PaloAltoNetworks / terraform-provider-scm

The Terraform provider for Strata Cloud Manager
Apache License 2.0
7 stars 2 forks source link

scm_hip_object resource fails to create if setting the disk_backup attribute and within/not_within is specified #13

Closed ancoleman closed 6 months ago

ancoleman commented 6 months ago

Describe the bug

_scm_hipobject resource when leveraging the attribute within or not_within fails to create the resource as both days and hours are being enforced at the same time. This should be an or scenario when using days or hours.

Configuration being used:

 terraform-disk-bkp:
    folder: Shared
    description: "Check if disk backup is enabled and configured correctly"
    disk_backup:
      criteria:
        is_installed: true # Boolean only values
        is_enabled: "yes" # Boolean only values
        last_backup_time:
          within:
            hours: 7
      vendor:
        - name: "Apple Inc."
          product:
            - "Time Machine"

Resource is built this way:

resource "scm_hip_object" "this" {
  for_each             = try(var.objects, {})
  folder               = try(each.value.folder, null) # Fail if no folder
  name                 = each.key
  description          = try(each.value.description, null)
  anti_malware         = try(each.value.anti_malware, null)
  certificate          = try(each.value.certificate, null)
  custom_checks        = try(each.value.custom_checks, null)
  data_loss_prevention = try(each.value.data_loss_prevention, null)
  disk_backup          = try(each.value.disk_backup, null)
  disk_encryption      = try(each.value.disk_encryption, null)
  firewall             = try(each.value.firewall, null)
  host_info            = try(each.value.host_info, null)
  mobile_device        = try(each.value.mobile_device, null)
  network_info         = try(each.value.network_info, null)
  patch_management     = try(each.value.patch_management, null)
  device               = try(each.value.device, null)
  snippet              = try(each.value.snippet, null)
}

Expected behavior

You should be able to specify not_available

Current behavior

╷
│ Error: Error creating config
│ 
│   with module.hip_with_yaml.scm_hip_object.this["terraform-disk-bkp"],
│   on ../../modules/hip/main.tf line 1, in resource "scm_hip_object" "this":
│    1: resource "scm_hip_object" "this" {
│ 
│ [HTTP 400] API_I00013 Your configuration is not valid. Please review the error message for more details. - map[errorType:Invalid Object errors:[] message:[
│ terraform-disk-bkp -> disk-backup -> criteria -> last-backup-time -> within  cannot have more than one subconfiguration>  terraform-disk-bkp -> disk-backup ->
│ criteria -> last-backup-time -> within is invalid>]]
╵

You can see the plan inserts hours, even when I don't specify it in the configuration. This also happens if I specify hours and not days in the configuration.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.hip_with_yaml.scm_hip_object.this["terraform-disk-bkp"] will be created
  + resource "scm_hip_object" "this" {
      + description = "Check if disk backup is enabled and configured correctly"
      + disk_backup = {
          + criteria       = {
              + is_installed     = true
              + last_backup_time = {
                  + not_available = false
                  + within        = {
                      + days  = 1
                      + hours = 7
                    }
                }
            }
          + exclude_vendor = false
        }
      + folder      = "Shared"
      + id          = (known after apply)
      + name        = "terraform-disk-bkp"
      + tfid        = (known after apply)
    }

Possible solution

Steps to reproduce

  1. Use the same configuration as my yaml example

Context

Your Environment