resource_security_group_rule.go

package provider

import (
	"context"
	"errors"
	"strings"

	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
	"github.com/krystal/go-katapult"
	"github.com/krystal/go-katapult/core"
)

func resourceSecurityGroupRule() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceSecurityGroupRuleCreate,
		ReadContext:   resourceSecurityGroupRuleRead,
		UpdateContext: resourceSecurityGroupRuleUpdate,
		DeleteContext: resourceSecurityGroupRuleDelete,
		Importer: &schema.ResourceImporter{
			StateContext: schema.ImportStatePassthroughContext,
		},
		Description: "Allows management of individual security group rules. " +
			"This should only be used with the `katapult_security_group` " +
			"resource if the `external_rules` attribute is enabled. " +
			"Otherwise you should define rules directly on the security " +
			"group resource.",
		Schema: map[string]*schema.Schema{
			"id": {
				Type:     schema.TypeString,
				Computed: true,
				Description: "The ID of the security group rule. This is " +
					"automatically generated by the API.",
			},
			"security_group_id": {
				Type:     schema.TypeString,
				Required: true,
				Description: "The ID of the security group to which the rule " +
					"applies.",
				ValidateFunc: validation.StringIsNotEmpty,
				ForceNew:     true,
			},
			"direction": {
				Type:     schema.TypeString,
				Required: true,
				Description: "The direction of the rule (`inbound` or " +
					"`outbound`).",
				ValidateFunc: validation.StringInSlice(
					[]string{"inbound", "outbound"}, true,
				),
			},
			"protocol": {
				Type:     schema.TypeString,
				Required: true,
				Description: "The protocol of the rule (`TCP`, `UDP`, or " +
					"`ICMP`).",
				ValidateFunc: validation.StringInSlice(
					[]string{"TCP", "UDP", "ICMP"}, true,
				),
				StateFunc: func(v any) string {
					return strings.ToUpper(v.(string))
				},
			},
			"ports": {
				Type:     schema.TypeString,
				Optional: true,
				Description: "The port, ports, or range of ports to which " +
					"the rule applies (e.g. `22`, `22,80,443`, or " +
					"`3000-3999`). If not specified, the rule applies to " +
					"all ports.",
			},
			"targets": {
				Type:     schema.TypeSet,
				Required: true,
				Description: "The targets to which the rule applies. Can be " +
					"IP addresses, CIDR blocks, IDs for virtual machines, " +
					"virtual machine groups, tags, address lists, or " +
					"`all:ipv4` and `all:ipv6`.",
				Elem: &schema.Schema{
					Type:         schema.TypeString,
					ValidateFunc: validation.StringIsNotEmpty,
				},
			},
			"notes": {
				Type:     schema.TypeString,
				Optional: true,
				Description: "Notes for the rule. Used for human reference " +
					"only.",
			},
		},
	}
}

func resourceSecurityGroupRuleCreate(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	sgRef := core.SecurityGroupRef{ID: d.Get("security_group_id").(string)}
	args := &core.SecurityGroupRuleArguments{
		Direction: d.Get("direction").(string),
		Protocol:  strings.ToUpper(d.Get("protocol").(string)),
	}

	if raw, ok := d.GetOk("ports"); ok {
		ports := raw.(string)
		args.Ports = &ports
	}

	if raw, ok := d.GetOk("targets"); ok {
		targets := schemaSetToSlice[string](raw.(*schema.Set))
		args.Targets = &targets
	}

	if raw, ok := d.GetOk("notes"); ok {
		notes := raw.(string)
		args.Notes = &notes
	}

	rule, _, err := m.Core.SecurityGroupRules.Create(ctx, sgRef, args)
	if err != nil {
		return diag.FromErr(err)
	}

	d.SetId(rule.ID)

	// implementation of the create function goes here
	return resourceSecurityGroupRuleRead(ctx, d, meta)
}

func resourceSecurityGroupRuleRead(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)
	var diags diag.Diagnostics

	_, err := sharedSecurityGroupRuleRead(ctx, d, m, d.Id())
	if err != nil {
		if errors.Is(err, katapult.ErrNotFound) {
			d.SetId("")

			return diags
		}

		return diag.FromErr(err)
	}

	return diag.Diagnostics{}
}

func sharedSecurityGroupRuleRead(
	ctx context.Context,
	d *schema.ResourceData,
	m *Meta,
	id string,
) (string, error) {
	sgr, _, err := m.Core.SecurityGroupRules.GetByID(ctx, id)
	if err != nil {
		return "", err
	}

	if sgr.SecurityGroup != nil {
		_ = d.Set("security_group_id", sgr.SecurityGroup.ID)
	}
	_ = d.Set("direction", sgr.Direction)
	_ = d.Set("protocol", sgr.Protocol)
	_ = d.Set("ports", sgr.Ports)
	_ = d.Set("notes", sgr.Notes)

	err = d.Set("targets", stringSliceToSchemaSet(sgr.Targets))
	if err != nil {
		return "", err
	}

	return sgr.ID, nil
}

func resourceSecurityGroupRuleUpdate(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	sgrRef := core.SecurityGroupRuleRef{ID: d.Id()}
	args := &core.SecurityGroupRuleArguments{}

	if d.HasChange("direction") {
		args.Direction = d.Get("direction").(string)
	}

	if d.HasChange("protocol") {
		args.Protocol = strings.ToUpper(d.Get("protocol").(string))
	}

	if d.HasChange("ports") {
		ports := d.Get("ports").(string)
		args.Ports = &ports
	}

	if d.HasChange("targets") {
		targets := schemaSetToSlice[string](d.Get("targets").(*schema.Set))
		args.Targets = &targets
	}

	if d.HasChange("notes") {
		notes := d.Get("notes").(string)
		args.Notes = &notes
	}

	_, _, err := m.Core.SecurityGroupRules.Update(ctx, sgrRef, args)
	if err != nil {
		return diag.FromErr(err)
	}

	return diag.Diagnostics{}
}

func resourceSecurityGroupRuleDelete(
	ctx context.Context,
	d *schema.ResourceData,
	meta interface{},
) diag.Diagnostics {
	m := meta.(*Meta)

	ref := core.SecurityGroupRuleRef{ID: d.Id()}
	_, _, err := m.Core.SecurityGroupRules.Delete(ctx, ref)
	if err != nil && !errors.Is(err, katapult.ErrNotFound) {
		return diag.FromErr(err)
	}

	return diag.Diagnostics{}
}