Skip to content

Commit 160ec74

Browse files
anGie44anGie44
authored
Merge pull request #14617 from terraform-providers/b-wafv2-rule-group-rule
resource/wafv2_rule_group: remove force_new property from arguments to prevent resource recreation
2 parents 5ab1a44 + deb124b commit 160ec74

2 files changed

Lines changed: 263 additions & 37 deletions

File tree

‎aws/resource_aws_wafv2_rule_group.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,6 @@ func resourceAwsWafv2RuleGroup() *schema.Resource {
9595
"name": {
9696
Type: schema.TypeString,
9797
Required: true,
98-
ForceNew: true,
9998
ValidateFunc: validation.StringLenBetween(1, 128),
10099
},
101100
"priority": {

‎aws/resource_aws_wafv2_rule_group_test.go‎

Lines changed: 263 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,43 @@ func TestAccAwsWafv2RuleGroup_basic(t *testing.T) {
1919
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
2020
resourceName := "aws_wafv2_rule_group.test"
2121

22+
resource.ParallelTest(t, resource.TestCase{
23+
PreCheck: func() { testAccPreCheck(t) },
24+
Providers: testAccProviders,
25+
CheckDestroy: testAccCheckAwsWafv2RuleGroupDestroy,
26+
Steps: []resource.TestStep{
27+
{
28+
Config: testAccAwsWafv2RuleGroupConfig_Basic(ruleGroupName),
29+
Check: resource.ComposeTestCheckFunc(
30+
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
31+
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
32+
resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
33+
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
34+
resource.TestCheckResourceAttr(resourceName, "description", ruleGroupName),
35+
resource.TestCheckResourceAttr(resourceName, "rule.#", "0"),
36+
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
37+
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
38+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
39+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
40+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
41+
resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
42+
),
43+
},
44+
{
45+
ResourceName: resourceName,
46+
ImportState: true,
47+
ImportStateVerify: true,
48+
ImportStateIdFunc: testAccAwsWafv2RuleGroupImportStateIdFunc(resourceName),
49+
},
50+
},
51+
})
52+
}
53+
54+
func TestAccAwsWafv2RuleGroup_updateRule(t *testing.T) {
55+
var v wafv2.RuleGroup
56+
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
57+
resourceName := "aws_wafv2_rule_group.test"
58+
2259
resource.ParallelTest(t, resource.TestCase{
2360
PreCheck: func() { testAccPreCheck(t) },
2461
Providers: testAccProviders,
@@ -55,15 +92,115 @@ func TestAccAwsWafv2RuleGroup_basic(t *testing.T) {
5592
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
5693
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
5794
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
58-
resource.TestCheckResourceAttr(resourceName, "rule.#", "2"),
95+
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
96+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
97+
"name": "rule-1",
98+
"priority": "1",
99+
"action.#": "1",
100+
"action.0.allow.#": "0",
101+
"action.0.block.#": "0",
102+
"action.0.count.#": "1",
103+
"statement.#": "1",
104+
"statement.0.geo_match_statement.#": "1",
105+
"statement.0.geo_match_statement.0.country_codes.#": "2",
106+
}),
107+
),
108+
},
109+
{
110+
ResourceName: resourceName,
111+
ImportState: true,
112+
ImportStateVerify: true,
113+
ImportStateIdFunc: testAccAwsWafv2RuleGroupImportStateIdFunc(resourceName),
114+
},
115+
},
116+
})
117+
}
118+
119+
func TestAccAwsWafv2RuleGroup_updateRuleProperties(t *testing.T) {
120+
var v wafv2.RuleGroup
121+
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
122+
resourceName := "aws_wafv2_rule_group.test"
123+
ruleName2 := fmt.Sprintf("%s-2", ruleGroupName)
124+
125+
resource.ParallelTest(t, resource.TestCase{
126+
PreCheck: func() { testAccPreCheck(t) },
127+
Providers: testAccProviders,
128+
CheckDestroy: testAccCheckAwsWafv2RuleGroupDestroy,
129+
Steps: []resource.TestStep{
130+
{
131+
Config: testAccAwsWafv2RuleGroupConfig_BasicUpdate(ruleGroupName),
132+
Check: resource.ComposeTestCheckFunc(
133+
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
134+
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
135+
resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
136+
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
137+
resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
138+
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
139+
resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
140+
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
141+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
142+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
143+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
144+
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
59145
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
60-
"name": "rule-2",
61-
"priority": "10",
146+
"name": "rule-1",
147+
"priority": "1",
62148
"action.#": "1",
63149
"action.0.allow.#": "0",
64-
"action.0.block.#": "1",
65-
"action.0.count.#": "0",
66-
"statement.#": "1",
150+
"action.0.block.#": "0",
151+
"action.0.count.#": "1",
152+
"visibility_config.0.cloudwatch_metrics_enabled": "false",
153+
"visibility_config.0.metric_name": "friendly-rule-metric-name",
154+
"visibility_config.0.sampled_requests_enabled": "false",
155+
"statement.#": "1",
156+
"statement.0.geo_match_statement.#": "1",
157+
"statement.0.geo_match_statement.0.country_codes.#": "2",
158+
}),
159+
),
160+
},
161+
{
162+
// Test step verifies addition of a rule block with the first block unchanged
163+
Config: testAccAwsWafv2RuleGroupConfig_UpdateMultipleRules(ruleGroupName, "rule-1", ruleName2, 1, 2),
164+
Check: resource.ComposeTestCheckFunc(
165+
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
166+
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
167+
resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
168+
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
169+
resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
170+
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
171+
resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
172+
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
173+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
174+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
175+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
176+
resource.TestCheckResourceAttr(resourceName, "rule.#", "2"),
177+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
178+
"name": "rule-1",
179+
"priority": "1",
180+
"action.#": "1",
181+
"action.0.allow.#": "0",
182+
"action.0.block.#": "0",
183+
"action.0.count.#": "1",
184+
"visibility_config.#": "1",
185+
"visibility_config.0.cloudwatch_metrics_enabled": "false",
186+
"visibility_config.0.metric_name": "rule-1",
187+
"visibility_config.0.sampled_requests_enabled": "false",
188+
"statement.#": "1",
189+
"statement.0.geo_match_statement.#": "1",
190+
"statement.0.geo_match_statement.0.country_codes.#": "2",
191+
}),
192+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
193+
"name": ruleName2,
194+
"priority": "2",
195+
"action.#": "1",
196+
"action.0.allow.#": "0",
197+
"action.0.block.#": "1",
198+
"action.0.count.#": "0",
199+
"visibility_config.#": "1",
200+
"visibility_config.0.cloudwatch_metrics_enabled": "false",
201+
"visibility_config.0.metric_name": ruleName2,
202+
"visibility_config.0.sampled_requests_enabled": "false",
203+
"statement.#": "1",
67204
"statement.0.size_constraint_statement.#": "1",
68205
"statement.0.size_constraint_statement.0.comparison_operator": "LT",
69206
"statement.0.size_constraint_statement.0.field_to_match.#": "1",
@@ -79,13 +216,65 @@ func TestAccAwsWafv2RuleGroup_basic(t *testing.T) {
79216
"priority": "5",
80217
"type": "NONE",
81218
}),
219+
),
220+
},
221+
{
222+
// Test step to verify a change in priority for rule #1 and a change in name and priority for rule #2
223+
Config: testAccAwsWafv2RuleGroupConfig_UpdateMultipleRules(ruleGroupName, "rule-1", "updated", 5, 10),
224+
Check: resource.ComposeTestCheckFunc(
225+
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
226+
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
227+
resource.TestCheckResourceAttr(resourceName, "capacity", "50"),
228+
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
229+
resource.TestCheckResourceAttr(resourceName, "description", "Updated"),
230+
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
231+
resource.TestCheckResourceAttr(resourceName, "tags.%", "0"),
232+
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
233+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.cloudwatch_metrics_enabled", "false"),
234+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.metric_name", "friendly-metric-name"),
235+
resource.TestCheckResourceAttr(resourceName, "visibility_config.0.sampled_requests_enabled", "false"),
236+
resource.TestCheckResourceAttr(resourceName, "rule.#", "2"),
82237
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
83-
"name": "rule-1",
84-
"priority": "1",
85-
"action.#": "1",
86-
"action.0.allow.#": "0",
87-
"action.0.block.#": "0",
88-
"action.0.count.#": "1",
238+
"name": "rule-1",
239+
"priority": "5",
240+
"action.#": "1",
241+
"action.0.allow.#": "0",
242+
"action.0.block.#": "0",
243+
"action.0.count.#": "1",
244+
"visibility_config.#": "1",
245+
"visibility_config.0.cloudwatch_metrics_enabled": "false",
246+
"visibility_config.0.metric_name": "rule-1",
247+
"visibility_config.0.sampled_requests_enabled": "false",
248+
"statement.#": "1",
249+
"statement.0.geo_match_statement.#": "1",
250+
"statement.0.geo_match_statement.0.country_codes.#": "2",
251+
}),
252+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
253+
"name": "updated",
254+
"priority": "10",
255+
"action.#": "1",
256+
"action.0.allow.#": "0",
257+
"action.0.block.#": "1",
258+
"action.0.count.#": "0",
259+
"visibility_config.#": "1",
260+
"visibility_config.0.cloudwatch_metrics_enabled": "false",
261+
"visibility_config.0.metric_name": "updated",
262+
"visibility_config.0.sampled_requests_enabled": "false",
263+
"statement.#": "1",
264+
"statement.0.size_constraint_statement.#": "1",
265+
"statement.0.size_constraint_statement.0.comparison_operator": "LT",
266+
"statement.0.size_constraint_statement.0.field_to_match.#": "1",
267+
"statement.0.size_constraint_statement.0.field_to_match.0.query_string.#": "1",
268+
"statement.0.size_constraint_statement.0.size": "50",
269+
"statement.0.size_constraint_statement.0.text_transformation.#": "2",
270+
}),
271+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*.statement.0.size_constraint_statement.0.text_transformation.*", map[string]string{
272+
"priority": "2",
273+
"type": "CMD_LINE",
274+
}),
275+
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*.statement.0.size_constraint_statement.0.text_transformation.*", map[string]string{
276+
"priority": "5",
277+
"type": "NONE",
89278
}),
90279
),
91280
},
@@ -1235,31 +1424,16 @@ resource "aws_wafv2_rule_group" "test" {
12351424
scope = "REGIONAL"
12361425
12371426
rule {
1238-
name = "rule-2"
1239-
priority = 10
1427+
name = "rule-1"
1428+
priority = 1
12401429
12411430
action {
1242-
block {}
1431+
count {}
12431432
}
12441433
12451434
statement {
1246-
size_constraint_statement {
1247-
comparison_operator = "LT"
1248-
size = 50
1249-
1250-
field_to_match {
1251-
query_string {}
1252-
}
1253-
1254-
text_transformation {
1255-
priority = 5
1256-
type = "NONE"
1257-
}
1258-
1259-
text_transformation {
1260-
priority = 2
1261-
type = "CMD_LINE"
1262-
}
1435+
geo_match_statement {
1436+
country_codes = ["US", "NL"]
12631437
}
12641438
}
12651439
@@ -1270,9 +1444,26 @@ resource "aws_wafv2_rule_group" "test" {
12701444
}
12711445
}
12721446
1447+
visibility_config {
1448+
cloudwatch_metrics_enabled = false
1449+
metric_name = "friendly-metric-name"
1450+
sampled_requests_enabled = false
1451+
}
1452+
}
1453+
`, name)
1454+
}
1455+
1456+
func testAccAwsWafv2RuleGroupConfig_UpdateMultipleRules(name string, ruleName1, ruleName2 string, priority1, priority2 int) string {
1457+
return fmt.Sprintf(`
1458+
resource "aws_wafv2_rule_group" "test" {
1459+
capacity = 50
1460+
name = "%[1]s"
1461+
description = "Updated"
1462+
scope = "REGIONAL"
1463+
12731464
rule {
1274-
name = "rule-1"
1275-
priority = 1
1465+
name = "%[2]s"
1466+
priority = %[3]d
12761467
12771468
action {
12781469
count {}
@@ -1286,7 +1477,43 @@ resource "aws_wafv2_rule_group" "test" {
12861477
12871478
visibility_config {
12881479
cloudwatch_metrics_enabled = false
1289-
metric_name = "friendly-rule-metric-name"
1480+
metric_name = "%[2]s"
1481+
sampled_requests_enabled = false
1482+
}
1483+
}
1484+
1485+
rule {
1486+
name = "%[4]s"
1487+
priority = %[5]d
1488+
1489+
action {
1490+
block {}
1491+
}
1492+
1493+
statement {
1494+
size_constraint_statement {
1495+
comparison_operator = "LT"
1496+
size = 50
1497+
1498+
field_to_match {
1499+
query_string {}
1500+
}
1501+
1502+
text_transformation {
1503+
priority = 5
1504+
type = "NONE"
1505+
}
1506+
1507+
text_transformation {
1508+
priority = 2
1509+
type = "CMD_LINE"
1510+
}
1511+
}
1512+
}
1513+
1514+
visibility_config {
1515+
cloudwatch_metrics_enabled = false
1516+
metric_name = "%[4]s"
12901517
sampled_requests_enabled = false
12911518
}
12921519
}
@@ -1297,7 +1524,7 @@ resource "aws_wafv2_rule_group" "test" {
12971524
sampled_requests_enabled = false
12981525
}
12991526
}
1300-
`, name)
1527+
`, name, ruleName1, priority1, ruleName2, priority2)
13011528
}
13021529

13031530
func testAccAwsWafv2RuleGroupConfig_UpdateCapacity(name string) string {

0 commit comments

Comments
 (0)
⚡