Migration path from (firewall) rules to ingress/egress_rules

[oliverboehme-ida]

TL;DR

The field rules in firewall-rules module is marked "deprecated". But what is the clean way of transitioning rules to the new fields (ingress_rules, egress_rules) without destroying/re-applying them all?

Terraform Resources

https://github.com/terraform-google-modules/terraform-google-network/tree/master/modules/firewall-rules

Additional information

After painfully re-writing all rules separately to be included in ingress_rules and egress_rules, I found no non-destructive way of transitioning them in Terraform state.

Moved block does not work because the "old" resource "rules" is still existing. Import block does not work because it assumes the resources are not contained in the state (thus destroying the "real" resources too) Manually tf importing has the same effect.

Destroying and re-creating all is too risky.

What now?

[oliverboehme-ida]

CC @imrannayer

[oliverboehme-ida]

For anyone who is interested, I solved it like this:

• Take the old firewall_rules and translate them into ingress_rules and egress_rules.
  • I wrote a script doing this, where the main task is to transform ranges into source_ranges and destination_ranges depending on if it is an Ingress or Egress rule.
• Backup the Terraform state :warning:
• Remove rules from Terraform state.
  • terraform state rm 'module.<module_name>.module.firewall_rules.google_compute_firewall.rules
• Find deployed Firewall rules to import:
  • gcloud compute firewall-rules list --project <project_id> --format='value(name)'
• Generate import-Blocks:

  rules=$(gcloud compute firewall-rules list --project <project_id> --format='value(name)')
  for rule in $rules
  do
  echo "import {
  to       = module.<module_name>.module.firewall_rules.google_compute_firewall.rules_ingress_egress[\"$rule\"]
  id       = \"projects/<project_id>/global/firewalls/$rule\"
  }"
  done

• Add the import-Blocks to Terraform file and apply
  • Expected result is that all Rules are imported, with none added, changed or destroyed :white_check_mark:
• Remove import-Blocks again.