From fb4c862003444e163298bb15f1a762bd47a6016b Mon Sep 17 00:00:00 2001
From: Salim Afiune Maya <afiune@lacework.net>
Date: Wed, 2 Mar 2022 00:26:08 -0800
Subject: [PATCH] refactor: encourage the use of anonymous queries

The motivation of this change it to avoid making our users set the query
id twice, it makes no sense to allow them to configure a different query
id, especially not since the platform enforces that both, the query id and
the query text match.

Furthermore, we have introduced the concept of anonymous queries, such
queries are encouraged and should the default way that users create and
manage LQL queries.

This change updates all documentation and tests to avoid adding the
query id inside the query text.

Signed-off-by: Salim Afiune Maya <afiune@lacework.net>
---
 examples/resource_lacework_query/main.tf    |  2 +-
 integration/resource_lacework_query_test.go | 79 ++++++++++++++++++++-
 website/docs/r/policy.html.markdown         |  2 +-
 website/docs/r/query.html.markdown          |  4 +-
 4 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/examples/resource_lacework_query/main.tf b/examples/resource_lacework_query/main.tf
index df0d7d621..225f3f01b 100644
--- a/examples/resource_lacework_query/main.tf
+++ b/examples/resource_lacework_query/main.tf
@@ -19,7 +19,7 @@ variable "query_id" {
 variable "query" {
   type    = string
   default = <<EOT
-  Lql_Terraform_Query {
+  {
       source {
           CloudTrailRawEvents
       }
diff --git a/integration/resource_lacework_query_test.go b/integration/resource_lacework_query_test.go
index 33207066c..902eee64c 100644
--- a/integration/resource_lacework_query_test.go
+++ b/integration/resource_lacework_query_test.go
@@ -120,8 +120,63 @@ func TestQueryCreate(t *testing.T) {
 	assert.Equal(t, queryStringK8, actualQuery)
 }
 
+func TestQueryDeprecatedSytaxWithID(t *testing.T) {
+	terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
+		TerraformDir: "../examples/resource_lacework_query",
+		Vars: map[string]interface{}{
+			"query_id": "Lql_Terraform_Query",
+			"query":    queryDeprecatedSyntaxWithID},
+	})
+	defer terraform.Destroy(t, terraformOptions)
+
+	// Create new Query
+	create := terraform.InitAndApplyAndIdempotent(t, terraformOptions)
+	createProps := GetQueryProps(create)
+
+	actualQueryID := terraform.Output(t, terraformOptions, "query_id")
+	actualQuery := terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", createProps.Data.QueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, createProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, queryDeprecatedSyntaxWithID, actualQuery)
+
+	// Update Query
+	terraformOptions.Vars = map[string]interface{}{
+		"query_id": "Lql_Terraform_Query",
+		"query":    updateQueryDeprecatedSyntaxWithID,
+	}
+
+	update := terraform.ApplyAndIdempotent(t, terraformOptions)
+	updateProps := GetQueryProps(update)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", updateProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, updateProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+
+	// Run apply again
+	thirdApply := terraform.ApplyAndIdempotent(t, terraformOptions)
+
+	thirdApplyProps := GetQueryProps(thirdApply)
+
+	actualQueryID = terraform.Output(t, terraformOptions, "query_id")
+	actualQuery = terraform.Output(t, terraformOptions, "query")
+
+	assert.Equal(t, "Lql_Terraform_Query", thirdApplyProps.Data.QueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, thirdApplyProps.Data.QueryText)
+
+	assert.Equal(t, "Lql_Terraform_Query", actualQueryID)
+	assert.Equal(t, updateQueryDeprecatedSyntaxWithID, actualQuery)
+}
+
 var (
-	queryString = `Lql_Terraform_Query {
+	queryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -139,7 +194,7 @@ var (
         EVENT
     }
 }`
-	queryStringK8 = `Lql_Terraform_Query {
+	queryStringK8 = `{
       source {
           LW_ACT_K8S_AUDIT
       }
@@ -157,7 +212,7 @@ var (
       }
   }`
 
-	updatedQueryString = `Lql_Terraform_Query {
+	updatedQueryString = `{
     source {
         CloudTrailRawEvents
     }
@@ -176,4 +231,22 @@ var (
         EVENT
     }        
 }`
+
+	queryDeprecatedSyntaxWithID = `Lql_Terraform_Query {
+    source {
+        CloudTrailRawEvents
+    }
+    filter {
+        ERROR_CODE is null
+    }
+    return distinct {
+        EVENT
+    }
+}`
+
+	updateQueryDeprecatedSyntaxWithID = `Lql_Terraform_Query{
+    source { CloudTrailRawEvents }
+    filter { ERROR_CODE is null }
+    return distinct { EVENT }
+}`
 )
diff --git a/website/docs/r/policy.html.markdown b/website/docs/r/policy.html.markdown
index 35cccd4cd..ea18a9633 100644
--- a/website/docs/r/policy.html.markdown
+++ b/website/docs/r/policy.html.markdown
@@ -21,7 +21,7 @@ Create a Lacework Policy to check for a change of password from an RDS cluster.
 resource "lacework_query" "AWS_CTA_AuroraPasswordChange" {
   query_id = "TF_AWS_CTA_AuroraPasswordChange"
   query    = <<EOT
-  TF_AWS_CTA_AuroraPasswordChange {
+  {
       source {
           CloudTrailRawEvents
       }
diff --git a/website/docs/r/query.html.markdown b/website/docs/r/query.html.markdown
index f663ad9ee..e63ab04ab 100644
--- a/website/docs/r/query.html.markdown
+++ b/website/docs/r/query.html.markdown
@@ -22,7 +22,7 @@ Query all EC2 instances with public IP addresses.
 resource "lacework_query" "example" {
   query_id = "TF_AWS_Config_EC2InstanceWithPublicIPAddress"
   query    = <<EOT
-  TF_AWS_Config_EC2InstanceWithPublicIPAddress {
+  {
       source {
           LW_CFG_AWS_EC2_INSTANCES
       }
@@ -50,7 +50,7 @@ Query CloutTrail events and filter only S3 buckets with ACL 'public-read', 'publ
 resource "lacework_query" "example" {
   query_id       = "TF_AWS_CTA_S3PublicACLCreated"
   query          = <<EOT
-  TF_AWS_CTA_S3PublicACLCreated {
+  {
       source {
           CloudTrailRawEvents
       }