Skip to content

Commit ef39480

Browse files
Pavel-KoevPavel-Koev
authored
Add optional account id parameter to the site ssl settings resource to be able to read and update sub-account site settings (#424)
1 parent 1265e78 commit ef39480

File tree

4 files changed

+88
-38
lines changed

4 files changed

+88
-38
lines changed

‎incapsula/client_site_ssl_settings.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,15 @@ type TLSConfiguration struct {
2626
}
2727

2828
type SSLSettingsDTO struct {
29-
HstsConfiguration HSTSConfiguration `json:"hstsConfiguration"`
29+
HstsConfiguration *HSTSConfiguration `json:"hstsConfiguration"`
3030
InboundTLSSettingsConfiguration *InboundTLSSettingsConfiguration `json:"inboundTlsSettings,omitempty"`
3131
}
3232

3333
type SSLSettingsResponse struct {
3434
Data []SSLSettingsDTO `json:"data"`
3535
}
3636

37-
func (c *Client) UpdateSiteSSLSettings(siteID int, mySSLSettings SSLSettingsResponse) (*SSLSettingsResponse, error) {
37+
func (c *Client) UpdateSiteSSLSettings(siteID int, accountID int, mySSLSettings SSLSettingsResponse) (*SSLSettingsResponse, error) {
3838
log.Printf("[INFO] Updating Incapsula Site SSL settings for Site ID %d\n", siteID)
3939

4040
requestJSON, err := json.Marshal(mySSLSettings)
@@ -44,6 +44,9 @@ func (c *Client) UpdateSiteSSLSettings(siteID int, mySSLSettings SSLSettingsResp
4444

4545
// Patch request to Incapsula
4646
reqURL := fmt.Sprintf("%s/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", c.config.BaseURLAPI, siteID)
47+
if accountID != 0 {
48+
reqURL = fmt.Sprintf("%s?caid=%d", reqURL, accountID)
49+
}
4750
log.Printf("[INFO] SSL Settings request json looks like this %s\n", requestJSON)
4851
log.Printf("[INFO] SSL Settings request URL looks like this %s\n", reqURL)
4952
resp, err := c.DoJsonRequestWithHeaders(http.MethodPatch, reqURL, requestJSON, UpdateSiteSSLSettings)
@@ -73,11 +76,15 @@ func (c *Client) UpdateSiteSSLSettings(siteID int, mySSLSettings SSLSettingsResp
7376
return &sslSettingsResponse, nil
7477
}
7578

76-
func (c *Client) ReadSiteSSLSettings(siteID int) (*SSLSettingsResponse, int, error) {
79+
func (c *Client) ReadSiteSSLSettings(siteID int, accountID int) (*SSLSettingsResponse, int, error) {
7780
log.Printf("[INFO] Getting Incapsula Incap SSL settings for Site ID %d\n", siteID)
7881

7982
// Get form to Incapsula
8083
reqURL := fmt.Sprintf("%s/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", c.config.BaseURLAPI, siteID)
84+
if accountID != 0 {
85+
reqURL = fmt.Sprintf("%s?caid=%d", reqURL, accountID)
86+
}
87+
log.Printf("[INFO] SSL Settings request URL looks like this %s\n", reqURL)
8188
resp, err := c.DoJsonRequestWithHeaders(http.MethodGet, reqURL, nil, ReadSiteSSLSettings)
8289
if err != nil {
8390
return nil, 0, fmt.Errorf("error from Incapsula service when reading SSL Settings for Site ID %d: %s", siteID, err)

‎incapsula/client_site_ssl_settings_test.go‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func TestUpdateSiteSSLSettingsHandleBadConnection(t *testing.T) {
1616
sslSettingsDTO := getUpdateSiteSSLSettingsDTO()
1717

1818
// act
19-
var res, err = client.UpdateSiteSSLSettings(123, sslSettingsDTO)
19+
var res, err = client.UpdateSiteSSLSettings(123, 1234, sslSettingsDTO)
2020

2121
// assert
2222
if err == nil {
@@ -33,6 +33,7 @@ func TestUpdateSiteSSLSettingsHandleResponseCodeNotSuccess(t *testing.T) {
3333
apiID := "foo"
3434
apiKey := "bar"
3535
siteID := 42
36+
accountID := 1234
3637

3738
endpoint := fmt.Sprintf("/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", siteID)
3839

@@ -53,7 +54,7 @@ func TestUpdateSiteSSLSettingsHandleResponseCodeNotSuccess(t *testing.T) {
5354
var dto = getUpdateSiteSSLSettingsDTO()
5455

5556
// act
56-
_, err := client.UpdateSiteSSLSettings(siteID, dto)
57+
_, err := client.UpdateSiteSSLSettings(siteID, accountID, dto)
5758

5859
// assert
5960
if err == nil {
@@ -70,6 +71,7 @@ func TestUpdateSiteSSLSettingsHandleInvalidResponseBody(t *testing.T) {
7071
apiID := "foo"
7172
apiKey := "bar"
7273
siteID := 42
74+
accountID := 1234
7375

7476
endpoint := fmt.Sprintf("/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", siteID)
7577
server := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
@@ -90,7 +92,7 @@ func TestUpdateSiteSSLSettingsHandleInvalidResponseBody(t *testing.T) {
9092
var dto = getUpdateSiteSSLSettingsDTO()
9193

9294
// act
93-
_, err := client.UpdateSiteSSLSettings(siteID, dto)
95+
_, err := client.UpdateSiteSSLSettings(siteID, accountID, dto)
9496

9597
// assert
9698
if err == nil {
@@ -107,6 +109,7 @@ func TestUpdateSiteSSLSettingsSuccess(t *testing.T) {
107109
apiID := "foo"
108110
apiKey := "bar"
109111
siteID := 42
112+
accountID := 1234
110113

111114
validResponse := getValidJSONResponse()
112115

@@ -127,7 +130,7 @@ func TestUpdateSiteSSLSettingsSuccess(t *testing.T) {
127130
var dto = getUpdateSiteSSLSettingsDTO()
128131

129132
// act
130-
_, err := client.UpdateSiteSSLSettings(siteID, dto)
133+
_, err := client.UpdateSiteSSLSettings(siteID, accountID, dto)
131134

132135
// assert
133136
if err != nil {
@@ -141,7 +144,7 @@ func TestReadSiteSSLSettingsHandleRequestError(t *testing.T) {
141144
client := &Client{config: config, httpClient: &http.Client{Timeout: time.Millisecond * 1}}
142145

143146
// act
144-
var res, statusCode, err = client.ReadSiteSSLSettings(123)
147+
var res, statusCode, err = client.ReadSiteSSLSettings(123, 1234)
145148

146149
// assert
147150
if err == nil {
@@ -162,6 +165,7 @@ func TestReadSiteSSLSettingsHandleResponseCodeNotSuccess(t *testing.T) {
162165
apiID := "foo"
163166
apiKey := "bar"
164167
siteID := 42
168+
accountID := 1234
165169

166170
endpoint := fmt.Sprintf("/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", siteID)
167171

@@ -181,7 +185,7 @@ func TestReadSiteSSLSettingsHandleResponseCodeNotSuccess(t *testing.T) {
181185
client := &Client{config: config, httpClient: &http.Client{}}
182186

183187
// act
184-
_, statusCode, err := client.ReadSiteSSLSettings(siteID)
188+
_, statusCode, err := client.ReadSiteSSLSettings(siteID, accountID)
185189

186190
// assert
187191
if err == nil {
@@ -198,6 +202,7 @@ func TestReadSiteSSLSettingsHandleInvalidResponseBody(t *testing.T) {
198202
apiID := "foo"
199203
apiKey := "bar"
200204
siteID := 42
205+
accountID := 1234
201206

202207
endpoint := fmt.Sprintf("/sites-mgmt/v3/sites/%d/settings/TLSConfiguration", siteID)
203208
server := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
@@ -217,7 +222,7 @@ func TestReadSiteSSLSettingsHandleInvalidResponseBody(t *testing.T) {
217222
client := &Client{config: config, httpClient: &http.Client{}}
218223

219224
// act
220-
_, _, err := client.ReadSiteSSLSettings(siteID)
225+
_, _, err := client.ReadSiteSSLSettings(siteID, accountID)
221226

222227
// assert
223228
if err == nil {
@@ -234,6 +239,7 @@ func TestReadSiteSSLSettingsSuccess(t *testing.T) {
234239
apiID := "foo"
235240
apiKey := "bar"
236241
siteID := 42
242+
accountID := 1234
237243

238244
var validResponse = getValidJSONResponse()
239245

@@ -253,7 +259,7 @@ func TestReadSiteSSLSettingsSuccess(t *testing.T) {
253259
client := &Client{config: config, httpClient: &http.Client{}}
254260

255261
// act
256-
_, statusCode, err := client.ReadSiteSSLSettings(siteID)
262+
_, statusCode, err := client.ReadSiteSSLSettings(siteID, accountID)
257263

258264
// assert
259265
if err != nil {
@@ -269,7 +275,7 @@ func getUpdateSiteSSLSettingsDTO() SSLSettingsResponse {
269275
var sslSettingsDTO = SSLSettingsResponse{
270276
Data: []SSLSettingsDTO{
271277
{
272-
HstsConfiguration: HSTSConfiguration{
278+
HstsConfiguration: &HSTSConfiguration{
273279
PreLoaded: true,
274280
MaxAge: 1237,
275281
SubDomainsIncluded: true,

‎incapsula/resource_site_ssl_settings.go‎

Lines changed: 40 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
66
"log"
77
"strconv"
8+
"strings"
89
)
910

1011
var hstsConfigResource = schema.Resource{
@@ -69,13 +70,32 @@ func resourceSiteSSLSettings() *schema.Resource {
6970
Delete: resourceSiteSSLSettingsDelete,
7071
Importer: &schema.ResourceImporter{
7172
State: func(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
72-
siteID, err := strconv.Atoi(d.Id())
73-
if err != nil {
74-
fmt.Errorf("failed to convert Site Id from import command, actual value: %s, expected numeric id", d.Id())
73+
idSlice := strings.Split(d.Id(), "/")
74+
log.Printf("[DEBUG] Starting to import site ssl settings. Parameters: %s\n", d.Id())
75+
76+
if len(idSlice) > 2 || idSlice[0] == "" {
77+
return nil, fmt.Errorf("unexpected format of ID (%q), expected site_id or site_id/account_id", d.Id())
7578
}
7679

80+
siteID, err := strconv.Atoi(idSlice[0])
81+
if err != nil {
82+
fmt.Errorf("failed to convert Site Id from import command, actual value: %s, expected numeric id", idSlice[0])
83+
}
7784
d.Set("site_id", siteID)
78-
log.Printf("[DEBUG] Import Site Config JSON for Site ID %d", siteID)
85+
86+
if len(idSlice) == 2 {
87+
if idSlice[1] == "" {
88+
return nil, fmt.Errorf("unexpected format of ID (%q), expected site_id or site_id/account_id", d.Id())
89+
}
90+
91+
accountID, err := strconv.Atoi(idSlice[1])
92+
if err != nil {
93+
fmt.Errorf("failed to convert Account Id from import command, actual value: %s, expected numeric id", idSlice[1])
94+
}
95+
d.Set("account_id", accountID)
96+
}
97+
98+
log.Printf("[DEBUG] Import Site ssl settings for Site ID %d", siteID)
7999
return []*schema.ResourceData{d}, nil
80100
},
81101
},
@@ -87,6 +107,11 @@ func resourceSiteSSLSettings() *schema.Resource {
87107
Required: true,
88108
ForceNew: true,
89109
},
110+
"account_id": {
111+
Description: "Numeric identifier of the account in which the site is located",
112+
Type: schema.TypeInt,
113+
Optional: true,
114+
},
90115
"hsts": {
91116
Type: schema.TypeSet,
92117
Optional: true,
@@ -108,7 +133,7 @@ func resourceSiteSSLSettingsUpdate(d *schema.ResourceData, m interface{}) error
108133

109134
setting := getSSLSettingsDTO(d)
110135

111-
_, err := client.UpdateSiteSSLSettings(d.Get("site_id").(int), setting)
136+
_, err := client.UpdateSiteSSLSettings(d.Get("site_id").(int), d.Get("account_id").(int), setting)
112137

113138
if err != nil {
114139
return err
@@ -120,7 +145,7 @@ func resourceSiteSSLSettingsUpdate(d *schema.ResourceData, m interface{}) error
120145
func resourceSiteSSLSettingsRead(d *schema.ResourceData, m interface{}) error {
121146
client := m.(*Client)
122147

123-
settingsData, statusCode, err := client.ReadSiteSSLSettings(d.Get("site_id").(int))
148+
settingsData, statusCode, err := client.ReadSiteSSLSettings(d.Get("site_id").(int), d.Get("account_id").(int))
124149
if statusCode == 404 {
125150
d.SetId("")
126151
return nil
@@ -150,7 +175,7 @@ func resourceSiteSSLSettingsDelete(d *schema.ResourceData, m interface{}) error
150175
// If more settings are implemented in the endpoint, add delete logic for them here.
151176
setting := prepareDisableHSTSStructure()
152177
prepareDefaultTLSStructure(&setting)
153-
var _, err = client.UpdateSiteSSLSettings(d.Get("site_id").(int), setting)
178+
var _, err = client.UpdateSiteSSLSettings(d.Get("site_id").(int), d.Get("account_id").(int), setting)
154179

155180
if err != nil {
156181
return err
@@ -160,7 +185,7 @@ func resourceSiteSSLSettingsDelete(d *schema.ResourceData, m interface{}) error
160185
}
161186

162187
func prepareDisableHSTSStructure() SSLSettingsResponse {
163-
disableHSTSSetting := HSTSConfiguration{
188+
disableHSTSSetting := &HSTSConfiguration{
164189
IsEnabled: false,
165190
}
166191

@@ -185,7 +210,7 @@ func prepareDefaultTLSStructure(settingsData *SSLSettingsResponse) {
185210

186211
func mapHSTSResponseToHSTSResource(d *schema.ResourceData, settingsData *SSLSettingsResponse) {
187212
// handle HSTS remote configuration mapping
188-
var hstsSettingsFromServer HSTSConfiguration
213+
var hstsSettingsFromServer *HSTSConfiguration
189214
hstsSettingsFromServer = settingsData.Data[0].HstsConfiguration
190215
// Get the "hsts" attribute from the resource data
191216
// Create a map to hold the values for the "hsts" nested object
@@ -202,12 +227,15 @@ func mapHSTSResponseToHSTSResource(d *schema.ResourceData, settingsData *SSLSett
202227
// END HSTS mapping
203228
}
204229

205-
func mapHSTSResourceToHSTSDTO(d *schema.ResourceData) HSTSConfiguration {
206-
hsts := d.Get("hsts").(*schema.Set)
230+
func mapHSTSResourceToHSTSDTO(d *schema.ResourceData) *HSTSConfiguration {
231+
hsts, ok := d.Get("hsts").(*schema.Set)
232+
if !ok || hsts.Len() == 0 {
233+
return nil
234+
}
207235
hstsList := hsts.List()
208236
hstsMap := hstsList[0].(map[string]interface{})
209237

210-
return HSTSConfiguration{
238+
return &HSTSConfiguration{
211239
IsEnabled: hstsMap["is_enabled"].(bool),
212240
MaxAge: hstsMap["max_age"].(int),
213241
PreLoaded: hstsMap["pre_loaded"].(bool),

‎website/docs/r/site_ssl_settings.html.markdown‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,30 @@ If you run the SSL settings resource from a site for which SSL is not yet enable
2626
resource "incapsula_site_ssl_settings" "example" {
2727
site_id = incapsula_site.mysite.id
2828
29-
hsts {
30-
is_enabled = true
31-
max_age = 86400
32-
sub_domains_included = true
33-
pre_loaded = false
29+
hsts {
30+
is_enabled = true
31+
max_age = 31536000
32+
sub_domains_included = false
33+
pre_loaded = false
3434
}
35-
inbound_tls_settings {
36-
configuration_profile = "CUSTOM"
3735
38-
tls_configuration {
39-
tls_version = "TLS_1_2"
40-
ciphers_support = ["TLS_CHACHA20_POLY1305_SHA256", "TLS_AES_256_GCM_SHA384"]
36+
inbound_tls_settings {
37+
configuration_profile = "CUSTOM"
38+
39+
tls_configuration {
40+
tls_version = "TLS_1_2"
41+
ciphers_support = [
42+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
43+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
44+
]
4145
}
42-
tls_configuration {
43-
tls_version = "TLS_1_3"
44-
ciphers_support = ["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
46+
tls_configuration {
47+
tls_version = "TLS_1_3"
48+
ciphers_support = [
49+
"TLS_AES_128_GCM_SHA256",
50+
"TLS_CHACHA20_POLY1305_SHA256",
51+
"TLS_AES_256_GCM_SHA384",
52+
]
4553
}
4654
}
4755
}
@@ -99,9 +107,10 @@ The following attributes are exported:
99107

100108
## Import
101109

102-
Site SSL settings can be imported using the `id`:
110+
Site SSL settings can be imported using the `siteId` or `siteId`/`accountId` for sub-accounts:
103111
```
104112
terraform import incapsula_site_ssl_settings.example 1234
113+
terraform import incapsula_site_ssl_settings.example 1234/4321
105114
```
106115

107116

0 commit comments

Comments
 (0)