From 79903cd7ea88f90d4d5e65befa77c2e831d4c79a Mon Sep 17 00:00:00 2001 From: Radek Simko Date: Fri, 19 May 2017 17:59:15 +0200 Subject: [PATCH] provider/aws: Allow updating tuples in WAF SQLInjectionMatchSet + no tuples (#14667) * provider/aws: Allow updating tuples in WAF SQL Injection Match Set * provider/aws: Allow WAF SQL Injection match set with no tuples --- ...esource_aws_waf_sql_injection_match_set.go | 97 ++++++++++++----- ...ce_aws_waf_sql_injection_match_set_test.go | 101 ++++++++++++++++++ 2 files changed, 172 insertions(+), 26 deletions(-) diff --git a/builtin/providers/aws/resource_aws_waf_sql_injection_match_set.go b/builtin/providers/aws/resource_aws_waf_sql_injection_match_set.go index c888efe5a5..808373c4a2 100644 --- a/builtin/providers/aws/resource_aws_waf_sql_injection_match_set.go +++ b/builtin/providers/aws/resource_aws_waf_sql_injection_match_set.go @@ -98,30 +98,42 @@ func resourceAwsWafSqlInjectionMatchSetRead(d *schema.ResourceData, meta interfa } d.Set("name", resp.SqlInjectionMatchSet.Name) + d.Set("sql_injection_match_tuples", resp.SqlInjectionMatchSet.SqlInjectionMatchTuples) return nil } func resourceAwsWafSqlInjectionMatchSetUpdate(d *schema.ResourceData, meta interface{}) error { - log.Printf("[INFO] Updating SqlInjectionMatchSet: %s", d.Get("name").(string)) - err := updateSqlInjectionMatchSetResource(d, meta, waf.ChangeActionInsert) - if err != nil { - return errwrap.Wrapf("[ERROR] Error updating SqlInjectionMatchSet: {{err}}", err) + conn := meta.(*AWSClient).wafconn + + if d.HasChange("sql_injection_match_tuples") { + o, n := d.GetChange("sql_injection_match_tuples") + oldT, newT := o.(*schema.Set).List(), n.(*schema.Set).List() + + err := updateSqlInjectionMatchSetResource(d.Id(), oldT, newT, conn) + if err != nil { + return errwrap.Wrapf("[ERROR] Error updating SqlInjectionMatchSet: {{err}}", err) + } } + return resourceAwsWafSqlInjectionMatchSetRead(d, meta) } func resourceAwsWafSqlInjectionMatchSetDelete(d *schema.ResourceData, meta interface{}) error { conn := meta.(*AWSClient).wafconn - log.Printf("[INFO] Deleting SqlInjectionMatchSet: %s", d.Get("name").(string)) - err := updateSqlInjectionMatchSetResource(d, meta, waf.ChangeActionDelete) - if err != nil { - return errwrap.Wrapf("[ERROR] Error deleting SqlInjectionMatchSet: {{err}}", err) + oldTuples := d.Get("sql_injection_match_tuples").(*schema.Set).List() + + if len(oldTuples) > 0 { + noTuples := []interface{}{} + err := updateSqlInjectionMatchSetResource(d.Id(), oldTuples, noTuples, conn) + if err != nil { + return errwrap.Wrapf("[ERROR] Error deleting SqlInjectionMatchSet: {{err}}", err) + } } wr := newWafRetryer(conn, "global") - _, err = wr.RetryWithToken(func(token *string) (interface{}, error) { + _, err := wr.RetryWithToken(func(token *string) (interface{}, error) { req := &waf.DeleteSqlInjectionMatchSetInput{ ChangeToken: token, SqlInjectionMatchSetId: aws.String(d.Id()), @@ -136,29 +148,16 @@ func resourceAwsWafSqlInjectionMatchSetDelete(d *schema.ResourceData, meta inter return nil } -func updateSqlInjectionMatchSetResource(d *schema.ResourceData, meta interface{}, ChangeAction string) error { - conn := meta.(*AWSClient).wafconn - +func updateSqlInjectionMatchSetResource(id string, oldT, newT []interface{}, conn *waf.WAF) error { wr := newWafRetryer(conn, "global") _, err := wr.RetryWithToken(func(token *string) (interface{}, error) { req := &waf.UpdateSqlInjectionMatchSetInput{ ChangeToken: token, - SqlInjectionMatchSetId: aws.String(d.Id()), - } - - sqlInjectionMatchTuples := d.Get("sql_injection_match_tuples").(*schema.Set) - for _, sqlInjectionMatchTuple := range sqlInjectionMatchTuples.List() { - simt := sqlInjectionMatchTuple.(map[string]interface{}) - sizeConstraintUpdate := &waf.SqlInjectionMatchSetUpdate{ - Action: aws.String(ChangeAction), - SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{ - FieldToMatch: expandFieldToMatch(simt["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})), - TextTransformation: aws.String(simt["text_transformation"].(string)), - }, - } - req.Updates = append(req.Updates, sizeConstraintUpdate) + SqlInjectionMatchSetId: aws.String(id), + Updates: diffWafSqlInjectionMatchTuples(oldT, newT), } + log.Printf("[INFO] Updating SqlInjectionMatchSet: %s", req) return conn.UpdateSqlInjectionMatchSet(req) }) if err != nil { @@ -167,3 +166,49 @@ func updateSqlInjectionMatchSetResource(d *schema.ResourceData, meta interface{} return nil } + +func flattenWafSqlInjectionMatchTuples(ts []*waf.SqlInjectionMatchTuple) []interface{} { + out := make([]interface{}, len(ts), len(ts)) + for i, t := range ts { + m := make(map[string]interface{}) + m["text_transformation"] = *t.TextTransformation + m["field_to_match"] = flattenFieldToMatch(t.FieldToMatch) + out[i] = m + } + + return out +} + +func diffWafSqlInjectionMatchTuples(oldT, newT []interface{}) []*waf.SqlInjectionMatchSetUpdate { + updates := make([]*waf.SqlInjectionMatchSetUpdate, 0) + + for _, od := range oldT { + tuple := od.(map[string]interface{}) + + if idx, contains := sliceContainsMap(newT, tuple); contains { + newT = append(newT[:idx], newT[idx+1:]...) + continue + } + + updates = append(updates, &waf.SqlInjectionMatchSetUpdate{ + Action: aws.String(waf.ChangeActionDelete), + SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{ + FieldToMatch: expandFieldToMatch(tuple["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})), + TextTransformation: aws.String(tuple["text_transformation"].(string)), + }, + }) + } + + for _, nd := range newT { + tuple := nd.(map[string]interface{}) + + updates = append(updates, &waf.SqlInjectionMatchSetUpdate{ + Action: aws.String(waf.ChangeActionInsert), + SqlInjectionMatchTuple: &waf.SqlInjectionMatchTuple{ + FieldToMatch: expandFieldToMatch(tuple["field_to_match"].(*schema.Set).List()[0].(map[string]interface{})), + TextTransformation: aws.String(tuple["text_transformation"].(string)), + }, + }) + } + return updates +} diff --git a/builtin/providers/aws/resource_aws_waf_sql_injection_match_set_test.go b/builtin/providers/aws/resource_aws_waf_sql_injection_match_set_test.go index 5ea8bca0fb..c9f081b3d9 100644 --- a/builtin/providers/aws/resource_aws_waf_sql_injection_match_set_test.go +++ b/builtin/providers/aws/resource_aws_waf_sql_injection_match_set_test.go @@ -31,6 +31,14 @@ func TestAccAWSWafSqlInjectionMatchSet_basic(t *testing.T) { "aws_waf_sql_injection_match_set.sql_injection_match_set", "name", sqlInjectionMatchSet), resource.TestCheckResourceAttr( "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.data", ""), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.type", "QUERY_STRING"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.text_transformation", "URL_DECODE"), ), }, }, @@ -92,6 +100,78 @@ func TestAccAWSWafSqlInjectionMatchSet_disappears(t *testing.T) { }) } +func TestAccAWSWafSqlInjectionMatchSet_changeTuples(t *testing.T) { + var before, after waf.SqlInjectionMatchSet + setName := fmt.Sprintf("sqlInjectionMatchSet-%s", acctest.RandString(5)) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckAWSWafSqlInjectionMatchSetDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAWSWafSqlInjectionMatchSetConfig(setName), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &before), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.data", ""), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.field_to_match.2316364334.type", "QUERY_STRING"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3367958210.text_transformation", "URL_DECODE"), + ), + }, + { + Config: testAccAWSWafSqlInjectionMatchSetConfig_changeTuples(setName), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &after), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.#", "1"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.4253810390.data", "GET"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.field_to_match.4253810390.type", "METHOD"), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.3333510133.text_transformation", "NONE"), + ), + }, + }, + }) +} + +func TestAccAWSWafSqlInjectionMatchSet_noTuples(t *testing.T) { + var ipset waf.SqlInjectionMatchSet + setName := fmt.Sprintf("sqlInjectionMatchSet-%s", acctest.RandString(5)) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckAWSWafSqlInjectionMatchSetDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAWSWafSqlInjectionMatchSetConfig_noTuples(setName), + Check: resource.ComposeAggregateTestCheckFunc( + testAccCheckAWSWafSqlInjectionMatchSetExists("aws_waf_sql_injection_match_set.sql_injection_match_set", &ipset), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "name", setName), + resource.TestCheckResourceAttr( + "aws_waf_sql_injection_match_set.sql_injection_match_set", "sql_injection_match_tuples.#", "0"), + ), + }, + }, + }) +} + func testAccCheckAWSWafSqlInjectionMatchSetDisappears(v *waf.SqlInjectionMatchSet) resource.TestCheckFunc { return func(s *terraform.State) error { conn := testAccProvider.Meta().(*AWSClient).wafconn @@ -218,3 +298,24 @@ resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" { } }`, name) } + +func testAccAWSWafSqlInjectionMatchSetConfig_changeTuples(name string) string { + return fmt.Sprintf(` +resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" { + name = "%s" + sql_injection_match_tuples { + text_transformation = "NONE" + field_to_match { + type = "METHOD" + data = "GET" + } + } +}`, name) +} + +func testAccAWSWafSqlInjectionMatchSetConfig_noTuples(name string) string { + return fmt.Sprintf(` +resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" { + name = "%s" +}`, name) +}