feat(firewall): add firewall management resources - #422
Merged
Conversation
…rces Implements CrowdStrike firewall management capabilities for Terraform: Resources: - crowdstrike_firewall_rule_group: Manage firewall rule groups with nested rules - crowdstrike_firewall_policy: Manage firewall policies with host groups and settings - crowdstrike_firewall_policy_precedence: Control policy ordering/priority Data Sources: - crowdstrike_firewall_policies: Query existing firewall policies - crowdstrike_firewall_rule_groups: Query existing rule groups Closes #99
…tion Bug fixes discovered during verification testing: 1. Log field not preserved: API doesn't return log field, causing drift - Preserve plan's log value in wrapRules when reading back from API 2. Single port handling: start=443, end=443 caused API 'duplicate ports' error - Convert to end=0 when sending to API - Restore plan's end value when reading back (if plan had start==end) 3. Precedence dynamic enforcement race condition: - Parallel tests changing policy count caused failures - Preserve plan IDs in state for dynamic mode instead of reading from API - Changed precedence tests to sequential to avoid interference All 29 acceptance tests pass.
This removes all duplicate calls that were introduced during the merge conflict resolution
Rename the schema-visible test_mode attribute to monitor_mode and drop the last_updated and rule-level log fields across the firewall policy, rule group, and precedence resources. - migrate error handling to tferrors.NewDiagnosticFromAPIError with read/read-write scopes and not-found handling - add config validation: monitor_mode requires enforce, and address_family=ANY conflicts with local/remote addresses - fix Linux platform ID mapping (2 -> 3) - support clearing an empty policy description via a custom request type that drops omitempty - map address_family ANY<->NONE and add ESP to Linux-unsupported protocols - simplify precedence dynamic enforcement by truncating to the managed count instead of branching on preserve-plan-IDs - expose host_groups, rule_group_ids, container settings, and nested rules in the firewall data sources
# Conflicts: # internal/provider/provider.go # internal/sweep/sweep_test.go
7 tasks
redhatrises
approved these changes
Jul 8, 2026
adelfazel
pushed a commit
to adelfazel/terraform-provider-crowdstrike
that referenced
this pull request
Jul 13, 2026
* feat(firewall): add firewall rule group, policy, and precedence resources Implements CrowdStrike firewall management capabilities for Terraform: Resources: - crowdstrike_firewall_rule_group: Manage firewall rule groups with nested rules - crowdstrike_firewall_policy: Manage firewall policies with host groups and settings - crowdstrike_firewall_policy_precedence: Control policy ordering/priority Data Sources: - crowdstrike_firewall_policies: Query existing firewall policies - crowdstrike_firewall_rule_groups: Query existing rule groups --------- Co-authored-by: tphilll <153414806+tphilll@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #344 by @tphilll. Includes the original firewall contribution plus additional refinements:
test_mode->monitor_modeand add validation requiringenforcelast_updatedand the rule-levellogfieldtferrors.NewDiagnosticFromAPIErroraddress_familyANY<->NONE and add ESP to Linux-unsupported protocols