Skip to content

Commit b442838

Browse files
temblekingairadier
andauthored
feat(secure-vm): implement sysdig_secure_accept_vulnerability_risk resource (#579)
* chore(nix): add flake for reproducible development environment * build: update project to go 1.23 * fix: solve vulnerabilities by upgrading deps Solved the following vulnerabilities: - GO-2024-2947 - GO-2024-2687 - GO-2024-2611 - GO-2023-2153 * feat: implement sysdig_secure_accept_vulnerability_risk resource * build(nix): add package and app to bundle terraform with the provider * build(nix): add devshell to be able to launch a local dev shell from remote/local code * build(nix): use 1.0.0-local version in the nix package * fix: use correct format for expiration_date * fix(lint): solve linter problems * chore(build): downgrade dependencies from sysdig that break the tests * fix(lint): adjust drift in lint options from makefile to gh actions * ci: reenable go:build flag for tf_acc_sysdig_secure * fix(ci): use the api.us1.sysdig.com url in case of secure.sysdig.com * docs: add doc for sysdig_secure_vulnerability_accept_risk * fix(ci): restore or remove env var from tests * ci: add more dependencies to check target * chore: update flake dependencies to update terraform to 1.10 * fix(docs): correct example of hostname_contains * docs: clarify that image wildcard can only be used at the beginning or the end * docs: rename opt args to context args and clarify they are not fully optional * Update website/docs/r/secure_vulnerability_accept_risk.md Co-authored-by: Alvaro Iradier <[email protected]> * Update website/docs/r/secure_vulnerability_accept_risk.md Co-authored-by: Alvaro Iradier <[email protected]> * fix(docs): add again the rule risk acceptance * ci: remove hacky way to make tests pass in us1 --------- Co-authored-by: Alvaro Iradier <[email protected]>
1 parent edee724 commit b442838

9 files changed

+1206
-52
lines changed

go.mod

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
11
module github.com/draios/terraform-provider-sysdig
22

3-
go 1.19
3+
go 1.23
4+
5+
toolchain go1.23.3
46

57
require (
68
github.com/Jeffail/gabs/v2 v2.7.0
79
github.com/aws/aws-sdk-go v1.44.284
810
github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
9-
github.com/hashicorp/go-retryablehttp v0.7.4
11+
github.com/hashicorp/go-retryablehttp v0.7.7
1012
github.com/hashicorp/terraform-plugin-log v0.8.0
1113
github.com/hashicorp/terraform-plugin-sdk/v2 v2.26.1
1214
github.com/jmespath/go-jmespath v0.4.0
@@ -15,7 +17,7 @@ require (
1517
github.com/spf13/cast v1.5.1
1618
github.com/stretchr/testify v1.8.4
1719
github.com/sysdiglabs/agent-kilt/runtimes/cloudformation v0.0.0-20240201123620-2272de6dee9f
18-
google.golang.org/protobuf v1.30.0
20+
google.golang.org/protobuf v1.36.0
1921
)
2022

2123
require (
@@ -27,15 +29,15 @@ require (
2729
github.com/docker/distribution v2.8.2+incompatible // indirect
2830
github.com/docker/docker v24.0.2+incompatible // indirect
2931
github.com/docker/docker-credential-helpers v0.7.0 // indirect
30-
github.com/fatih/color v1.13.0 // indirect
32+
github.com/fatih/color v1.16.0 // indirect
3133
github.com/go-akka/configuration v0.0.0-20200606091224-a002c0330665 // indirect
32-
github.com/golang/protobuf v1.5.3 // indirect
33-
github.com/google/go-cmp v0.5.9 // indirect
34+
github.com/golang/protobuf v1.5.4 // indirect
35+
github.com/google/go-cmp v0.6.0 // indirect
3436
github.com/google/go-containerregistry v0.15.2 // indirect
3537
github.com/hashicorp/errwrap v1.0.0 // indirect
3638
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
3739
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
38-
github.com/hashicorp/go-hclog v1.4.0 // indirect
40+
github.com/hashicorp/go-hclog v1.6.3 // indirect
3941
github.com/hashicorp/go-multierror v1.1.1 // indirect
4042
github.com/hashicorp/go-plugin v1.4.8 // indirect
4143
github.com/hashicorp/go-uuid v1.0.3 // indirect
@@ -51,7 +53,7 @@ require (
5153
github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
5254
github.com/klauspost/compress v1.16.6 // indirect
5355
github.com/mattn/go-colorable v0.1.13 // indirect
54-
github.com/mattn/go-isatty v0.0.19 // indirect
56+
github.com/mattn/go-isatty v0.0.20 // indirect
5557
github.com/mitchellh/copystructure v1.2.0 // indirect
5658
github.com/mitchellh/go-homedir v1.1.0 // indirect
5759
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -69,14 +71,14 @@ require (
6971
github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
7072
github.com/vmihailenco/tagparser v0.1.1 // indirect
7173
github.com/zclconf/go-cty v1.13.2 // indirect
72-
golang.org/x/crypto v0.7.0 // indirect
73-
golang.org/x/mod v0.10.0 // indirect
74-
golang.org/x/net v0.9.0 // indirect
75-
golang.org/x/sync v0.3.0 // indirect
76-
golang.org/x/sys v0.14.0 // indirect
77-
golang.org/x/text v0.9.0 // indirect
74+
golang.org/x/crypto v0.31.0 // indirect
75+
golang.org/x/mod v0.17.0 // indirect
76+
golang.org/x/net v0.33.0 // indirect
77+
golang.org/x/sync v0.10.0 // indirect
78+
golang.org/x/sys v0.28.0 // indirect
79+
golang.org/x/text v0.21.0 // indirect
7880
google.golang.org/appengine v1.6.7 // indirect
79-
google.golang.org/genproto v0.0.0-20221207170731-23e4bf6bdc37 // indirect
80-
google.golang.org/grpc v1.51.0 // indirect
81+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241216192217-9240e9c98484 // indirect
82+
google.golang.org/grpc v1.69.2 // indirect
8183
gopkg.in/yaml.v3 v3.0.1 // indirect
8284
)

go.sum

Lines changed: 61 additions & 36 deletions
Large diffs are not rendered by default.

sysdig/internal/client/v2/client.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ type SecureCommon interface {
5959
PostureZoneInterface
6060
PostureControlInterface
6161
PostureAcceptRiskInterface
62+
PostureVulnerabilityAcceptRiskInterface
6263
}
6364

6465
type Requester interface {
Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
package v2
2+
3+
import (
4+
"fmt"
5+
"time"
6+
)
7+
8+
type (
9+
EntityType string
10+
ReasonType string
11+
StatusType string
12+
StageType string
13+
ContextType string
14+
)
15+
16+
const (
17+
EntityTypeImageName EntityType = "imageName"
18+
EntityTypeImagePrefix EntityType = "imagePrefix"
19+
EntityTypeImageSuffix EntityType = "imageSuffix"
20+
EntityTypeImageNameContains EntityType = "imageNameContains"
21+
EntityTypeVulnerability EntityType = "vulnerability"
22+
EntityTypeHostName EntityType = "hostName"
23+
EntityTypeHostNameContains EntityType = "hostNameContains"
24+
EntityTypePolicyRule EntityType = "policyRule"
25+
)
26+
27+
const (
28+
ReasonRiskTransferred ReasonType = "RiskTransferred"
29+
ReasonRiskAvoided ReasonType = "RiskAvoided"
30+
ReasonRiskMitigated ReasonType = "RiskMitigated"
31+
ReasonRiskOwned ReasonType = "RiskOwned"
32+
ReasonRiskNotRelevant ReasonType = "RiskNotRelevant"
33+
ReasonCustom ReasonType = "Custom"
34+
)
35+
36+
func ReasonTypeFromString(value string) (ReasonType, error) {
37+
t := ReasonType(value)
38+
switch t {
39+
case ReasonRiskTransferred, ReasonRiskAvoided, ReasonRiskMitigated, ReasonRiskOwned, ReasonRiskNotRelevant, ReasonCustom:
40+
return t, nil
41+
default:
42+
return "", fmt.Errorf("unsupported reason type: %s", value)
43+
}
44+
}
45+
46+
const (
47+
StatusActive StatusType = "active"
48+
StatusExpired StatusType = "expired"
49+
)
50+
51+
const (
52+
ContextTypeImageName ContextType = "imageName"
53+
ContextTypeImagePrefix ContextType = "imagePrefix"
54+
ContextTypeImageSuffix ContextType = "imageSuffix"
55+
ContextTypeImageNameContains ContextType = "imageNameContains"
56+
ContextTypeHostName ContextType = "hostName"
57+
ContextTypeHostNameContains ContextType = "hostNameContains"
58+
ContextTypePackageName ContextType = "packageName"
59+
ContextTypePackageVersion ContextType = "packageVersion"
60+
)
61+
62+
type AcceptVulnerabilityRiskRequest struct {
63+
EntityType EntityType `json:"entityType"`
64+
EntityValue string `json:"entityValue"`
65+
Reason ReasonType `json:"reason"`
66+
Description string `json:"description"`
67+
ExpirationDate string `json:"expirationDate,omitempty"`
68+
Context []AcceptVulnerabilityRiskContext `json:"context"`
69+
Stages []StageType `json:"stages,omitempty"`
70+
}
71+
72+
type UpdateAcceptVulnerabilityRiskRequest struct {
73+
ID string `json:"id"`
74+
ExpirationDate string `json:"expirationDate,omitempty"`
75+
Reason ReasonType `json:"reason"`
76+
Description string `json:"description"`
77+
}
78+
79+
type AcceptVulnerabilityRisk struct {
80+
ID string `json:"id"`
81+
EntityType EntityType `json:"entityType"`
82+
EntityValue string `json:"entityValue"`
83+
Reason ReasonType `json:"reason"`
84+
Description string `json:"description"`
85+
ExpirationDate string `json:"expirationDate,omitempty"`
86+
Status StatusType `json:"status"`
87+
CreatedAt time.Time `json:"createdAt,omitempty"`
88+
UpdatedAt time.Time `json:"updatedAt,omitempty"`
89+
CreatedBy string `json:"createdBy,omitempty"`
90+
UpdatedBy string `json:"updatedBy,omitempty"`
91+
Context []AcceptVulnerabilityRiskContext `json:"context"`
92+
Stages []StageType `json:"stages,omitempty"`
93+
}
94+
95+
type AcceptVulnerabilityRiskContext struct {
96+
ContextType ContextType `json:"contextType"`
97+
ContextValue string `json:"contextValue"`
98+
}
Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
package v2
2+
3+
import (
4+
"context"
5+
"fmt"
6+
"net/http"
7+
)
8+
9+
type PostureVulnerabilityAcceptRiskInterface interface {
10+
Base
11+
12+
SaveAcceptVulnerabilityRisk(ctx context.Context, p *AcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error)
13+
GetAcceptanceVulnerabilityRisk(ctx context.Context, id string) (*AcceptVulnerabilityRisk, int, error)
14+
DeleteAcceptanceVulnerabilityRisk(ctx context.Context, id string) error
15+
UpdateAcceptanceVulnerabilityRisk(ctx context.Context, p *UpdateAcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error)
16+
}
17+
18+
const (
19+
AcceptVulnerabilityRiskCreatePath = "%s/secure/vulnerability/v1beta1/accepted-risks"
20+
AcceptVulnerabilityRiskGetPath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s"
21+
AcceptVulnerabilityRiskDeletePath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s"
22+
AcceptVulnerabilityRiskUpdatePath = "%s/secure/vulnerability/v1beta1/accepted-risks/%s"
23+
)
24+
25+
func (c *Client) SaveAcceptVulnerabilityRisk(ctx context.Context, p *AcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) {
26+
payload, err := Marshal(p)
27+
if err != nil {
28+
return nil, 0, err
29+
}
30+
31+
response, err := c.requester.Request(ctx, http.MethodPost, fmt.Sprintf(AcceptVulnerabilityRiskCreatePath, c.config.url), payload)
32+
if err != nil {
33+
return nil, 0, err
34+
}
35+
defer response.Body.Close()
36+
37+
if response.StatusCode != http.StatusCreated {
38+
return nil, response.StatusCode, c.ErrorFromResponse(response)
39+
}
40+
41+
resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body)
42+
if err != nil {
43+
return nil, 0, err
44+
}
45+
46+
return &resp, 0, nil
47+
}
48+
49+
func (c *Client) GetAcceptanceVulnerabilityRisk(ctx context.Context, id string) (*AcceptVulnerabilityRisk, int, error) {
50+
response, err := c.requester.Request(ctx, http.MethodGet, fmt.Sprintf(AcceptVulnerabilityRiskGetPath, c.config.url, id), nil)
51+
if err != nil {
52+
return nil, 0, err
53+
}
54+
defer response.Body.Close()
55+
56+
if response.StatusCode != http.StatusOK {
57+
return nil, response.StatusCode, c.ErrorFromResponse(response)
58+
}
59+
60+
resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body)
61+
if err != nil {
62+
return nil, 0, err
63+
}
64+
65+
return &resp, 0, nil
66+
}
67+
68+
func (c *Client) DeleteAcceptanceVulnerabilityRisk(ctx context.Context, id string) error {
69+
response, err := c.requester.Request(ctx, http.MethodDelete, fmt.Sprintf(AcceptVulnerabilityRiskDeletePath, c.config.url, id), nil)
70+
if err != nil {
71+
return err
72+
}
73+
defer response.Body.Close()
74+
75+
if response.StatusCode != http.StatusNoContent {
76+
return c.ErrorFromResponse(response)
77+
}
78+
79+
return nil
80+
}
81+
82+
func (c *Client) UpdateAcceptanceVulnerabilityRisk(ctx context.Context, p *UpdateAcceptVulnerabilityRiskRequest) (*AcceptVulnerabilityRisk, int, error) {
83+
payload, err := Marshal(p)
84+
if err != nil {
85+
return nil, 0, err
86+
}
87+
88+
response, err := c.requester.Request(ctx, http.MethodPut, fmt.Sprintf(AcceptVulnerabilityRiskUpdatePath, c.config.url, p.ID), payload)
89+
if err != nil {
90+
return nil, 0, err
91+
}
92+
defer response.Body.Close()
93+
94+
if response.StatusCode != http.StatusOK {
95+
return nil, response.StatusCode, c.ErrorFromResponse(response)
96+
}
97+
98+
resp, err := Unmarshal[AcceptVulnerabilityRisk](response.Body)
99+
if err != nil {
100+
return nil, 0, err
101+
}
102+
103+
return &resp, 0, nil
104+
}

sysdig/provider.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ func (p *SysdigProvider) Provider() *schema.Provider {
197197
"sysdig_secure_posture_policy": resourceSysdigSecurePosturePolicy(),
198198
"sysdig_secure_posture_control": resourceSysdigSecurePostureControl(),
199199
"sysdig_secure_posture_accept_risk": resourceSysdigSecureAcceptPostureRisk(),
200+
"sysdig_secure_vulnerability_accept_risk": resourceSysdigSecureVulnerabilityAcceptRisk(),
200201
},
201202
DataSourcesMap: map[string]*schema.Resource{
202203
"sysdig_secure_agentless_scanning_assets": dataSourceSysdigSecureAgentlessScanningAssets(),

0 commit comments

Comments
 (0)