forseti-security / terraform-google-forseti

A Terraform module for installing Forseti on GCP
Apache License 2.0
132 stars 126 forks source link

Ignore content_language changes on rules #615

Closed gaima8 closed 4 years ago

gaima8 commented 4 years ago
  # module.sct_forseti_dev.module.server_rules.google_storage_bucket_object.main[23] must be replaced
-/+ resource "google_storage_bucket_object" "main" {
        bucket           = "forseti-server-........"
        content          = (sensitive value)
      - content_language = "en" -> null # forces replacement

Ignoring content and md5 hash changes tells me you really want to allow the end user to change rules without the module overwriting them. So ignore content_language too.

We're using CFT to manage this deployment if that makes any difference.

google-cla[bot] commented 4 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

gaima8 commented 4 years ago

@googlebot I signed it!

gkowalski-google commented 4 years ago

@gaima8 This change looks fine to me. If you are looking to modify the default rules that ship with Forseti, then you should set manage_rules_enabled = false. When set to false, the Terraform module will not overwrite any rules in GCS during deployment.