feat(waf): Onboard Managed Rule Set

docs/data-sources/alb_waf_managed_rule_set.md

@@ -0,0 +1,68 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_managed_rule_set Data Source - stackit"
+subcategory: ""
+description: |-
+  ALB WAF Managed Rule Set resource schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+---
+
+# stackit_alb_waf_managed_rule_set (Data Source)
+
+ALB WAF Managed Rule Set resource schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+## Example Usage
+
+```terraform
+data "stackit_alb_waf_managed_rule_set" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-managed-rule-set"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Managed Rule Set configuration name.
+- `project_id` (String) STACKIT project ID associated with the ALB WAF Managed Rule Set.
+
+### Optional
+
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+
+### Read-Only
+
+- `groups` (Attributes Map) Inventory of all available Managed Rule Set groups and their current configuration. (see [below for nested schema](#nestedatt--groups))
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
+- `type` (String) Set the Managed Rule Set type.
+- `usage` (Attributes) Managed Rule Set usage (see [below for nested schema](#nestedatt--usage))
+- `version` (String) Managed Rule Set version.
+
+<a id="nestedatt--groups"></a>
+### Nested Schema for `groups`
+
+Read-Only:
+
+- `description` (String) A description of what this group covers.
+- `group_name` (String) The name for the rule group.
+- `rules` (Attributes Map) Rules of the rule group. (see [below for nested schema](#nestedatt--groups--rules))
+
+<a id="nestedatt--groups--rules"></a>
+### Nested Schema for `groups.rules`
+
+Read-Only:
+
+- `description` (String) A description of what this rule does.
+- `mode` (String) The current mode of the rule.
+- `severity` (String) Impact level.
+
+
+
+<a id="nestedatt--usage"></a>
+### Nested Schema for `usage`
+
+Read-Only:
+
+- `count` (Number) Number of WAFs using this Managed Rule Set.
+- `items` (List of String) List of WAFs that use this Managed Rule Set.

docs/index.md

@@ -165,6 +165,7 @@ Note: AWS specific checks must be skipped as they do not work on STACKIT. For de
 
 - `alb_certificates_custom_endpoint` (String) Custom endpoint for the Application Load Balancer TLS Certificate service
 - `alb_custom_endpoint` (String) Custom endpoint for the Application Load Balancer service
+- `alb_waf_custom_endpoint` (String) Custom endpoint for the Application Load Balancer Web Application Firewall service
 - `authorization_custom_endpoint` (String) Custom endpoint for the Membership service
 - `cdn_custom_endpoint` (String) Custom endpoint for the CDN service
 - `credentials_path` (String) Path of JSON from where the credentials are read. Takes precedence over the env var `STACKIT_CREDENTIALS_PATH`. Default value is `~/.stackit/credentials.json`.

docs/resources/alb_waf_managed_rule_set.md

@@ -0,0 +1,69 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_managed_rule_set Resource - stackit"
+subcategory: ""
+description: |-
+  ALB WAF Managed Rule Set resource schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+---
+
+# stackit_alb_waf_managed_rule_set (Resource)
+
+ALB WAF Managed Rule Set resource schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+## Example Usage
+
+```terraform
+resource "stackit_alb_waf_managed_rule_set" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-managed-rule-set"
+  type       = "TYPE_OWASP_CRS"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Managed Rule Set configuration name.
+- `project_id` (String) STACKIT project ID associated with the ALB WAF Managed Rule Set.
+- `type` (String) Set the Managed Rule Set type.
+
+### Optional
+
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+
+### Read-Only
+
+- `groups` (Attributes Map) Inventory of all available Managed Rule Set groups and their current configuration. (see [below for nested schema](#nestedatt--groups))
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
+- `usage` (Attributes) Managed Rule Set usage (see [below for nested schema](#nestedatt--usage))
+- `version` (String) Managed Rule Set version.
+
+<a id="nestedatt--groups"></a>
+### Nested Schema for `groups`
+
+Read-Only:
+
+- `description` (String) A description of what this group covers.
+- `group_name` (String) The name for the rule group.
+- `rules` (Attributes Map) Rules of the rule group. (see [below for nested schema](#nestedatt--groups--rules))
+
+<a id="nestedatt--groups--rules"></a>
+### Nested Schema for `groups.rules`
+
+Read-Only:
+
+- `description` (String) A description of what this rule does.
+- `mode` (String) The current mode of the rule.
+- `severity` (String) Impact level.
+
+
+
+<a id="nestedatt--usage"></a>
+### Nested Schema for `usage`
+
+Read-Only:
+
+- `count` (Number) Number of WAFs using this Managed Rule Set.
+- `items` (List of String) List of WAFs that use this Managed Rule Set.

examples/data-sources/stackit_alb_waf_managed_rule_set/data-source.tf

@@ -0,0 +1,4 @@
+data "stackit_alb_waf_managed_rule_set" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-managed-rule-set"
+}

examples/resources/stackit_alb_waf_managed_rule_set/resource.tf

@@ -0,0 +1,5 @@
+resource "stackit_alb_waf_managed_rule_set" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-managed-rule-set"
+  type       = "TYPE_OWASP_CRS"
+}

go.mod

@@ -14,6 +14,7 @@ require (
 	github.com/hashicorp/terraform-plugin-testing v1.16.0
 	github.com/stackitcloud/stackit-sdk-go/core v0.26.0
 	github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0
+	github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.9.0
 	github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0
 	github.com/stackitcloud/stackit-sdk-go/services/certificates v1.9.0
 	github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0

go.sum

@@ -672,6 +672,8 @@ github.com/stackitcloud/stackit-sdk-go/core v0.26.0 h1:jQEb9gkehfp6VCP6TcYk7BI10
 github.com/stackitcloud/stackit-sdk-go/core v0.26.0/go.mod h1:WU1hhxnjXw2EV7CYa1nlEvNpMiRY6CvmIOaHuL3pOaA=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0 h1:WoWlHdzISGXPEaJOYt6HP5F9M5nbyCJL6VqRJZIaOQs=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0/go.mod h1:eK6oRB5Tmpt6KbXQ4UYBGg2LgW5bPtVoncL9E8JSRww=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.9.0 h1:R3ovD+OhhjhhiVYUkhK/Szo4pQVU0KKBJeCo3JB/aH0=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.9.0/go.mod h1:4M9G1I64kZwlXO32ZoIpt0GAN4SpZ1SYerwCVVIBGoE=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2 h1:b7WJ/vwxlVmNNX91kI3obqGcuoPAyaCbDL5aCMQ/sNg=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2/go.mod h1:T/JF25XGJ3GqER/1L2N//DgY8x5tY7gA3N+/0nvmOWY=
 github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0 h1:k+KJ4gp9awhJMY5y55vDqRSr6G/S9+8haTNILGbgH9s=

stackit/internal/core/core.go

@@ -42,6 +42,7 @@ type ProviderData struct {
 	DefaultRegion                   string
 	ALBCertificatesCustomEndpoint   string
 	ALBCustomEndpoint               string
+	AlbWafCustomEndpoint            string
 	AuthorizationCustomEndpoint     string
 	CdnCustomEndpoint               string
 	DnsCustomEndpoint               string

stackit/internal/services/albwaf/albwaf_acc_test.go

@@ -0,0 +1,184 @@
+package albwaf_test
+
+import (
+	"context"
+	_ "embed"
+	"errors"
+	"fmt"
+	"maps"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/config"
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+	"github.com/hashicorp/terraform-plugin-testing/plancheck"
+	"github.com/hashicorp/terraform-plugin-testing/terraform"
+	"github.com/stackitcloud/stackit-sdk-go/core/utils"
+	albwaf "github.com/stackitcloud/stackit-sdk-go/services/albwaf/v1betaapi"
+
+	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/core"
+	"github.com/stackitcloud/terraform-provider-stackit/stackit/internal/testutil"
+)
+
+var (
+	//go:embed testdata/managed-rule-set.tf
+	managedRuleSetConfig string
+)
+
+var testManagedRuleSet = config.Variables{
+	"project_id": config.StringVariable(testutil.ProjectId),
+	"name":       config.StringVariable("tf-acc-" + acctest.RandStringFromCharSet(8, acctest.CharSetAlpha)),
+	"type":       config.StringVariable("TYPE_OWASP_CRS"),
+}
+
+var testManagedRuleSetUpdated = func() config.Variables {
+	updatedConfig := config.Variables{}
+	maps.Copy(updatedConfig, testManagedRuleSet)
+	updatedConfig["name"] = config.StringVariable(fmt.Sprintf("%s-updated", testutil.ConvertConfigVariable(updatedConfig["name"])))
+	return updatedConfig
+}
+
+func TestAccManagedRuleSet(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: testutil.TestAccProtoV6ProviderFactories,
+		CheckDestroy:             testAccCheckDestroy,
+		Steps: []resource.TestStep{
+			// Creation
+			{
+				ConfigVariables: testManagedRuleSet,
+				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "region", testutil.Region),
+					resource.TestCheckResourceAttrSet("stackit_alb_waf_managed_rule_set.managed_rule_set", "id"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSet["name"])),
+
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
+				),
+			},
+			// Data source
+			{
+				ConfigVariables: testManagedRuleSet,
+				Config: fmt.Sprintf(`
+					%s
+					%s
+
+					data "stackit_alb_waf_managed_rule_set" "managed_rule_set" {
+					  project_id = stackit_alb_waf_managed_rule_set.managed_rule_set.project_id
+					  name  = stackit_alb_waf_managed_rule_set.managed_rule_set.name
+					}
+					`,
+					testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig,
+				),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "region", testutil.Region),
+					resource.TestCheckResourceAttrPair(
+						"data.stackit_alb_waf_managed_rule_set.managed_rule_set", "id",
+						"stackit_alb_waf_managed_rule_set.managed_rule_set", "id",
+					),
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSet["name"])),
+
+					resource.TestCheckResourceAttr("data.stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
+				),
+			},
+			// Import
+			{
+				ConfigVariables: testManagedRuleSet,
+				ResourceName:    "stackit_alb_waf_managed_rule_set.managed_rule_set",
+				ImportStateIdFunc: func(s *terraform.State) (string, error) {
+					r, ok := s.RootModule().Resources["stackit_alb_waf_managed_rule_set.managed_rule_set"]
+					if !ok {
+						return "", fmt.Errorf("couldn't find resource stackit_alb_waf_managed_rule_set.managed_rule_set")
+					}
+					policyId, ok := r.Primary.Attributes["name"]
+					if !ok {
+						return "", fmt.Errorf("couldn't find attribute name")
+					}
+					return fmt.Sprintf("%s,%s,%s", testutil.ProjectId, testutil.Region, policyId), nil
+				},
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			// Update
+			{
+				ConfigVariables: testManagedRuleSetUpdated(),
+				Config:          fmt.Sprintf("%s\n%s", testutil.NewConfigBuilder().EnableBetaResources(true).BuildProviderConfig(), managedRuleSetConfig),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectResourceAction("stackit_alb_waf_managed_rule_set.managed_rule_set", plancheck.ResourceActionReplace),
+					},
+				},
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "project_id", testutil.ProjectId),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "region", testutil.Region),
+					resource.TestCheckResourceAttrSet("stackit_alb_waf_managed_rule_set.managed_rule_set", "id"),
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "name", testutil.ConvertConfigVariable(testManagedRuleSetUpdated()["name"])),
+
+					resource.TestCheckResourceAttr("stackit_alb_waf_managed_rule_set.managed_rule_set", "usage.count", "0"),
+				),
+			},
+			// Deletion is done by the framework implicitly
+		},
+	})
+}
+
+func createClient() (*albwaf.APIClient, error) {
+	client, err := albwaf.NewAPIClient(testutil.NewConfigBuilder().BuildClientOptions(testutil.AlbWafCustomEndpoint, false)...)
+	if err != nil {
+		return nil, fmt.Errorf("creating client: %w", err)
+	}
+
+	return client, nil
+}
+
+func testAccCheckDestroy(s *terraform.State) error {
+	checkFunctions := []func(s *terraform.State) error{
+		testAlbWafManagedRuleSetDestroy,
+	}
+	var errs []error
+
+	for _, f := range checkFunctions {
+		func() {
+			err := f(s)
+			if err != nil {
+				errs = append(errs, err)
+			}
+		}()
+	}
+	return errors.Join(errs...)
+}
+
+func testAlbWafManagedRuleSetDestroy(s *terraform.State) error {
+	ctx := context.Background()
+	client, err := createClient()
+	if err != nil {
+		return err
+	}
+
+	managedRuleSetsToDestroy := []string{}
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "stackit_alb_waf_managed_rule_set" {
+			continue
+		}
+		// managed rule set transform id: "[projectId],[region],[name]"
+		name := strings.Split(rs.Primary.ID, core.Separator)[2]
+		managedRuleSetsToDestroy = append(managedRuleSetsToDestroy, name)
+	}
+
+	resp, err := client.DefaultAPI.ListManagedRuleSets(ctx, testutil.ProjectId, testutil.Region).Execute()
+	if err != nil {
+		return fmt.Errorf("getting resp: %w", err)
+	}
+
+	for _, item := range resp.Items {
+		if utils.Contains(managedRuleSetsToDestroy, item.GetName()) {
+			_, err := client.DefaultAPI.DeleteManagedRuleSet(ctx, testutil.ProjectId, testutil.Region, item.GetName()).Execute()
+			if err != nil {
+				return fmt.Errorf("deleting policy %s during CheckDestroy: %w", item.GetName(), err)
+			}
+		}
+	}
+	return nil
+}