Skip to content

Commit be66725

Browse files
anovisanovis
authored
gcp - firewall - modify action (cloud-custodian#6546)
1 parent 92463ec commit be66725

File tree

5 files changed

+199
-0
lines changed

5 files changed

+199
-0
lines changed

‎tools/c7n_gcp/c7n_gcp/resources/network.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,53 @@ def get_resource_params(self, m, r):
158158
return {'project': project, 'firewall': resource_name}
159159

160160

161+
@Firewall.action_registry.register('modify')
162+
class ModifyFirewall(MethodAction):
163+
"""Modify filtered Firewall Rules
164+
165+
:example: Enable logging on filtered firewalls
166+
167+
.. yaml:
168+
169+
policies:
170+
- name: enable-firewall-logging
171+
resource: gcp.firewall
172+
filters:
173+
- type: value
174+
key: name
175+
value: no-logging
176+
actions:
177+
- type: modify
178+
logConfig:
179+
enabled: true
180+
"""
181+
182+
schema = type_schema(
183+
'modify',
184+
**{'description': {'type': 'string'},
185+
'network': {'type': 'string'},
186+
'priority': {'type': 'number'},
187+
'sourceRanges': {'type': 'array', 'items': {'type': 'string'}},
188+
'destinationRanges': {'type': 'array', 'items': {'type': 'string'}},
189+
'sourceTags': {'type': 'array', 'items': {'type': 'string'}},
190+
'targetTags': {'type': 'array', 'items': {'type': 'string'}},
191+
'sourceServiceAccounts': {'type': 'array', 'items': {'type': 'string'}},
192+
'targetServiceAccounts': {'type': 'array', 'items': {'type': 'string'}},
193+
'allowed': {'type': 'array', 'items': {'type': 'object'}},
194+
'denied': {'type': 'array', 'items': {'type': 'object'}},
195+
'direction': {'enum': ['INGRESS', 'EGRESS']},
196+
'logConfig': {'type': 'object'},
197+
'disabled': {'type': 'boolean'}})
198+
method_spec = {'op': 'patch'}
199+
permissions = ('compute.networks.updatePolicy', 'compute.firewalls.update')
200+
path_param_re = re.compile('.*?/projects/(.*?)/global/firewalls/(.*)')
201+
202+
def get_resource_params(self, m, r):
203+
project, resource_name = self.path_param_re.match(
204+
r['selfLink']).groups()
205+
return {'project': project, 'firewall': resource_name, 'body': self.data}
206+
207+
161208
@resources.register('router')
162209
class Router(QueryResourceManager):
163210
"""GCP resource: https://cloud.google.com/compute/docs/reference/rest/v1/routers

‎tools/c7n_gcp/tests/data/flights/firewall-modify/get-compute-v1-projects-cloud-custodian-global-firewalls-test_1.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"headers": {
3+
"etag": "mKIkXzG_CsXtACJ-pjHU1QvbY6E=/XOjuCw1ioqrMA3GKAKOgT_Op8EQ=",
4+
"content-type": "application/json; charset=UTF-8",
5+
"vary": "Origin, X-Origin, Referer",
6+
"date": "Wed, 17 Mar 2021 19:54:48 GMT",
7+
"server": "ESF",
8+
"cache-control": "private",
9+
"x-xss-protection": "0",
10+
"x-frame-options": "SAMEORIGIN",
11+
"x-content-type-options": "nosniff",
12+
"alt-svc": "h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",
13+
"transfer-encoding": "chunked",
14+
"status": "200",
15+
"content-length": "656",
16+
"-content-encoding": "gzip",
17+
"content-location": "https://compute.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls/test?alt=json"
18+
},
19+
"body": {
20+
"id": "4853772226933023804",
21+
"creationTimestamp": "2021-03-17T12:38:59.990-07:00",
22+
"name": "test",
23+
"description": "",
24+
"network": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/networks/default",
25+
"priority": 500,
26+
"sourceRanges": [
27+
"1.1.1.1"
28+
],
29+
"targetTags": [
30+
"newtag"
31+
],
32+
"allowed": [
33+
{
34+
"IPProtocol": "tcp",
35+
"ports": [
36+
"22"
37+
]
38+
}
39+
],
40+
"direction": "INGRESS",
41+
"logConfig": {
42+
"enable": false
43+
},
44+
"disabled": false,
45+
"selfLink": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls/test",
46+
"kind": "compute#firewall"
47+
}
48+
}

‎tools/c7n_gcp/tests/data/flights/firewall-modify/get-compute-v1-projects-cloud-custodian-global-firewalls_1.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"headers": {
3+
"etag": "9V13kgN2MxsEq9IbD5kJQ0R-UXI=/hu_9Mer_bwfDfMhzv5q0EJNCBwA=",
4+
"content-type": "application/json; charset=UTF-8",
5+
"vary": "Origin, X-Origin, Referer",
6+
"date": "Wed, 17 Mar 2021 19:54:41 GMT",
7+
"server": "ESF",
8+
"cache-control": "private",
9+
"x-xss-protection": "0",
10+
"x-frame-options": "SAMEORIGIN",
11+
"x-content-type-options": "nosniff",
12+
"alt-svc": "h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",
13+
"transfer-encoding": "chunked",
14+
"status": "200",
15+
"content-length": "5237",
16+
"-content-encoding": "gzip",
17+
"content-location": "https://compute.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls?alt=json"
18+
},
19+
"body": {
20+
"id": "projects/cloud-custodian/global/firewalls",
21+
"items": [
22+
{
23+
"id": "4853772226933023804",
24+
"creationTimestamp": "2021-03-17T12:38:59.990-07:00",
25+
"name": "test",
26+
"description": "",
27+
"network": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/networks/default",
28+
"priority": 1000,
29+
"sourceRanges": [
30+
"1.1.1.1"
31+
],
32+
"targetTags": [
33+
"oldtag"
34+
],
35+
"allowed": [
36+
{
37+
"IPProtocol": "tcp",
38+
"ports": [
39+
"22"
40+
]
41+
}
42+
],
43+
"direction": "INGRESS",
44+
"logConfig": {
45+
"enable": false
46+
},
47+
"disabled": false,
48+
"selfLink": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls/test",
49+
"kind": "compute#firewall"
50+
}
51+
],
52+
"selfLink": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls",
53+
"kind": "compute#firewallList"
54+
}
55+
}

‎tools/c7n_gcp/tests/data/flights/firewall-modify/patch-compute-v1-projects-cloud-custodian-global-firewalls-test_1.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"headers": {
3+
"content-type": "application/json; charset=UTF-8",
4+
"vary": "Origin, X-Origin, Referer",
5+
"date": "Wed, 17 Mar 2021 19:54:42 GMT",
6+
"server": "ESF",
7+
"cache-control": "private",
8+
"x-xss-protection": "0",
9+
"x-frame-options": "SAMEORIGIN",
10+
"x-content-type-options": "nosniff",
11+
"alt-svc": "h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"",
12+
"transfer-encoding": "chunked",
13+
"status": "200",
14+
"content-length": "644",
15+
"-content-encoding": "gzip"
16+
},
17+
"body": {
18+
"id": "8915306104775237741",
19+
"name": "operation-1616010881632-5bdc0da8d88e9-c6119e51-58d48670",
20+
"operationType": "patch",
21+
"targetLink": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/firewalls/test",
22+
"targetId": "4853772226933023804",
23+
"status": "RUNNING",
24+
"progress": 0,
25+
"insertTime": "2021-03-17T12:54:42.014-07:00",
26+
"startTime": "2021-03-17T12:54:42.023-07:00",
27+
"selfLink": "https://www.googleapis.com/compute/v1/projects/cloud-custodian/global/operations/operation-1616010881632-5bdc0da8d88e9-c6119e51-58d48670",
28+
"kind": "compute#operation"
29+
}
30+
}

‎tools/c7n_gcp/tests/test_network.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,25 @@ def test_firewall_get(self):
1919
'project_id': 'cloud-custodian'})
2020
self.assertEqual(fw['name'], 'allow-inbound-xyz')
2121

22+
def test_firewall_modify(self):
23+
project_id = 'cloud-custodian'
24+
factory = self.replay_flight_data('firewall-modify', project_id=project_id)
25+
p = self.load_policy(
26+
{'name': 'fdelete',
27+
'resource': 'gcp.firewall',
28+
'filters': [{'name': 'test'}],
29+
'actions': [{'type': 'modify', 'priority': 500, 'targetTags': ['newtag']}]
30+
},
31+
session_factory=factory)
32+
resources = p.run()
33+
self.assertEqual(len(resources), 1)
34+
if self.recording:
35+
time.sleep(5)
36+
client = p.resource_manager.get_client()
37+
result = client.execute_query('get', {'project': project_id, 'firewall': 'test'})
38+
self.assertEqual(result["targetTags"][0], 'newtag')
39+
self.assertEqual(result["priority"], 500)
40+
2241
def test_firewall_delete(self):
2342
project_id = 'cloud-custodian'
2443
factory = self.replay_flight_data('firewall-delete', project_id=project_id)

0 commit comments

Comments
 (0)