Allow managing the complete firewall state for a VPC

[marcus-kempe]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

In much the same way as it is possible to have complete control over all IAM bindings within an organization (google_organization_iam_binding vs google_organization_iam_policy), it would be great to have a resource that represent all firewall rules within a VPC.

Now unfortunately the current resource that is used to represent firewall rules is kind of incorrectly named google_compute_firewall. It should likely have been called google_compute_firewall_rule instead (analogous to google_app_engine_firewall_rule). If it were, it would have made sense to have an aggregation resource called google_compute_firewall that instead maintains state of all rules within a VPCs firewall, which is also analogous to the naming convention in cloud console.

I realize that it is likely hard to change the name of the current resource, but it would be great if there was another good solution to the same problem (I'm a little at loss thinking of another resource name that would work instead).

My use case for this is primarily to make certain that there is no configuration drift between the repository and the actual firewall, which can then be monitored for compliance reasons.

New or Affected Resource(s)

• google_compute_firewall
• google_compute_firewall_rule

b/356665445

[rileykarson]

Note: This request is for a plural firewall resource i.e. google_compute_firewalls