Scaffold the Azure RM Network Security Rule resource

Author: stack72

builtin/providers/azurerm/network_security_rule.go

@@ -0,0 +1,46 @@
+package azurerm
+
+import (
+	"fmt"
+	"strings"
+)
+
+func validateNetworkSecurityRuleProtocol(v interface{}, k string) (ws []string, errors []error) {
+	value := strings.ToLower(v.(string))
+	protocols := map[string]bool{
+		"tcp": true,
+		"udp": true,
+		"*":   true,
+	}
+
+	if !protocols[value] {
+		errors = append(errors, fmt.Errorf("Network Security Rule Protocol can only be Tcp, Udp or *"))
+	}
+	return
+}
+
+func validateNetworkSecurityRuleAccess(v interface{}, k string) (ws []string, errors []error) {
+	value := strings.ToLower(v.(string))
+	accessTypes := map[string]bool{
+		"allow": true,
+		"deny":  true,
+	}
+
+	if !accessTypes[value] {
+		errors = append(errors, fmt.Errorf("Network Security Rule Access can only be Allow or Deny"))
+	}
+	return
+}
+
+func validateNetworkSecurityRuleDirection(v interface{}, k string) (ws []string, errors []error) {
+	value := strings.ToLower(v.(string))
+	directions := map[string]bool{
+		"inbound":  true,
+		"outbound": true,
+	}
+
+	if !directions[value] {
+		errors = append(errors, fmt.Errorf("Network Security Rule Directions can only be Inbound or Outbound"))
+	}
+	return
+}

builtin/providers/azurerm/network_security_rule_test.go

@@ -0,0 +1,115 @@
+package azurerm
+
+import "testing"
+
+func TestResourceAzureRMNetworkSecurityRuleProtocol_validation(t *testing.T) {
+	cases := []struct {
+		Value    string
+		ErrCount int
+	}{
+		{
+			Value:    "Random",
+			ErrCount: 1,
+		},
+		{
+			Value:    "tcp",
+			ErrCount: 0,
+		},
+		{
+			Value:    "TCP",
+			ErrCount: 0,
+		},
+		{
+			Value:    "*",
+			ErrCount: 0,
+		},
+		{
+			Value:    "Udp",
+			ErrCount: 0,
+		},
+		{
+			Value:    "Tcp",
+			ErrCount: 0,
+		},
+	}
+
+	for _, tc := range cases {
+		_, errors := validateNetworkSecurityRuleProtocol(tc.Value, "azurerm_network_security_rule")
+
+		if len(errors) != tc.ErrCount {
+			t.Fatalf("Expected the Azure RM Network Security Rule protocol to trigger a validation error")
+		}
+	}
+}
+
+func TestResourceAzureRMNetworkSecurityRuleAccess_validation(t *testing.T) {
+	cases := []struct {
+		Value    string
+		ErrCount int
+	}{
+		{
+			Value:    "Random",
+			ErrCount: 1,
+		},
+		{
+			Value:    "Allow",
+			ErrCount: 0,
+		},
+		{
+			Value:    "Deny",
+			ErrCount: 0,
+		},
+		{
+			Value:    "ALLOW",
+			ErrCount: 0,
+		},
+		{
+			Value:    "deny",
+			ErrCount: 0,
+		},
+	}
+
+	for _, tc := range cases {
+		_, errors := validateNetworkSecurityRuleAccess(tc.Value, "azurerm_network_security_rule")
+
+		if len(errors) != tc.ErrCount {
+			t.Fatalf("Expected the Azure RM Network Security Rule access to trigger a validation error")
+		}
+	}
+}
+
+func TestResourceAzureRMNetworkSecurityRuleDirection_validation(t *testing.T) {
+	cases := []struct {
+		Value    string
+		ErrCount int
+	}{
+		{
+			Value:    "Random",
+			ErrCount: 1,
+		},
+		{
+			Value:    "Inbound",
+			ErrCount: 0,
+		},
+		{
+			Value:    "Outbound",
+			ErrCount: 0,
+		},
+		{
+			Value:    "INBOUND",
+			ErrCount: 0,
+		},
+		{
+			Value:    "Inbound",
+			ErrCount: 0,
+		},
+	}
+
+	for _, tc := range cases {
+		_, errors := validateNetworkSecurityRuleDirection(tc.Value, "azurerm_network_security_rule")
+
+		if len(errors) != tc.ErrCount {
+			t.Fatalf("Expected the Azure RM Network Security Rule direction to trigger a validation error")
+		}
+	}
+}

builtin/providers/azurerm/provider.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/hashicorp/terraform/helper/mutexkv"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/hashicorp/terraform/terraform"
 )
@@ -44,9 +45,9 @@ func Provider() terraform.ResourceProvider {
 			"azurerm_local_network_gateway":  resourceArmLocalNetworkGateway(),
 			"azurerm_availability_set":       resourceArmAvailabilitySet(),
 			"azurerm_network_security_group": resourceArmNetworkSecurityGroup(),
+			"azurerm_network_security_rule":  resourceArmNetworkSecurityRule(),
 			"azurerm_public_ip":              resourceArmPublicIp(),
 		},
-
 		ConfigureFunc: providerConfigure,
 	}
 }
@@ -110,3 +111,6 @@ func azureRMNormalizeLocation(location interface{}) string {
 	input := location.(string)
 	return strings.Replace(strings.ToLower(input), " ", "", -1)
 }
+
+// armMutexKV is the instance of MutexKV for ARM resources
+var armMutexKV = mutexkv.NewMutexKV()

builtin/providers/azurerm/resource_arm_network_security_group.go

@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"time"
 
-	"strings"
-
 	"github.com/Azure/azure-sdk-for-go/arm/network"
 	"github.com/hashicorp/terraform/helper/hashcode"
 	"github.com/hashicorp/terraform/helper/resource"
@@ -132,7 +130,7 @@ func resourceArmNetworkSecurityGroupCreate(d *schema.ResourceData, meta interfac
 	location := d.Get("location").(string)
 	resGroup := d.Get("resource_group_name").(string)
 
-	sgRules, sgErr := expandAzureRmSecurityGroupRules(d)
+	sgRules, sgErr := expandAzureRmSecurityRules(d)
 	if sgErr != nil {
 		return fmt.Errorf("Error Building list of Network Security Group Rules: %s", sgErr)
 	}
@@ -185,6 +183,10 @@ func resourceArmNetworkSecurityGroupRead(d *schema.ResourceData, meta interface{
 		return fmt.Errorf("Error making Read request on Azure Network Security Group %s: %s", name, err)
 	}
 
+	if resp.Properties.SecurityRules != nil {
+		d.Set("security_rule", flattenNetworkSecurityRules(resp.Properties.SecurityRules))
+	}
+
 	return nil
 }
 
@@ -229,7 +231,30 @@ func securityGroupStateRefreshFunc(client *ArmClient, resourceGroupName string,
 	}
 }
 
-func expandAzureRmSecurityGroupRules(d *schema.ResourceData) ([]network.SecurityRule, error) {
+func flattenNetworkSecurityRules(rules *[]network.SecurityRule) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0, len(*rules))
+	for _, rule := range *rules {
+		sgRule := make(map[string]interface{})
+		sgRule["name"] = *rule.Name
+		sgRule["destination_address_prefix"] = *rule.Properties.DestinationAddressPrefix
+		sgRule["destination_port_range"] = *rule.Properties.DestinationPortRange
+		sgRule["source_address_prefix"] = *rule.Properties.SourceAddressPrefix
+		sgRule["source_port_range"] = *rule.Properties.SourcePortRange
+		sgRule["priority"] = int(*rule.Properties.Priority)
+		sgRule["access"] = rule.Properties.Access
+		sgRule["direction"] = rule.Properties.Direction
+		sgRule["protocol"] = rule.Properties.Protocol
+
+		if rule.Properties.Description != nil {
+			sgRule["description"] = *rule.Properties.Description
+		}
+
+		result = append(result, sgRule)
+	}
+	return result
+}
+
+func expandAzureRmSecurityRules(d *schema.ResourceData) ([]network.SecurityRule, error) {
 	sgRules := d.Get("security_rule").(*schema.Set).List()
 	rules := make([]network.SecurityRule, 0, len(sgRules))
 
@@ -268,43 +293,3 @@ func expandAzureRmSecurityGroupRules(d *schema.ResourceData) ([]network.Security
 
 	return rules, nil
 }
-
-func validateNetworkSecurityRuleProtocol(v interface{}, k string) (ws []string, errors []error) {
-	value := strings.ToLower(v.(string))
-	viewTypes := map[string]bool{
-		"tcp": true,
-		"udp": true,
-		"*":   true,
-	}
-
-	if !viewTypes[value] {
-		errors = append(errors, fmt.Errorf("Network Security Rule Protocol can only be Tcp, Udp or *"))
-	}
-	return
-}
-
-func validateNetworkSecurityRuleAccess(v interface{}, k string) (ws []string, errors []error) {
-	value := strings.ToLower(v.(string))
-	viewTypes := map[string]bool{
-		"allow": true,
-		"deny":  true,
-	}
-
-	if !viewTypes[value] {
-		errors = append(errors, fmt.Errorf("Network Security Rule Access can only be Allow or Deny"))
-	}
-	return
-}
-
-func validateNetworkSecurityRuleDirection(v interface{}, k string) (ws []string, errors []error) {
-	value := strings.ToLower(v.(string))
-	viewTypes := map[string]bool{
-		"inbound":  true,
-		"outbound": true,
-	}
-
-	if !viewTypes[value] {
-		errors = append(errors, fmt.Errorf("Network Security Rule Directions can only be Inbound or Outbound"))
-	}
-	return
-}