[#15779] Add google_network_security_firewall_endpoint resource

mmv1/products/networksecurity/FirewallEndpoint.yaml

@@ -0,0 +1,112 @@
+# Copyright 2024 Google Inc.
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an 'AS IS' BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+--- !ruby/object:Api::Resource
+name: 'FirewallEndpoint'
+base_url: '{{parent}}/locations/{{location}}/firewallEndpoints'
+create_url: '{{parent}}/locations/{{location}}/firewallEndpoints?firewallEndpointId={{name}}'
+self_link: '{{parent}}/locations/{{location}}/firewallEndpoints/{{name}}'
+min_version: beta
+update_verb: :PATCH
+update_mask: true
+description: |
+  A Firewall endpoint is a Cloud Firewall resource that enables
+  layer 7 advanced protection capabilities, such as intrusion prevention,
+  in your network.
+references:
+  !ruby/object:Api::Resource::ReferenceLinks
+  api: 'https://cloud.google.com/firewall/docs/reference/network-security/rest/v1beta1/organizations.locations.firewallEndpoints'
+  guides:
+    'Firewall endpoint overview': 'https://cloud.google.com/firewall/docs/about-firewall-endpoints'
+    'Create and associate firewall endpoints': 'https://cloud.google.com/firewall/docs/configure-firewall-endpoints'
+timeouts: !ruby/object:Api::Timeouts
+  insert_minutes: 60
+  update_minutes: 60
+  delete_minutes: 60
+async: !ruby/object:Api::OpAsync
+  include_project: true
+  operation: !ruby/object:Api::OpAsync::Operation
+    base_url: '{{op_id}}'
+    result: !ruby/object:Api::OpAsync::Result
+      resource_inside_response: true
+autogen_async: true
+import_format: ['{{%parent}}/locations/{{location}}/firewallEndpoints/{{name}}']
+examples:
+  - !ruby/object:Provider::Terraform::Examples
+    name: 'network_security_firewall_endpoint_basic'
+    primary_resource_id: 'default'
+    skip_test: true   # update tests will take care of create and update. Firewall endpoint creation is too long.
+    min_version: beta
+    vars:
+      resource_name: 'my-firewall-endpoint'
+    test_env_vars:
+      org_id: :ORG_ID
+parameters:
+  - !ruby/object:Api::Type::String
+    name: 'name'
+    required: true
+    immutable: true
+    url_param_only: true
+    description: |
+      The name of the firewall endpoint resource.
+  - !ruby/object:Api::Type::String
+    name: 'location'
+    required: true
+    immutable: true
+    description: |
+      The location (zone) of the firewall endpoint.
+    url_param_only: true
+  - !ruby/object:Api::Type::String
+    name: 'parent'
+    description: |
+      The name of the parent this firewall endpoint belongs to.
+      Format: organizations/{organization_id}.
+    required: true
+    immutable: true
+    url_param_only: true
+properties:
+  - !ruby/object:Api::Type::KeyValueLabels
+    name: 'labels'
+    description: |
+      A map of key/value label pairs to assign to the resource.
+  - !ruby/object:Api::Type::String
+    name: 'selfLink'
+    description: |
+      Server-defined URL of this resource.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: 'createTime'
+    description: Time the firewall endpoint was created in UTC.
+    output: true
+  - !ruby/object:Api::Type::Time
+    name: 'updateTime'
+    description: Time the firewall endpoint was updated in UTC.
+    output: true
+  - !ruby/object:Api::Type::Boolean
+    name: 'reconciling'
+    description: |
+      Whether reconciling is in progress, recommended per https://google.aip.dev/128.
+    output: true
+  - !ruby/object:Api::Type::Array
+    name: associatedNetworks
+    description: |
+      List of networks that are associated with this endpoint in the local zone.
+      This is a projection of the FirewallEndpointAssociations pointing at this
+      endpoint. A network will only appear in this list after traffic routing is
+      fully configured. Format: projects/{project}/global/networks/{name}.
+    item_type: Api::Type::String
+    output: true
+  - !ruby/object:Api::Type::String
+    name: 'state'
+    description: The current state of the endpoint.
+    output: true

mmv1/templates/terraform/examples/network_security_firewall_endpoint_basic.tf.erb

@@ -0,0 +1,10 @@
+resource "google_network_security_firewall_endpoint" "<%= ctx[:primary_resource_id] %>" {
+  provider    = google-beta
+  name        = "<%= ctx[:vars]['resource_name'] %>"
+  parent      = "organizations/<%= ctx[:test_env_vars]['org_id'] %>"
+  location    = "us-central1-a"
+
+  labels = {
+    foo = "bar"
+  }
+}

mmv1/third_party/terraform/services/networksecurity/resource_network_security_firewall_endpoint_test.go.erb

@@ -0,0 +1,122 @@
+<% autogen_exception -%>
+package networksecurity_test
+<% unless version == 'ga' -%>
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+
+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+	"github.com/hashicorp/terraform-provider-google/google/envvar"
+	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
+	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
+)
+
+func TestAccNetworkSecurityFirewallEndpoints_basic(t *testing.T) {
+	acctest.SkipIfVcr(t)
+	t.Parallel()
+
+	orgId := envvar.GetTestOrgFromEnv(t)
+	randomSuffix := acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
+		CheckDestroy:             testAccCheckNetworkSecurityFirewallEndpointDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNetworkSecurityFirewallEndpoints_basic(orgId, randomSuffix),
+			},
+			{
+				ResourceName:            "google_network_security_firewall_endpoint.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+			{
+				Config: testAccNetworkSecurityFirewallEndpoints_update(orgId, randomSuffix),
+			},
+			{
+				ResourceName:            "google_network_security_firewall_endpoint.foobar",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
+func testAccNetworkSecurityFirewallEndpoints_basic(orgId string, randomSuffix string) string {
+	return fmt.Sprintf(`
+resource "google_network_security_firewall_endpoint" "foobar" {
+    provider = google-beta
+    name     = "tf-test-my-firewall-endpoint%s"
+    parent   = "organizations/%s"
+    location = "us-central1-a"
+
+    labels = {
+        foo = "bar"
+    }
+}
+`, randomSuffix, orgId)
+}
+
+func testAccNetworkSecurityFirewallEndpoints_update(orgId string, randomSuffix string) string {
+	return fmt.Sprintf(`
+resource "google_network_security_firewall_endpoint" "foobar" {
+    provider = google-beta
+    name     = "tf-test-my-firewall-endpoint%s"
+    parent   = "organizations/%s"
+    location = "us-central1-a"
+
+    labels = {
+        foo = "bar-updated"
+    }
+}
+`, randomSuffix, orgId)
+}
+
+func testAccCheckNetworkSecurityFirewallEndpointDestroyProducer(t *testing.T) func(s *terraform.State) error {
+	return func(s *terraform.State) error {
+		for name, rs := range s.RootModule().Resources {
+			if rs.Type != "google_network_security_firewall_endpoint" {
+				continue
+			}
+			if strings.HasPrefix(name, "data.") {
+				continue
+			}
+
+			config := acctest.GoogleProviderConfig(t)
+
+			url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{NetworkSecurityBasePath}}{{parent}}/locations/{{location}}/firewallEndpoints/{{name}}")
+			if err != nil {
+				return err
+			}
+
+			billingProject := ""
+
+			if config.BillingProject != "" {
+				billingProject = config.BillingProject
+			}
+
+			_, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
+				Config:    config,
+				Method:    "GET",
+				Project:   billingProject,
+				RawURL:    url,
+				UserAgent: config.UserAgent,
+			})
+			if err == nil {
+				return fmt.Errorf("NetworkSecurityFirewallEndpoint still exists at %s", url)
+			}
+		}
+
+		return nil
+	}
+}
+
+<% end -%>