Merge pull request hashicorp#3871 from terraform-providers/f-wafregio…

…nal-rate-based-rule

New Resource: aws_wafregional_rate_based_rule

aws/provider.go

@@ -559,6 +559,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_wafregional_byte_match_set":               resourceAwsWafRegionalByteMatchSet(),
 			"aws_wafregional_geo_match_set":                resourceAwsWafRegionalGeoMatchSet(),
 			"aws_wafregional_ipset":                        resourceAwsWafRegionalIPSet(),
+			"aws_wafregional_rate_based_rule":              resourceAwsWafRegionalRateBasedRule(),
 			"aws_wafregional_regex_pattern_set":            resourceAwsWafRegionalRegexPatternSet(),
 			"aws_wafregional_rule":                         resourceAwsWafRegionalRule(),
 			"aws_wafregional_size_constraint_set":          resourceAwsWafRegionalSizeConstraintSet(),

aws/resource_aws_waf_rule.go

@@ -173,39 +173,3 @@ func updateWafRuleResource(id string, oldP, newP []interface{}, conn *waf.WAF) e
 
 	return nil
 }
-
-func diffWafRulePredicates(oldP, newP []interface{}) []*waf.RuleUpdate {
-	updates := make([]*waf.RuleUpdate, 0)
-
-	for _, op := range oldP {
-		predicate := op.(map[string]interface{})
-
-		if idx, contains := sliceContainsMap(newP, predicate); contains {
-			newP = append(newP[:idx], newP[idx+1:]...)
-			continue
-		}
-
-		updates = append(updates, &waf.RuleUpdate{
-			Action: aws.String(waf.ChangeActionDelete),
-			Predicate: &waf.Predicate{
-				Negated: aws.Bool(predicate["negated"].(bool)),
-				Type:    aws.String(predicate["type"].(string)),
-				DataId:  aws.String(predicate["data_id"].(string)),
-			},
-		})
-	}
-
-	for _, np := range newP {
-		predicate := np.(map[string]interface{})
-
-		updates = append(updates, &waf.RuleUpdate{
-			Action: aws.String(waf.ChangeActionInsert),
-			Predicate: &waf.Predicate{
-				Negated: aws.Bool(predicate["negated"].(bool)),
-				Type:    aws.String(predicate["type"].(string)),
-				DataId:  aws.String(predicate["data_id"].(string)),
-			},
-		})
-	}
-	return updates
-}

aws/resource_aws_wafregional_rate_based_rule.go

@@ -0,0 +1,195 @@
+package aws
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/waf"
+	"github.com/aws/aws-sdk-go/service/wafregional"
+	"github.com/hashicorp/terraform/helper/schema"
+	"github.com/hashicorp/terraform/helper/validation"
+)
+
+func resourceAwsWafRegionalRateBasedRule() *schema.Resource {
+	return &schema.Resource{
+		Create: resourceAwsWafRegionalRateBasedRuleCreate,
+		Read:   resourceAwsWafRegionalRateBasedRuleRead,
+		Update: resourceAwsWafRegionalRateBasedRuleUpdate,
+		Delete: resourceAwsWafRegionalRateBasedRuleDelete,
+
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+				ForceNew: true,
+			},
+			"metric_name": {
+				Type:         schema.TypeString,
+				Required:     true,
+				ForceNew:     true,
+				ValidateFunc: validateWafMetricName,
+			},
+			"predicate": {
+				Type:     schema.TypeSet,
+				Optional: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"negated": {
+							Type:     schema.TypeBool,
+							Required: true,
+						},
+						"data_id": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validateMaxLength(128),
+						},
+						"type": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validateWafPredicatesType(),
+						},
+					},
+				},
+			},
+			"rate_key": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"rate_limit": {
+				Type:         schema.TypeInt,
+				Required:     true,
+				ValidateFunc: validation.IntAtLeast(2000),
+			},
+		},
+	}
+}
+
+func resourceAwsWafRegionalRateBasedRuleCreate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).wafregionalconn
+	region := meta.(*AWSClient).region
+
+	wr := newWafRegionalRetryer(conn, region)
+	out, err := wr.RetryWithToken(func(token *string) (interface{}, error) {
+		params := &waf.CreateRateBasedRuleInput{
+			ChangeToken: token,
+			MetricName:  aws.String(d.Get("metric_name").(string)),
+			Name:        aws.String(d.Get("name").(string)),
+			RateKey:     aws.String(d.Get("rate_key").(string)),
+			RateLimit:   aws.Int64(int64(d.Get("rate_limit").(int))),
+		}
+
+		return conn.CreateRateBasedRule(params)
+	})
+	if err != nil {
+		return err
+	}
+	resp := out.(*waf.CreateRateBasedRuleOutput)
+	d.SetId(*resp.Rule.RuleId)
+	return resourceAwsWafRegionalRateBasedRuleUpdate(d, meta)
+}
+
+func resourceAwsWafRegionalRateBasedRuleRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).wafregionalconn
+
+	params := &waf.GetRateBasedRuleInput{
+		RuleId: aws.String(d.Id()),
+	}
+
+	resp, err := conn.GetRateBasedRule(params)
+	if err != nil {
+		if isAWSErr(err, wafregional.ErrCodeWAFNonexistentItemException, "") {
+			log.Printf("[WARN] WAF Regional Rate Based Rule (%s) not found, removing from state", d.Id())
+			d.SetId("")
+			return nil
+		}
+
+		return err
+	}
+
+	var predicates []map[string]interface{}
+
+	for _, predicateSet := range resp.Rule.MatchPredicates {
+		predicates = append(predicates, map[string]interface{}{
+			"negated": *predicateSet.Negated,
+			"type":    *predicateSet.Type,
+			"data_id": *predicateSet.DataId,
+		})
+	}
+
+	d.Set("predicate", predicates)
+	d.Set("name", resp.Rule.Name)
+	d.Set("metric_name", resp.Rule.MetricName)
+	d.Set("rate_key", resp.Rule.RateKey)
+	d.Set("rate_limit", resp.Rule.RateLimit)
+
+	return nil
+}
+
+func resourceAwsWafRegionalRateBasedRuleUpdate(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).wafregionalconn
+	region := meta.(*AWSClient).region
+
+	if d.HasChange("predicate") {
+		o, n := d.GetChange("predicate")
+		oldP, newP := o.(*schema.Set).List(), n.(*schema.Set).List()
+		rateLimit := d.Get("rate_limit")
+
+		err := updateWafRateBasedRuleResourceWR(d.Id(), oldP, newP, rateLimit, conn, region)
+		if err != nil {
+			return fmt.Errorf("Error Updating WAF Rule: %s", err)
+		}
+	}
+
+	return resourceAwsWafRegionalRateBasedRuleRead(d, meta)
+}
+
+func resourceAwsWafRegionalRateBasedRuleDelete(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*AWSClient).wafregionalconn
+	region := meta.(*AWSClient).region
+
+	oldPredicates := d.Get("predicate").(*schema.Set).List()
+	if len(oldPredicates) > 0 {
+		noPredicates := []interface{}{}
+		rateLimit := d.Get("rate_limit")
+
+		err := updateWafRateBasedRuleResourceWR(d.Id(), oldPredicates, noPredicates, rateLimit, conn, region)
+		if err != nil {
+			return fmt.Errorf("Error updating WAF Regional Rate Based Rule Predicates: %s", err)
+		}
+	}
+
+	wr := newWafRegionalRetryer(conn, region)
+	_, err := wr.RetryWithToken(func(token *string) (interface{}, error) {
+		req := &waf.DeleteRateBasedRuleInput{
+			ChangeToken: token,
+			RuleId:      aws.String(d.Id()),
+		}
+		log.Printf("[INFO] Deleting WAF Regional Rate Based Rule")
+		return conn.DeleteRateBasedRule(req)
+	})
+	if err != nil {
+		return fmt.Errorf("Error deleting WAF Regional Rate Based Rule: %s", err)
+	}
+
+	return nil
+}
+
+func updateWafRateBasedRuleResourceWR(id string, oldP, newP []interface{}, rateLimit interface{}, conn *wafregional.WAFRegional, region string) error {
+	wr := newWafRegionalRetryer(conn, region)
+	_, err := wr.RetryWithToken(func(token *string) (interface{}, error) {
+		req := &waf.UpdateRateBasedRuleInput{
+			ChangeToken: token,
+			RuleId:      aws.String(id),
+			Updates:     diffWafRulePredicates(oldP, newP),
+			RateLimit:   aws.Int64(int64(rateLimit.(int))),
+		}
+
+		return conn.UpdateRateBasedRule(req)
+	})
+	if err != nil {
+		return fmt.Errorf("Error Updating WAF Regional Rate Based Rule: %s", err)
+	}
+
+	return nil
+}