The module doesn't support using TLS_JA3_FINGERPRINT in enforce on key

[mqmr]

[NOT A CONTRIBUTION]

It seems the module doesn't support setting TLS_JA3_FINGERPRINT, while the documentation [1] and examples [2] show it's possible.

│ Error: expected rule.60.rate_limit_options.0.enforce_on_key to be one of ["ALL" "IP" "HTTP_HEADER" "XFF_IP" "HTTP_COOKIE" "HTTP_PATH" "SNI" "REGION_CODE" ""], got TLS_JA3_FINGERPRINT

│ Error: expected rule.60.rate_limit_options.0.enforce_on_key_configs.0.enforce_on_key_type to be one of ["ALL" "IP" "HTTP_HEADER" "XFF_IP" "HTTP_COOKIE" "HTTP_PATH" "SNI" "REGION_CODE"], got TLS_JA3_FINGERPRINT

Would it be possible to extend the module to support that as well? Thank you

[1] https://cloud.google.com/armor/docs/rate-limiting-overview#identifying_clients_for_rate_limiting [2] https://cloud.google.com/armor/docs/configure-rate-limiting#ja3

[imrannayer]

@mqmr enforce_on_key_configs is a list of maps. Here is an example.

Can you try this and see if it works?

enforce_on_key_configs = [
          {
            enforce_on_key_type = "TLS_JA3_FINGERPRINT"
          },
          {
            enforce_on_key_type = "HTTP_PATH"
          },
          {
            enforce_on_key_type = "HTTP_COOKIE"
            enforce_on_key_name = "site_id"
          }
        ]

[mqmr]

@imrannayer

Thank you for the suggestion. Unfortunately, that doesn't work as well.

The second output in the initial message is for that very case.

I should've been more precise in my request. Actually, the provider doesn't support that feature:

• https://github.com/hashicorp/terraform-provider-google-beta/blob/f3462a7e0dd9c004586d6fb3e231356ec4d1b2f3/google-beta/services/compute/resource_compute_security_policy.go#L288
• https://github.com/hashicorp/terraform-provider-google/blob/ef4977ad913d503012c2d17418790bad960933bc/google/services/compute/resource_compute_security_policy.go#L221

[imrannayer]

@mqmr for provider issue can u plz create a ticket here

[mqmr]

https://github.com/hashicorp/terraform-provider-google/issues/17469

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[imrannayer]

will be available in provider version 5.31

[imrannayer]

it is available in 5.31.