data_source_huaweicloud_cfw_access_control_logs.go

// Generated by PMS #127
package cfw

import (
	"context"

	"github.com/hashicorp/go-multierror"
	"github.com/hashicorp/go-uuid"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/tidwall/gjson"

	"github.com/huaweicloud/terraform-provider-huaweicloud/huaweicloud/config"
	"github.com/huaweicloud/terraform-provider-huaweicloud/huaweicloud/helper/httphelper"
	"github.com/huaweicloud/terraform-provider-huaweicloud/huaweicloud/helper/schemas"
	"github.com/huaweicloud/terraform-provider-huaweicloud/huaweicloud/utils"
)

func DataSourceCfwAccessControlLogs() *schema.Resource {
	return &schema.Resource{
		ReadContext: dataSourceCfwAccessControlLogsRead,

		Schema: map[string]*schema.Schema{
			"region": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: `Specifies the region in which to query the resource. If omitted, the provider-level region will be used.`,
			},
			"fw_instance_id": {
				Type:        schema.TypeString,
				Required:    true,
				Description: `Specifies the firewall instance ID.`,
			},
			"start_time": {
				Type:        schema.TypeString,
				Required:    true,
				Description: `Specifies the start time. The time is in UTC.`,
			},
			"end_time": {
				Type:        schema.TypeString,
				Required:    true,
				Description: `Specifies the end time. The time is in UTC.`,
			},
			"src_ip": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the source IP address.`,
			},
			"src_port": {
				Type:        schema.TypeInt,
				Optional:    true,
				Description: `Specifies the source port.`,
			},
			"dst_ip": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the destination IP address.`,
			},
			"dst_port": {
				Type:        schema.TypeInt,
				Optional:    true,
				Description: `Specifies the destination port.`,
			},
			"app": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the application protocol.`,
			},
			"enterprise_project_id": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the enterprise project id.`,
			},
			"rule_name": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the rule name.`,
			},
			"action": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the action. The values can be **allow** and **deny**.`,
			},
			"src_region_name": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the source region name.`,
			},
			"dst_region_name": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: `Specifies the destination region name.`,
			},
			"records": {
				Type:        schema.TypeList,
				Computed:    true,
				Description: `The access control log records.`,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"src_ip": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The source IP address.`,
						},
						"src_port": {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: `The source port.`,
						},
						"dst_port": {
							Type:        schema.TypeInt,
							Computed:    true,
							Description: `The destination port.`,
						},
						"app": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The application protocol.`,
						},
						"rule_name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The rule name.`,
						},
						"rule_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The rule ID.`,
						},
						"hit_time": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The hit time.`,
						},
						"log_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The document ID.`,
						},
						"dst_ip": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The destination IP address.`,
						},
						"protocol": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The protocol type.`,
						},
						"action": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The action.`,
						},
						"src_region_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The source region id.`,
						},
						"src_region_name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The source region name.`,
						},
						"dst_region_id": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The destination region id.`,
						},
						"dst_region_name": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The destination region name.`,
						},
						"dst_host": {
							Type:        schema.TypeString,
							Computed:    true,
							Description: `The destination host.`,
						},
					},
				},
			},
		},
	}
}

type AccessControlLogsDSWrapper struct {
	*schemas.ResourceDataWrapper
	Config *config.Config
}

func newAccessControlLogsDSWrapper(d *schema.ResourceData, meta interface{}) *AccessControlLogsDSWrapper {
	return &AccessControlLogsDSWrapper{
		ResourceDataWrapper: schemas.NewSchemaWrapper(d),
		Config:              meta.(*config.Config),
	}
}

func dataSourceCfwAccessControlLogsRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	wrapper := newAccessControlLogsDSWrapper(d, meta)
	lisAccConLogRst, err := wrapper.ListAccessControlLogs()
	if err != nil {
		return diag.FromErr(err)
	}

	id, err := uuid.GenerateUUID()
	if err != nil {
		return diag.FromErr(err)
	}
	d.SetId(id)

	err = wrapper.listAccessControlLogsToSchema(lisAccConLogRst)
	if err != nil {
		return diag.FromErr(err)
	}

	return nil
}

// @API CFW GET /v1/{project_id}/cfw/logs/access-control
func (w *AccessControlLogsDSWrapper) ListAccessControlLogs() (*gjson.Result, error) {
	client, err := w.NewClient(w.Config, "cfw")
	if err != nil {
		return nil, err
	}
	startTime, err := utils.FormatUTCTimeStamp(w.Get("start_time").(string))
	if err != nil {
		return nil, err
	}
	endTime, err := utils.FormatUTCTimeStamp(w.Get("end_time").(string))
	if err != nil {
		return nil, err
	}

	uri := "/v1/{project_id}/cfw/logs/access-control"
	params := map[string]any{
		"fw_instance_id":        w.Get("fw_instance_id"),
		"start_time":            startTime * 1000,
		"end_time":              endTime * 1000,
		"src_ip":                w.Get("src_ip"),
		"src_port":              w.Get("src_port"),
		"dst_ip":                w.Get("dst_ip"),
		"dst_port":              w.Get("dst_port"),
		"app":                   w.Get("app"),
		"enterprise_project_id": w.Get("enterprise_project_id"),
		"rule_name":             w.Get("rule_name"),
		"action":                w.Get("action"),
		"src_region_name":       w.Get("src_region_name"),
		"dst_region_name":       w.Get("dst_region_name"),
		"limit":                 1000,
	}
	params = utils.RemoveNil(params)
	return httphelper.New(client).
		Method("GET").
		URI(uri).
		Query(params).
		Request().
		Result()
}

func (w *AccessControlLogsDSWrapper) listAccessControlLogsToSchema(body *gjson.Result) error {
	d := w.ResourceData
	mErr := multierror.Append(nil,
		d.Set("region", w.Config.GetRegion(w.ResourceData)),
		d.Set("records", schemas.SliceToList(body.Get("data.records"),
			func(record gjson.Result) any {
				return map[string]any{
					"src_ip":          record.Get("src_ip").Value(),
					"src_port":        record.Get("src_port").Value(),
					"dst_port":        record.Get("dst_port").Value(),
					"app":             record.Get("app").Value(),
					"rule_name":       record.Get("rule_name").Value(),
					"rule_id":         record.Get("rule_id").Value(),
					"hit_time":        w.setDataRecHitTim(&record),
					"log_id":          record.Get("log_id").Value(),
					"dst_ip":          record.Get("dst_ip").Value(),
					"protocol":        record.Get("protocol").Value(),
					"action":          record.Get("action").Value(),
					"src_region_id":   record.Get("src_region_id").Value(),
					"src_region_name": record.Get("src_region_name").Value(),
					"dst_region_id":   record.Get("dst_region_id").Value(),
					"dst_region_name": record.Get("dst_region_name").Value(),
					"dst_host":        record.Get("dst_host").Value(),
				}
			},
		)),
	)
	return mErr.ErrorOrNil()
}

func (*AccessControlLogsDSWrapper) setDataRecHitTim(data *gjson.Result) string {
	endTime := int64(data.Get("end_time").Float() / 1000)
	return utils.FormatTimeStampUTC(endTime)
}