tls_inspect", null) : null
173+
security_profile_group = each.value.action == "apply_security_profile_group" ? "//networksecurity.googleapis.com/${each.value.security_profile_group_id}" : null
170174

171175
## targetSecureTag may not be set at the same time as targetServiceAccounts
172176
dynamic "target_secure_tags" {

‎modules/vpc-serverless-connector-beta/metadata.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ spec:
2828
version: 10.0.0
2929
actuationTool:
3030
flavor: Terraform
31-
version: ">= 0.13.0"
31+
version: ">= 1.3"
3232
description: {}
3333
content:
3434
examples:

‎modules/vpc-serverless-connector-beta/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616

1717
terraform {
18-
required_version = ">= 0.13.0"
18+
required_version = ">= 1.3"
1919
required_providers {
2020
google-beta = {
2121
source = "hashicorp/google-beta"

‎test/integration/global-network-firewall-policy/global_firewall_policy_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,15 @@ func TestGlobalNetworkFirewallPolicy(t *testing.T) {
146146
assert.Equal("tcp", sp104.Get("match.layer4Configs").Array()[0].Get("ipProtocol").String(), "has expected layer4Configs.ipProtocol")
147147
layer4ConfigsPorts200 := sp104.Get("match.layer4Configs").Array()[0].Get("ports").Array()
148148
assert.Equal(1, len(layer4ConfigsPorts200), "Rule3 should have the correct layer4Configs.ports count")
149+
150+
rule300 := gcloud.Runf(t, "compute network-firewall-policies rules describe 300 --global-firewall-policy --firewall-policy %s --project %s", policyName, projectId)
151+
sp300 := rule300.Array()[0]
152+
assert.Equal("apply_security_profile_group", sp300.Get("action").String(), "Rule300 action should be allow")
153+
assert.Equal("egress-300", sp300.Get("ruleName").String(), "Rule300 ruleName should be egress-300")
154+
assert.Equal("test egress threat prevention rule 300", sp300.Get("description").String(), "Rule300 has expected description")
155+
assert.Equal("EGRESS", sp300.Get("direction").String(), "Rule300 direction should be EGRESS")
156+
assert.Equal("0.0.0.0/0", sp300.Get("match.destIpRanges").Array()[0].String(), "has expected destIpRanges")
157+
assert.Equal("tcp", sp300.Get("match.layer4Configs").Array()[0].Get("ipProtocol").String(), "has expected layer4Configs.ipProtocol")
149158
})
150159
fwp.Test()
151160
}

‎test/setup/main.tf‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,18 +22,21 @@ resource "random_string" "random_suffix" {
2222
}
2323

2424
resource "google_folder" "folder1" {
25-
display_name = "ci-network1-${random_string.random_suffix.result}"
26-
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
25+
display_name = "ci-network1-${random_string.random_suffix.result}"
26+
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
27+
deletion_protection = false
2728
}
2829

2930
resource "google_folder" "folder2" {
30-
display_name = "ci-network2-${random_string.random_suffix.result}"
31-
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
31+
display_name = "ci-network2-${random_string.random_suffix.result}"
32+
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
33+
deletion_protection = false
3234
}
3335

3436
resource "google_folder" "folder3" {
35-
display_name = "ci-network3-${random_string.random_suffix.result}"
36-
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
37+
display_name = "ci-network3-${random_string.random_suffix.result}"
38+
parent = var.folder_id != null ? "folders/${var.folder_id}" : "organizations/${var.org_id}"
39+
deletion_protection = false
3740
}
3841

3942
module "project" {

0 commit comments

Comments
 (0)