mt185252
commented
9 months ago Facing similar issue with preconfigured_waf_config block being present in new rules being added via the GCP console.
Seems like its happening only with newly created rules. I have a security policy which was created via the GCP console & has a total of 22 rules(again created via the GCP console), one of these rules was added relatively recently when compared to remaining 21.
I am working on terraform import to construct the state of this security policy and I see that after import for this one particular rule, terraform always tries to delete the preconfigured_waf_config block & as a result re-creates that rule. All the other 21 are just fine.
If I run terraform apply and then immediately run terraform plan I see that it again tries to delete the preconfigured_waf_config block.
To confirm my suspicion that this is been happening only with relatively new rules, I performed the below on the mentioned order:
- Created a new security policy and added 3 rules to it via the GCP console.
- Imported the state using
terraform import. - Ran
terraform plan(this showed that thepreconfigured_waf_configblock in the existing rule has to be deleted & hence the rule will be deleted and recreated.) - Ran
terraform apply(It was successful) - Immediately ran
terraform planagain & had same observations as in step 3.$ terraform plan -out test -var-file ./vars/dev.tfvars module.cloud-armor["test"].google_compute_security_policy.policy: Refreshing state... [id=projects/<project_id>/global/securityPolicies/test]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place
Terraform will perform the following actions:
module.cloud-armor["test"].google_compute_security_policy.policy will be updated in-place
~ resource "google_compute_security_policy" "policy" {
id = "projects/
(5 unchanged attributes hidden)
- adaptive_protection_config {
- layer_7_ddos_defense_config {
- enable = false -> null
}
}
- rule {
- action = "allow" -> null
- description = "test1" -> null
- preview = false -> null
- priority = 10 -> null
- match {
- versioned_expr = "SRC_IPS_V1" -> null
- config {
- src_ip_ranges = [
- "1.1.1.1",
- "2.2.2.2",
] -> null
}
}
- preconfigured_waf_config {
}
}
- rule {
- action = "allow" -> null
- description = "test2" -> null
- preview = false -> null
- priority = 20 -> null
- match {
- versioned_expr = "SRC_IPS_V1" -> null
- config {
- src_ip_ranges = [
- "3.3.3.3",
- "4.4.4.4",
] -> null
}
}
- preconfigured_waf_config {
}
}
- rule {
- action = "deny" -> null
- description = "Default rule, higher priority overrides it" -> null
- preview = false -> null
- priority = 2147483647 -> null
- match {
- versioned_expr = "SRC_IPS_V1" -> null
- config {
- src_ip_ranges = [
- "*",
] -> null
}
}
- preconfigured_waf_config {
}
}
- rule {
- action = "deny(502)" -> null
- description = "test3" -> null
- preview = false -> null
- priority = 30 -> null
- match {
- versioned_expr = "SRC_IPS_V1" -> null
- config {
- src_ip_ranges = [
- "5.5.5.5",
- "6.6.6.6",
] -> null
}
}
- preconfigured_waf_config {
}
}
+ rule {
+ action = "allow"
+ description = "test1"
+ preview = false
+ priority = 10
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = [
+ "1.1.1.1",
+ "2.2.2.2",
]
}
}
}
+ rule {
+ action = "allow"
+ description = "test2"
+ preview = false
+ priority = 20
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = [
+ "3.3.3.3",
+ "4.4.4.4",
]
}
}
}
+ rule {
+ action = "deny"
+ description = "Default rule, higher priority overrides it"
+ preview = (known after apply)
+ priority = 2147483647
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = [
+ "*",
]
}
}
}
+ rule {
+ action = "deny(502)"
+ description = "test3"
+ preview = false
+ priority = 30
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = [
+ "5.5.5.5",
+ "6.6.6.6",
]
}
}
}
# (1 unchanged block hidden)
}
Tried a couple of more times and repeatedly saw this issue occurring.
When I create the policy & rules completely using terraform then I dont see this happening([Using module version v1.1.0](https://github.com/GoogleCloudPlatform/terraform-google-cloud-armor/tree/v1.0.0)).
scramblydevops
aaronclong
mersive-raypitmon
rojomisin
sarnepalli
bradam12
snek-git
haimke111
imrannayer
GangGreenTemperTatum
aebrahim
Kaschman
tonyay163
spinningarrow
Community Note
modular-magicianuser, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned tohashibot, a community member has claimed the issue already.Terraform Version
The same versions were also tested with amd64
Affected Resource(s)
Using resource through module
GoogleCloudPlatform/cloud-armor/googleversion2.0.1Expected Behavior
Terraform plan should be idempotent after terraform apply
Actual Behavior
Terraform always wants to recreate all rules in the security policy even if no changes are made and after applying and checking that all changes have been made.
Example of one rule:
References
https://github.com/hashicorp/terraform-provider-google/issues/9084 The same issue as described and related issues
b/318850546