refactor: encourage the use of anonymous queries (#280)

The motivation of this change it to avoid making our users set the query id twice, it makes no sense to allow them to configure a different query id, especially not since the platform enforces that both, the query id and the query text match. Furthermore, we have introduced the concept of anonymous queries, such queries are encouraged and should the default way that users create and manage LQL queries. This change updates all documentation and tests to avoid adding the query id inside the query text. Signed-off-by: Salim Afiune Maya <afiune@lacework.net>
lacework · Mar 2, 2022 · b7c2d4c · b7c2d4c
1 parent 953300a
commit b7c2d4c
Show file tree

Hide file tree

Showing 4 changed files with 80 additions and 7 deletions.
diff --git a/examples/resource_lacework_query/main.tf b/examples/resource_lacework_query/main.tf
@@ -19,7 +19,7 @@ variable "query_id" {
 variable "query" {
   type    = string
   default = <<EOT
-  Lql_Terraform_Query {
+  {
       source {
           CloudTrailRawEvents
       }

diff --git a/integration/resource_lacework_query_test.go b/integration/resource_lacework_query_test.go
@@ -120,8 +120,63 @@ func TestQueryCreate(t *testing.T) {
 	assert.Equal(t, queryStringK8, actualQuery)
 }
 
+func TestQueryDeprecatedSytaxWithID(t *testing.T) {
+	terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
+		TerraformDir: "../examples/resource_lacework_query",
+		Vars: map[string]interface{}{
+			"query_id": "Lql_Terraform_Query",
+			"query":    queryDeprecatedSyntaxWithID},
+	})
+	defer terraform.Destroy(t, terraformOptions)
+
+	// Create new Query
+	create := terraform.InitAndApplyAndIdempotent(t, terraformOptions)
+	createProps := GetQueryProps(create)
+
+	actualQueryID := terraform.Output(t, terraformOptions, "query_id")
+	actualQuery := terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", createProps.Data.QueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, createProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, actualQuery)
+
+	// Update Query
+	terraformOptions.Vars = map[string]interface{}{
+		"query_id": "Lql_Terraform_Query",
+		"query":    updateQueryDeprecatedSyntaxWithID,
+	}
+
+	update := terraform.ApplyAndIdempotent(t, terraformOptions)
+	updateProps := GetQueryProps(update)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", updateProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, updateProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+
+	// Run apply again
+	thirdApply := terraform.ApplyAndIdempotent(t, terraformOptions)
+
+	thirdApplyProps := GetQueryProps(thirdApply)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", thirdApplyProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, thirdApplyProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+}
+
 var (
-	queryString = `Lql_Terraform_Query {
+	queryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -139,7 +194,7 @@ var (
         EVENT
     }
 }`
-	queryStringK8 = `Lql_Terraform_Query {
+	queryStringK8 = `{
       source {
           LW_ACT_K8S_AUDIT
       }
@@ -157,7 +212,7 @@ var (
       }
   }`
 
-	updatedQueryString = `Lql_Terraform_Query {
+	updatedQueryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -176,4 +231,22 @@ var (
         EVENT
     }        
 }`
+
+	queryDeprecatedSyntaxWithID = `Lql_Terraform_Query {
+    source {
+        CloudTrailRawEvents
+    }
+    filter {
+        ERROR_CODE is null
+    }
+    return distinct {
+        EVENT
+    }
+}`
+
+	updateQueryDeprecatedSyntaxWithID = `Lql_Terraform_Query{
+    source { CloudTrailRawEvents }
+    filter { ERROR_CODE is null }
+    return distinct { EVENT }
+}`
 )
diff --git a/website/docs/r/policy.html.markdown b/website/docs/r/policy.html.markdown
@@ -21,7 +21,7 @@ Create a Lacework Policy to check for a change of password from an RDS cluster.
 resource "lacework_query" "AWS_CTA_AuroraPasswordChange" {
   query_id = "TF_AWS_CTA_AuroraPasswordChange"
   query    = <<EOT
-  TF_AWS_CTA_AuroraPasswordChange {
+  {
       source {
           CloudTrailRawEvents
       }

diff --git a/website/docs/r/query.html.markdown b/website/docs/r/query.html.markdown
@@ -22,7 +22,7 @@ Query all EC2 instances with public IP addresses.
 resource "lacework_query" "example" {
   query_id = "TF_AWS_Config_EC2InstanceWithPublicIPAddress"
   query    = <<EOT
-  TF_AWS_Config_EC2InstanceWithPublicIPAddress {
+  {
       source {
           LW_CFG_AWS_EC2_INSTANCES
       }
@@ -50,7 +50,7 @@ Query CloutTrail events and filter only S3 buckets with ACL 'public-read', 'publ
 resource "lacework_query" "example" {
   query_id       = "TF_AWS_CTA_S3PublicACLCreated"
   query          = <<EOT
-  TF_AWS_CTA_S3PublicACLCreated {
+  {
       source {
           CloudTrailRawEvents
       }