[CNS-9920] support aws paas (#960)

* support aws paas resources * add aws paas network query destinations * add aws paas cloud nodes * run make all
PaloAltoNetworks · Apr 15, 2024 · 5b3e927 · 5b3e927
1 parent 13c9c6d
commit 5b3e927
Show file tree

Hide file tree

Showing 9 changed files with 73 additions and 18 deletions.
diff --git a/cloudnetworkquerydestination.go b/cloudnetworkquerydestination.go
diff --git a/cloudnode.go b/cloudnode.go
diff --git a/custom_validations.go b/custom_validations.go
@@ -1704,16 +1704,26 @@ func ValidateCloudNetworkQueryFilter(attribute string, f *CloudNetworkQueryFilte
 		return makeValidationError(attribute, fmt.Sprintf("paas filtering only allowed for selectors with resource type: %s", CloudNetworkQueryFilterResourceTypePaaS))
 	}
 
-	var azure bool
+	var (
+		isAzure bool
+		isAWS   bool
+	)
 	for _, ct := range f.CloudTypes {
 		if strings.EqualFold(ct, constants.CloudTypeAzure) {
-			azure = true
+			isAzure = true
+			break
+		}
+		if strings.EqualFold(ct, constants.CloudTypeAWS) {
+			isAWS = true
 			break
 		}
 	}
 
-	if f.ResourceType == CloudNetworkQueryFilterResourceTypePaaS && !azure {
-		return makeValidationError(attribute, "paas filtering only allowed for Azure queries")
+	isPaaS := f.ResourceType == CloudNetworkQueryFilterResourceTypePaaS
+	if isPaaS && !isAzure && !isAWS {
+		return makeValidationError(
+			attribute, "PaaS filtering only allowed for Azure or AWS queries",
+		)
 	}
 
 	return nil

diff --git a/custom_validations_test.go b/custom_validations_test.go
@@ -5005,24 +5005,39 @@ func TestValidateCloudGraphQuery(t *testing.T) {
 			true,
 		},
 		{
-			"paas filter is set for AWS",
+			"paas filter is set for GCP",
 			args{
 				"invalid",
 				&CloudNetworkQuery{
 					SourceIP: "1.1.1.0/24",
 					DestinationSelector: &CloudNetworkQueryFilter{
 						ResourceType: CloudNetworkQueryFilterResourceTypePaaS,
-						CloudTypes:   []string{"Aws"},
-						PaasTypes:    []string{"MicrosoftDBforMySQLFlexibleServers"},
+						CloudTypes:   []string{"GCP"},
+						PaasTypes:    []string{"Cloud Functions"},
 					},
 				},
 			},
 			true,
 		},
+		{
+			"paas filter is set for AWS",
+			args{
+				"valid",
+				&CloudNetworkQuery{
+					SourceIP: "1.1.1.0/24",
+					DestinationSelector: &CloudNetworkQueryFilter{
+						ResourceType: CloudNetworkQueryFilterResourceTypePaaS,
+						CloudTypes:   []string{"Aws"},
+						PaasTypes:    []string{"AWS Lambda"},
+					},
+				},
+			},
+			false,
+		},
 		{
 			"paas filter is set for Azure",
 			args{
-				"invalid",
+				"valid",
 				&CloudNetworkQuery{
 					SourceIP: "1.1.1.0/24",
 					DestinationSelector: &CloudNetworkQueryFilter{

diff --git a/doc/documentation.md b/doc/documentation.md
@@ -12788,7 +12788,7 @@ Returns true if the destination is reachable through routing.
 
 ##### `type` [`autogenerated`,`read_only`]
 
-Type: `enum(Interface | Instance | LoadBalancer | PublicIP | K8sService | MySQLServer | MySQLFlexibleServer | PostgreSQLServer | PostgreSQLFlexibleServer | CosmosDB | SQLServer)`
+Type: `enum(Interface | Instance | LoadBalancer | PublicIP | K8sService | MySQLServer | MySQLFlexibleServer | PostgreSQLServer | PostgreSQLFlexibleServer | CosmosDB | SQLServer | LambdaFunction | RDSDBInstance | RedshiftCluster)`
 
 Returns the type of the destination.
 
@@ -13607,7 +13607,7 @@ The sub-type of the object as found in the parameters. Used for indexing.
 
 ##### `type` [`required`]
 
-Type: `enum(Endpoint | Subnet | VPC | Interface | RouteTable | Gateway | NetworkRuleSet | LoadBalancer | LoadBalancerRoute | PublicIPAddress | ScaleSet | ScaleGroup | K8sNode | K8sService | K8sNamespace | K8sPod | MySQLServer | MySQLFlexibleServer | PostgreSQLServer | PostgreSQLFlexibleServer | CosmosDB | SQLServer)`
+Type: `enum(Endpoint | Subnet | VPC | Interface | RouteTable | Gateway | NetworkRuleSet | LoadBalancer | LoadBalancerRoute | PublicIPAddress | ScaleSet | ScaleGroup | K8sNode | K8sService | K8sNamespace | K8sPod | MySQLServer | MySQLFlexibleServer | PostgreSQLServer | PostgreSQLFlexibleServer | CosmosDB | SQLServer | LambdaFunction | RDSDBInstance | RedshiftCluster)`
 
 Type of the endpoint.
 

diff --git a/openapi3_autogen/cloudnetworkquerydestination.json b/openapi3_autogen/cloudnetworkquerydestination.json
@@ -32,7 +32,10 @@
               "PostgreSQLServer",
               "PostgreSQLFlexibleServer",
               "CosmosDB",
-              "SQLServer"
+              "SQLServer",
+              "LambdaFunction",
+              "RDSDBInstance",
+              "RedshiftCluster"
             ],
             "readOnly": true
           },

diff --git a/openapi3_autogen/cloudnode.json b/openapi3_autogen/cloudnode.json
@@ -181,7 +181,10 @@
               "PostgreSQLServer",
               "PostgreSQLFlexibleServer",
               "CosmosDB",
-              "SQLServer"
+              "SQLServer",
+              "LambdaFunction",
+              "RDSDBInstance",
+              "RedshiftCluster"
             ],
             "example": "Endpoint"
           },

diff --git a/specs/cloudnetworkquerydestination.spec b/specs/cloudnetworkquerydestination.spec
@@ -50,6 +50,9 @@ attributes:
     - PostgreSQLFlexibleServer
     - CosmosDB
     - SQLServer
+    - LambdaFunction
+    - RDSDBInstance
+    - RedshiftCluster
     autogenerated: true
 
   - name: verdict

diff --git a/specs/cloudnode.spec b/specs/cloudnode.spec
@@ -122,4 +122,7 @@ attributes:
     - PostgreSQLFlexibleServer
     - CosmosDB
     - SQLServer
+    - LambdaFunction
+    - RDSDBInstance
+    - RedshiftCluster
     example_value: Endpoint