From b7c2d4ce9637606154293bf34101a78c078c4dc7 Mon Sep 17 00:00:00 2001
From: Salim Afiune <afiune@lacework.net>
Date: Wed, 2 Mar 2022 07:52:15 -0800
Subject: [PATCH] refactor: encourage the use of anonymous queries (#280)

The motivation of this change it to avoid making our users set the query
id twice, it makes no sense to allow them to configure a different query
id, especially not since the platform enforces that both, the query id and
the query text match.

Furthermore, we have introduced the concept of anonymous queries, such
queries are encouraged and should the default way that users create and
manage LQL queries.

This change updates all documentation and tests to avoid adding the
query id inside the query text.

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>
---
 examples/resource_lacework_query/main.tf    |  2 +-
 integration/resource_lacework_query_test.go | 79 ++++++++++++++++++++-
 website/docs/r/policy.html.markdown         |  2 +-
 website/docs/r/query.html.markdown          |  4 +-
 4 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/examples/resource_lacework_query/main.tf b/examples/resource_lacework_query/main.tf
index df0d7d62..225f3f01 100644
--- a/examples/resource_lacework_query/main.tf
+++ b/examples/resource_lacework_query/main.tf
@@ -19,7 +19,7 @@ variable "query_id" {
 variable "query" {
   type    = string
   default = <<EOT
-  Lql_Terraform_Query {
+  {
       source {
           CloudTrailRawEvents
       }
diff --git a/integration/resource_lacework_query_test.go b/integration/resource_lacework_query_test.go
index 33207066..902eee64 100644
--- a/integration/resource_lacework_query_test.go
+++ b/integration/resource_lacework_query_test.go
@@ -120,8 +120,63 @@ func TestQueryCreate(t *testing.T) {
 	assert.Equal(t, queryStringK8, actualQuery)
 }
 
+func TestQueryDeprecatedSytaxWithID(t *testing.T) {
+	terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
+		TerraformDir: "../examples/resource_lacework_query",
+		Vars: map[string]interface{}{
+			"query_id": "Lql_Terraform_Query",
+			"query":    queryDeprecatedSyntaxWithID},
+	})
+	defer terraform.Destroy(t, terraformOptions)
+
+	// Create new Query
+	create := terraform.InitAndApplyAndIdempotent(t, terraformOptions)
+	createProps := GetQueryProps(create)
+
+	actualQueryID := terraform.Output(t, terraformOptions, "query_id")
+	actualQuery := terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", createProps.Data.QueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, createProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, actualQuery)
+
+	// Update Query
+	terraformOptions.Vars = map[string]interface{}{
+		"query_id": "Lql_Terraform_Query",
+		"query":    updateQueryDeprecatedSyntaxWithID,
+	}
+
+	update := terraform.ApplyAndIdempotent(t, terraformOptions)
+	updateProps := GetQueryProps(update)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", updateProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, updateProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+
+	// Run apply again
+	thirdApply := terraform.ApplyAndIdempotent(t, terraformOptions)
+
+	thirdApplyProps := GetQueryProps(thirdApply)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", thirdApplyProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, thirdApplyProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+}
+
 var (
-	queryString = `Lql_Terraform_Query {
+	queryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -139,7 +194,7 @@ var (
         EVENT
     }
 }`
-	queryStringK8 = `Lql_Terraform_Query {
+	queryStringK8 = `{
       source {
           LW_ACT_K8S_AUDIT
       }
@@ -157,7 +212,7 @@ var (
       }
   }`
 
-	updatedQueryString = `Lql_Terraform_Query {
+	updatedQueryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -176,4 +231,22 @@ var (
         EVENT
     }        
 }`
+
+	queryDeprecatedSyntaxWithID = `Lql_Terraform_Query {
+    source {
+        CloudTrailRawEvents
+    }
+    filter {
+        ERROR_CODE is null
+    }
+    return distinct {
+        EVENT
+    }
+}`
+
+	updateQueryDeprecatedSyntaxWithID = `Lql_Terraform_Query{
+    source { CloudTrailRawEvents }
+    filter { ERROR_CODE is null }
+    return distinct { EVENT }
+}`
 )
diff --git a/website/docs/r/policy.html.markdown b/website/docs/r/policy.html.markdown
index 35cccd4c..ea18a963 100644
--- a/website/docs/r/policy.html.markdown
+++ b/website/docs/r/policy.html.markdown
@@ -21,7 +21,7 @@ Create a Lacework Policy to check for a change of password from an RDS cluster.
 resource "lacework_query" "AWS_CTA_AuroraPasswordChange" {
   query_id = "TF_AWS_CTA_AuroraPasswordChange"
   query    = <<EOT
-  TF_AWS_CTA_AuroraPasswordChange {
+  {
       source {
           CloudTrailRawEvents
       }
diff --git a/website/docs/r/query.html.markdown b/website/docs/r/query.html.markdown
index f663ad9e..e63ab04a 100644
--- a/website/docs/r/query.html.markdown
+++ b/website/docs/r/query.html.markdown
@@ -22,7 +22,7 @@ Query all EC2 instances with public IP addresses.
 resource "lacework_query" "example" {
   query_id = "TF_AWS_Config_EC2InstanceWithPublicIPAddress"
   query    = <<EOT
-  TF_AWS_Config_EC2InstanceWithPublicIPAddress {
+  {
       source {
           LW_CFG_AWS_EC2_INSTANCES
       }
@@ -50,7 +50,7 @@ Query CloutTrail events and filter only S3 buckets with ACL 'public-read', 'publ
 resource "lacework_query" "example" {
   query_id       = "TF_AWS_CTA_S3PublicACLCreated"
   query          = <<EOT
-  TF_AWS_CTA_S3PublicACLCreated {
+  {
       source {
           CloudTrailRawEvents
       }