[datadog_csm_threats] supporting cws multi-policy in terraform #2681

homoeconomics · 2024-11-15T20:41:47Z

Adding new resources and data sources to support the CWS multi-policy feature.

Updated the data source and resource datadog_csm_threats_agent_rule for users to manage their rules
Added a new data source resource datadog_csm_threats_policy for users to manage their policies.

Create a policy resource:

resource "datadog_csm_threats_policy" "my_policy" {
    description  = "my terraform policy"
    enabled      = false
    name         = "TERRAFORM POLICY"
    tags         = ["env:staging"]
}

Create a multi policy agent rule resource:

resource "datadog_csm_threats_agent_rule" "my_rule" {
    description  = "my terraform rule"
    enabled      = false
    expression   = "bind.addr.ip==1.1.1.1"
    name         = "TERRAFORM_RULE"
    policy_id    = datadog_csm_threats_policy.my_policy.id
    product_tags = ["foo:bar"]
}

datadog/fwprovider/resource_datadog_csm_threats_policy.go

datadog/fwprovider/resource_datadog_csm_threats_multi_policies.go

go.mod

docs/resources/csm_threats_policies_list.md

datadog/fwprovider/resource_datadog_csm_threats_multi_policies.go

datadog/fwprovider/resource_datadog_csm_threats_multi_policy_agent_rule.go

datadog/data_source_datadog_cloud_workload_security_agent_rules.go

datadog/fwprovider/data_source_datadog_csm_threats_agent_rule.go

datadog/data_source_datadog_cloud_workload_security_agent_rules.go

homoeconomics · 2025-05-21T17:38:36Z

datadog/fwprovider/data_source_datadog_csm_threats_agent_rule.go

@@ -51,44 +61,113 @@ func (r *csmThreatsAgentRulesDataSource) Read(ctx context.Context, request datas
 		return
 	}

-	res, _, err := r.api.ListCSMThreatsAgentRules(r.auth)
+	// Fetch CWS rules (without policy_id), using /security_monitoring/cloud_workload_security/agent_rules path
+	cwsRules, _, err := r.api.ListCloudWorkloadSecurityAgentRules(r.auth)


It seems there was a misunderstanding. I was suggesting that we use this data source to handle only rules from RC (by calling ListCSMThreatsAgentRules) and we let data_source_datadog_cloud_workload_security_agent_rules handle rules from Mongo.

I don't see why we need to merge rules from Mongo and RC.

my bad, I moved multi_policy_agent_rules to agent_rules and readded cloud_workload_security_agent_rules

datadog/fwprovider/resource_datadog_csm_threats_agent_rule.go

datadog/provider.go

homoeconomics · 2025-05-22T15:01:38Z

datadog/fwprovider/data_source_datadog_csm_threats_agent_rule.go

 	r.api = providerData.DatadogApiInstances.GetCSMThreatsApiV2()
 	r.auth = providerData.Auth
 }

-func (*csmThreatsAgentRulesDataSource) Metadata(_ context.Context, _ datasource.MetadataRequest, response *datasource.MetadataResponse) {
+func (r *csmThreatsAgentRulesDataSource) Metadata(_ context.Context, request datasource.MetadataRequest, response *datasource.MetadataResponse) {


nit: maybe you don't need this change?

homoeconomics · 2025-05-22T15:10:48Z

datadog/fwprovider/resource_datadog_csm_threats_agent_rule.go

@@ -93,9 +111,6 @@ func (r *csmThreatsAgentRuleResource) Create(ctx context.Context, request resour
 		return
 	}

-	csmThreatsMutex.Lock()


Why is this deleted? I thought we need this to prevent terraform from creating multiple rules simultaneously.

homoeconomics · 2025-05-22T15:15:50Z

docs/resources/csm_threats_agent_rule.md

@@ -29,10 +29,12 @@ resource "datadog_csm_threats_agent_rule" "my_agent_rule" {
 - `enabled` (Boolean) Indicates Whether the Agent rule is enabled.
 - `expression` (String) The SECL expression of the Agent rule
 - `name` (String) The name of the Agent rule.
+- `policy_id` (String) The ID of the agent policy in which the rule is saved


Can you also update the Import section below? I think we should support both of these.

terraform import datadog_csm_threats_agent_rule.my_agent_rule <policy ID>:<rule ID>

terraform import datadog_csm_threats_agent_rule.my_agent_rule <rule ID>

homoeconomics · 2025-05-22T15:34:33Z

datadog/fwprovider/resource_datadog_csm_threats_agent_rule.go

-	resource.ImportStatePassthroughID(ctx, path.Root("id"), request, response)
+	result := strings.SplitN(request.ID, ":", 2)
+	if len(result) != 2 {
+		response.Diagnostics.AddError("error retrieving policy_id or rule_id from given ID", "")


I'm wondering if it's possible to make it backward compatible. When this happens, instead of throwing an error, we just assume that it's a rule ID and the policy ID is not provided.

homoeconomics · 2025-05-22T15:37:04Z

datadog/fwprovider/resource_datadog_csm_threats_agent_rule.go

@@ -123,7 +138,8 @@ func (r *csmThreatsAgentRuleResource) Read(ctx context.Context, request resource
 	}

 	agentRuleId := state.Id.ValueString()
-	res, httpResponse, err := r.api.GetCSMThreatsAgentRule(r.auth, agentRuleId)
+	policyId := state.PolicyId.ValueString()


Is it possible that the policyId is not in the state? Can we not set it in the request if that's the case?

homoeconomics · 2025-05-22T15:39:53Z

datadog/fwprovider/resource_datadog_csm_threats_agent_rule.go

 	// Mandatory fields
 	id := state.Id.ValueString()
+	policyId := state.PolicyId.ValueString()


Let's not return an empty string if it's not there.

homoeconomics force-pushed the daniel.zhou/CWS-3394-tf-provider branch from 6322019 to 5da3fb7 Compare November 15, 2024 20:48

datadog-datadog-prod-us1 bot reviewed Jan 30, 2025

View reviewed changes

datadog/fwprovider/resource_datadog_csm_threats_policy.go Outdated Show resolved Hide resolved

homoeconomics commented Jan 31, 2025

View reviewed changes

datadog/fwprovider/resource_datadog_csm_threats_multi_policies.go Outdated Show resolved Hide resolved

go.mod Outdated Show resolved Hide resolved

docs/resources/csm_threats_policies_list.md Outdated Show resolved Hide resolved

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch 2 times, most recently from bf4b1af to 4c19fd8 Compare February 14, 2025 13:25

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch from a390790 to 6fc7905 Compare February 27, 2025 13:04

homoeconomics commented Feb 27, 2025

View reviewed changes

datadog/fwprovider/resource_datadog_csm_threats_multi_policies.go Outdated Show resolved Hide resolved

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch 2 times, most recently from f715a3a to 595f718 Compare February 28, 2025 16:56

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch 2 times, most recently from 8c3f3f3 to 1d306ae Compare March 28, 2025 15:36

homoeconomics commented Apr 1, 2025

View reviewed changes

datadog/fwprovider/resource_datadog_csm_threats_multi_policy_agent_rule.go Outdated Show resolved Hide resolved

datadog/fwprovider/resource_datadog_csm_threats_multi_policy_agent_rule.go Show resolved Hide resolved

homoeconomics commented Apr 2, 2025

View reviewed changes

datadog/data_source_datadog_cloud_workload_security_agent_rules.go Outdated Show resolved Hide resolved

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch from 2c6ae21 to 37ea69b Compare April 3, 2025 12:09

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch 2 times, most recently from a8a6b1c to fdbc105 Compare May 13, 2025 13:58

homoeconomics and others added 13 commits May 15, 2025 09:34

supporting cws multi-policy in terraform

a7fc0d9

supporting cws policies_list

224823b

add test file for policies_list

b8e52ed

remove priority

7cf0840

generate docs + modify test file

f8af22b

add product_tags

206c963

remove unused resources + modify test files

ffb4446

fix bugs

3768943

restore legacy anget_rule resource, fix tests

94835fd

generate docs

e427410

[cws-4175] add hostTagsLists field

04dada7

fix cws agent_rule resource and data_source + fix test files

4a3a424

update go.mod and go.sum

3f0069d

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch from fdbc105 to 3f0069d Compare May 15, 2025 07:35

regen docs + gen cassettes

b528f99

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch from 84f08b8 to b528f99 Compare May 15, 2025 08:25

QuentinGuillard marked this pull request as ready for review May 15, 2025 08:56

QuentinGuillard requested review from a team as code owners May 15, 2025 08:56

QuentinGuillard added the changelog/feature label May 15, 2025

QuentinGuillard changed the title ~~supporting cws multi-policy in terraform~~ [CWS - Workload Protection] supporting cws multi-policy in terraform May 15, 2025

QuentinGuillard changed the title ~~[CWS - Workload Protection] supporting cws multi-policy in terraform~~ [CWS] supporting cws multi-policy in terraform May 15, 2025

QuentinGuillard changed the title ~~[CWS] supporting cws multi-policy in terraform~~ [datadog_csm_threats] supporting cws multi-policy in terraform May 15, 2025

urseberry approved these changes May 15, 2025

View reviewed changes

clachner approved these changes May 19, 2025

View reviewed changes

homoeconomics commented May 19, 2025

View reviewed changes

datadog/fwprovider/data_source_datadog_csm_threats_agent_rule.go Outdated Show resolved Hide resolved

homoeconomics commented May 21, 2025

View reviewed changes

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch 3 times, most recently from 6fbce23 to 2481912 Compare May 22, 2025 08:55

remove multi_policy_agent_rule resource

cf16019

QuentinGuillard force-pushed the daniel.zhou/CWS-3394-tf-provider branch from 2481912 to cf16019 Compare May 22, 2025 08:56

homoeconomics commented May 22, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[datadog_csm_threats] supporting cws multi-policy in terraform #2681

[datadog_csm_threats] supporting cws multi-policy in terraform #2681

Uh oh!

homoeconomics commented Nov 15, 2024 •

edited by QuentinGuillard

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

homoeconomics May 21, 2025

Uh oh!

QuentinGuillard May 22, 2025

Uh oh!

Uh oh!

Uh oh!

homoeconomics May 22, 2025

Uh oh!

homoeconomics May 22, 2025

Uh oh!

homoeconomics May 22, 2025

Uh oh!

homoeconomics May 22, 2025

Uh oh!

homoeconomics May 22, 2025

Uh oh!

homoeconomics May 22, 2025

Uh oh!

Uh oh!

[datadog_csm_threats] supporting cws multi-policy in terraform #2681

Are you sure you want to change the base?

[datadog_csm_threats] supporting cws multi-policy in terraform #2681

Uh oh!

Conversation

homoeconomics commented Nov 15, 2024 • edited by QuentinGuillard Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

homoeconomics commented Nov 15, 2024 •

edited by QuentinGuillard

Loading