feat(albwaf): onboard WAF

docs/data-sources/alb_waf_configuration.md

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_configuration Data Source - stackit"
+subcategory: ""
+description: |-
+  albwaf resource schema.
+---
+
+# stackit_alb_waf_configuration (Data Source)
+
+albwaf resource schema.
+
+## Example Usage
+
+```terraform
+data "stackit_alb_waf_configuration" "waf" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the WAF Configuration.
+- `project_id` (String) STACKIT project ID to which the WAF Configuration is associated.
+
+### Optional
+
+- `custom_rule_group_name` (String) Name of the custom rule group for this WAF Configuration.
+- `labels` (Map of String) User-defined metadata as key-value pairs. Should not exceed 64 entries.
+- `managed_rule_set_name` (String) Name of the managed rule set configuration for this WAF Configuration.
+- `region` (String) The resource region (e.g. eu01). If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`".
+- `usage` (Attributes) Object containing usage-information for this WAF Configuration. (see [below for nested schema](#nestedatt--usage))
+
+<a id="nestedatt--usage"></a>
+### Nested Schema for `usage`
+
+Read-Only:
+
+- `count` (Number) Number of listeners using this WAF Configuration.
+- `items` (Attributes List) List of Application Load Balancers with their associated listeners that use this WAF Configuration. (see [below for nested schema](#nestedatt--usage--items))
+
+<a id="nestedatt--usage--items"></a>
+### Nested Schema for `usage.items`
+
+Read-Only:
+
+- `listener_names` (List of String) List of listener names in this Application Load Balancer using this WAF Configuration.
+- `load_balancer_name` (String) The display name of the Application Load Balancer.

docs/resources/alb_waf_configuration.md

@@ -0,0 +1,56 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_configuration Resource - stackit"
+subcategory: ""
+description: |-
+  albwaf resource schema.
+---
+
+# stackit_alb_waf_configuration (Resource)
+
+albwaf resource schema.
+
+## Example Usage
+
+```terraform
+resource "stackit_alb_waf" "waf" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the WAF Configuration.
+- `project_id` (String) STACKIT project ID to which the WAF Configuration is associated.
+
+### Optional
+
+- `custom_rule_group_name` (String) Name of the custom rule group for this WAF Configuration.
+- `labels` (Map of String) User-defined metadata as key-value pairs. Should not exceed 64 entries.
+- `managed_rule_set_name` (String) Name of the managed rule set configuration for this WAF Configuration.
+- `region` (String) The resource region (e.g. eu01). If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource ID. It is structured as "`project_id`,`region`".
+- `usage` (Attributes) Object containing usage-information for this WAF Configuration. (see [below for nested schema](#nestedatt--usage))
+
+<a id="nestedatt--usage"></a>
+### Nested Schema for `usage`
+
+Read-Only:
+
+- `count` (Number) Number of listeners using this WAF Configuration.
+- `items` (Attributes List) List of Application Load Balancers with their associated listeners that use this WAF Configuration. (see [below for nested schema](#nestedatt--usage--items))
+
+<a id="nestedatt--usage--items"></a>
+### Nested Schema for `usage.items`
+
+Read-Only:
+
+- `listener_names` (List of String) List of listener names in this Application Load Balancer using this WAF Configuration.
+- `load_balancer_name` (String) The display name of the Application Load Balancer.

examples/data-sources/stackit_alb_waf_configuration/data-source.tf

@@ -0,0 +1,5 @@
+data "stackit_alb_waf_configuration" "waf" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example"
+}
+

examples/resources/stackit_alb_waf_configuration/resource.tf

@@ -0,0 +1,5 @@
+resource "stackit_alb_waf" "waf" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example"
+}
+

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/hashicorp/terraform-plugin-testing v1.16.0
 	github.com/stackitcloud/stackit-sdk-go/core v0.26.0
 	github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0
-	github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0
+	github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0
 	github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0
 	github.com/stackitcloud/stackit-sdk-go/services/certificates v1.9.0
 	github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0

go.sum

@@ -672,8 +672,8 @@ github.com/stackitcloud/stackit-sdk-go/core v0.26.0 h1:jQEb9gkehfp6VCP6TcYk7BI10
 github.com/stackitcloud/stackit-sdk-go/core v0.26.0/go.mod h1:WU1hhxnjXw2EV7CYa1nlEvNpMiRY6CvmIOaHuL3pOaA=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0 h1:WoWlHdzISGXPEaJOYt6HP5F9M5nbyCJL6VqRJZIaOQs=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0/go.mod h1:eK6oRB5Tmpt6KbXQ4UYBGg2LgW5bPtVoncL9E8JSRww=
-github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0 h1:0WsTSSZ0LjNpM3E1d3MgkBXmzMQThVQ7IuXhL2w4EyM=
-github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0/go.mod h1:4M9G1I64kZwlXO32ZoIpt0GAN4SpZ1SYerwCVVIBGoE=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0 h1:ejTZTnGKFUWs9Ch9U30Jd+tpDA/SnHuSF9DpfD6w+To=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0/go.mod h1:4M9G1I64kZwlXO32ZoIpt0GAN4SpZ1SYerwCVVIBGoE=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2 h1:b7WJ/vwxlVmNNX91kI3obqGcuoPAyaCbDL5aCMQ/sNg=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2/go.mod h1:T/JF25XGJ3GqER/1L2N//DgY8x5tY7gA3N+/0nvmOWY=
 github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0 h1:k+KJ4gp9awhJMY5y55vDqRSr6G/S9+8haTNILGbgH9s=

stackit/internal/services/albwaf/albwaf_acc_test.go

@@ -22,44 +22,55 @@ import (
 )
 
 var (
-	//go:embed testdata/managed-rule-set.tf
-	managedRuleSetConfig string
+	//go:embed testdata/resource-max.tf
+	wafConfig string
 )
 
-var testManagedRuleSet = config.Variables{
-	"project_id": config.StringVariable(testutil.ProjectId),
-	"name":       config.StringVariable("tf-acc-" + acctest.RandStringFromCharSet(8, acctest.CharSetAlpha)),
-	"type":       config.StringVariable("TYPE_OWASP_CRS"),
+var testConfigVarsMax = config.Variables{
+	"project_id":              config.StringVariable(testutil.ProjectId),
+	"waf_configuration_name":  config.StringVariable("tf-acc-" + acctest.RandStringFromCharSet(8, acctest.CharSetAlpha)),
+	"rule_set_name":           config.StringVariable("tf-acc-" + acctest.RandStringFromCharSet(8, acctest.CharSetAlpha)),
+	"type":                    config.StringVariable("TYPE_OWASP_CRS"),
+	"waf_configuration_label": config.StringVariable("some-label"),
 }
 
-var testManagedRuleSetUpdated = func() config.Variables {
+var testConfigVarsMaxUpdated = func() config.Variables {
 	updatedConfig := config.Variables{}
-	maps.Copy(updatedConfig, testManagedRuleSet)
-	updatedConfig["name"] = config.StringVariable(fmt.Sprintf("%s-updated", testutil.ConvertConfigVariable(updatedConfig["name"])))
+	maps.Copy(updatedConfig, testConfigVarsMax)
+	updatedConfig["waf_configuration_name"] = config.StringVariable(fmt.Sprintf("%s-updated", testutil.ConvertConfigVariable(updatedConfig["waf_configuration_name"])))
+	updatedConfig["rule_set_name"] = config.StringVariable(fmt.Sprintf("%s-updated", testutil.ConvertConfigVariable(updatedConfig["rule_set_name"])))
+	updatedConfig["waf_configuration_label"] = config.StringVariable(fmt.Sprintf("%s-updated", testutil.ConvertConfigVariable(updatedConfig["waf_configuration_label"])))
 	return updatedConfig
 }
 
-func TestAccManagedRuleSet(t *testing.T) {
+func TestAccWafResourceMax(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		ProtoV6ProviderFactories: testutil.TestAccProtoV6ProviderFactories,
 		CheckDestroy:             testAccCheckDestroy,
 		Steps: []resource.TestStep{
 			// Creation
 			{
-				ConfigVariables: testManagedRuleSet,
-				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig),
+				ConfigVariables: testConfigVarsMax,
+				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), wafConfig),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
 					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "region", testutil.Region),
 					resource.TestCheckResourceAttrSet("stackit_alb_waf_managed_rule_set.managed_rule_set", "id"),
-					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSet["name"])),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testConfigVarsMax["rule_set_name"])),
 
-					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "region", testutil.Region),
+					resource.TestCheckResourceAttrSet("stackit_alb_waf_configuration.waf_instance", "id"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "name", testutil.ConvertConfigVariable(testConfigVarsMax["waf_configuration_name"])),
+					resource.TestCheckResourceAttrPair("stackit_alb_waf_configuration.waf_instance", "managed_rule_set_name", "stackit_alb_waf_managed_rule_set.managed_rule_set", "name"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "labels.label1", testutil.ConvertConfigVariable(testConfigVarsMax["waf_configuration_label"])),
+
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "usage.count", "0"),
 				),
 			},
 			// Data source
 			{
-				ConfigVariables: testManagedRuleSet,
+				ConfigVariables: testConfigVarsMax,
 				Config: fmt.Sprintf(`
 					%s
 					%s
@@ -68,8 +79,14 @@ func TestAccManagedRuleSet(t *testing.T) {
 					  project_id = stackit_alb_waf_managed_rule_set.managed_rule_set.project_id
 					  name  = stackit_alb_waf_managed_rule_set.managed_rule_set.name
 					}
+
+					data "stackit_alb_waf_configuration" "waf" {
+					  project_id = stackit_alb_waf_configuration.waf_instance.project_id
+					  name  = stackit_alb_waf_configuration.waf_instance.name
+  					managed_rule_set_name = data.stackit_alb_waf_managed_rule_set.managed_rule_set.name
+					}
 					`,
-					testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig,
+					testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), wafConfig,
 				),
 				Check: resource.ComposeAggregateTestCheckFunc(
 					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
@@ -78,14 +95,41 @@ func TestAccManagedRuleSet(t *testing.T) {
 						"data.stackit_alb_waf_managed_rule_set.managed_rule_set", "id",
 						"stackit_alb_waf_managed_rule_set.managed_rule_set", "id",
 					),
-					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSet["name"])),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testConfigVarsMax["rule_set_name"])),
+
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_configuration.waf", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_configuration.waf", "region", testutil.Region),
+					resource.TestCheckResourceAttrPair(
+						"data.stackit_alb_waf_configuration.waf", "id",
+						"stackit_alb_waf_configuration.waf_instance", "id",
+					),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_configuration.waf", "name", testutil.ConvertConfigVariable(testConfigVarsMax["waf_configuration_name"])),
+					resource.TestCheckResourceAttrPair("data.stackit_alb_waf_configuration.waf", "managed_rule_set_name", "data.stackit_alb_waf_managed_rule_set.managed_rule_set", "name"),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_configuration.waf", "labels.label1", testutil.ConvertConfigVariable(testConfigVarsMax["waf_configuration_label"])),
 
-					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_configuration.waf", "usage.count", "0"),
 				),
 			},
 			// Import
 			{
-				ConfigVariables: testManagedRuleSet,
+				ConfigVariables: testConfigVarsMax,
+				ResourceName:    "stackit_alb_waf_configuration.waf_instance",
+				ImportStateIdFunc: func(s *terraform.State) (string, error) {
+					r, ok := s.RootModule().Resources["stackit_alb_waf_configuration.waf_instance"]
+					if !ok {
+						return "", fmt.Errorf("couldn't find resource stackit_alb_waf_configuration.waf_instance")
+					}
+					name, ok := r.Primary.Attributes["name"]
+					if !ok {
+						return "", fmt.Errorf("couldn't find attribute name")
+					}
+					return fmt.Sprintf("%s,%s,%s", testutil.ProjectId, testutil.Region, name), nil
+				},
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				ConfigVariables: testConfigVarsMax,
 				ResourceName:    "stackit_alb_waf_managed_rule_set.managed_rule_set",
 				ImportStateIdFunc: func(s *terraform.State) (string, error) {
 					r, ok := s.RootModule().Resources["stackit_alb_waf_managed_rule_set.managed_rule_set"]
@@ -103,18 +147,26 @@ func TestAccManagedRuleSet(t *testing.T) {
 			},
 			// Update
 			{
-				ConfigVariables: testManagedRuleSetUpdated(),
-				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig),
+				ConfigVariables: testConfigVarsMaxUpdated(),
+				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), wafConfig),
 				ConfigPlanChecks: resource.ConfigPlanChecks{
 					PreApply: []plancheck.PlanCheck{
-						plancheck.ExpectResourceAction("stackit_alb_waf_managed_rule_set.managed_rule_set", plancheck.ResourceActionReplace),
+						plancheck.ExpectResourceAction("stackit_alb_waf_configuration.waf_instance", plancheck.ResourceActionReplace),
 					},
 				},
 				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "region", testutil.Region),
+					resource.TestCheckResourceAttrSet("stackit_alb_waf_configuration.waf_instance", "id"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "name", testutil.ConvertConfigVariable(testConfigVarsMaxUpdated()["waf_configuration_name"])),
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "labels.label1", testutil.ConvertConfigVariable(testConfigVarsMaxUpdated()["waf_configuration_label"])),
+
+					resource.TestCheckResourceAttr("stackit_alb_waf_configuration.waf_instance", "usage.count", "0"),
+
 					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
 					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "region", testutil.Region),
 					resource.TestCheckResourceAttrSet("stackit_alb_waf_managed_rule_set.managed_rule_set", "id"),
-					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSetUpdated()["name"])),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testConfigVarsMaxUpdated()["rule_set_name"])),
 
 					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
 				),

stackit/internal/services/albwaf/managed_rule_set/resource.go

@@ -432,8 +432,8 @@ func toCreatePayload(_ context.Context, model *Model) (*albWaf.CreateManagedRule
 	}
 
 	payload := &albWaf.CreateManagedRuleSetPayload{
-		Name: model.Name.ValueStringPointer(),
-		Type: new(albWaf.MRSType(model.Type.ValueString())),
+		Name: model.Name.ValueString(),
+		Type: albWaf.MRSType(model.Type.ValueString()),
 	}
 
 	return payload, nil

stackit/internal/services/albwaf/managed_rule_set/resource_test.go

@@ -36,8 +36,8 @@ func TestToCreatePayload(t *testing.T) {
 				Type:      types.StringValue(string(albWaf.MRSTYPE_TYPE_OWASP_CRS)),
 			},
 			expected: &albWaf.CreateManagedRuleSetPayload{
-				Name: testName.ValueStringPointer(),
-				Type: new(albWaf.MRSTYPE_TYPE_OWASP_CRS),
+				Name: testName.ValueString(),
+				Type: albWaf.MRSTYPE_TYPE_OWASP_CRS,
 			},
 			isValid: true,
 		},

stackit/internal/services/albwaf/testdata/resource-max.tf

@@ -0,0 +1,20 @@
+variable "project_id" {}
+variable "waf_configuration_name" {}
+variable "rule_set_name" {}
+variable "type" {}
+variable "waf_configuration_label" {}
+
+resource "stackit_alb_waf_managed_rule_set" "managed_rule_set" {
+  project_id = var.project_id
+  type       = var.type
+  name       = var.rule_set_name
+}
+resource "stackit_alb_waf_configuration" "waf_instance" {
+  project_id            = var.project_id
+  name                  = var.waf_configuration_name
+  managed_rule_set_name = stackit_alb_waf_managed_rule_set.managed_rule_set.name
+  labels = {
+    label1 = var.waf_configuration_label
+  }
+}
+