Add terraform support to Okta ML Policy by harshampatel-sysdig · Pull Request #675 · sysdiglabs/terraform-provider-sysdig

harshampatel-sysdig · 2025-10-30T00:50:17Z

Key changes:

Added resource and data source for sysdig_secure_okta_ml_policy
Implemented CRUD operations with proper error handling
Added tests and documentation

daniel-almeida

Left some minor comments. I'll let someone else look at the implication of the changes as I don't have any experience with this repo.

daniel-almeida · 2025-10-30T16:26:53Z

@@ -0,0 +1,15 @@
+{


No need to push this. If you can, please add it to gitignore so this isn't tracked in the future.

You might need to delete it from your local machine and push once to remove it from here

daniel-almeida · 2025-10-30T16:30:23Z

+		// TODO: Iterate over a list of rules instead of hard-coding the index values
+		// TODO: Should we assume that only a single Malware rule can be attached to a policy?


These TODOs are intentionally kept to match the AWS ML implementation pattern. Both AWS ML and Okta ML policies currently support a single rule per policy.

For now yes the behavior is 1 rule per policy for these non-Falco types like malware, drift and ML ones. So we can remove the comment if needed

daniel-almeida · 2025-10-30T16:31:02Z

+		})
+	}
+
+	_ = d.Set("rule", rules)


Is this an error being ignored? We should handle it if so.

daniel-almeida · 2025-10-30T16:33:35Z

+}
+
+func oktaMLPolicyFromResourceData(d *schema.ResourceData) (v2.PolicyRulesComposite, error) {
+	policy := &v2.PolicyRulesComposite{


I see there's similar code for other types, but I think it makes more sense to avoid the pointer in this function and pass &policy to oktaMLPolicyReducer, which is where a pointer is actually needed.

daniel-almeida · 2025-10-30T16:35:07Z

+		return diag.FromErr(err)
+	}
+
+	id, _ := strconv.Atoi(d.Id())


Let's handle the error here.

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

ombellare

Added some minor comments. Let me know if you want me to add it to your other branch that you plan to merge

ombellare · 2025-10-30T20:20:52Z

@@ -0,0 +1,15 @@
+{


You might need to delete it from your local machine and push once to remove it from here

ombellare · 2025-10-30T21:41:56Z

+		// TODO: Iterate over a list of rules instead of hard-coding the index values
+		// TODO: Should we assume that only a single Malware rule can be attached to a policy?


For now yes the behavior is 1 rule per policy for these non-Falco types like malware, drift and ML ones. So we can remove the comment if needed

ombellare · 2025-10-30T21:44:56Z

+
+* `anomalous_console_login` - Anomaly detection settings for logins.
+    * `enabled` - Whether anomaly detection is enabled.
+    * `threshold` - Confidence level threshold for triggering alerts.


Could you add that only supported values for the threshold are 1, 2 and 3 please? If you would like you can update for the other ML types as well (I think they were missed there too)

ombellare · 2025-10-30T21:45:38Z

+
+* `description` - (Required) Rule description.
+* `anomalous_console_login` - (Required) This attribute allows you to activate anomaly detection for logins and adjust its settings.
+    * `threshold` - (Required) Trigger at or above confidence level.


I think there should be an enabled field here too similar to how you have on your data source.

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

tembleking · 2025-11-03T10:11:00Z

Closed as duplicate of #676, since this is a PR from a fork and secrets will not be passed to the CI.

Key changes: - Added resource and data source for sysdig_secure_okta_ml_policy - Implemented CRUD operations with proper error handling - Added tests and documentation Similar open PR: #675 (I'll close this once new one merged) --------- Co-authored-by: Fede Barcelona <fede_rico_94@hotmail.com>

Add terraform support to Okta ML Policy

df22c77

harshampatel-sysdig requested review from airadier, daniel-almeida, ivanlysiuk-sysdig, jbainbridgesysdig, mateobur, ombellare, rosenbloomb-sysdig and tembleking as code owners October 30, 2025 00:50

Merge branch 'master' into feature-oktaml-terraform

7d69eab

harshampatel-sysdig marked this pull request as draft October 30, 2025 00:51

harshampatel-sysdig marked this pull request as ready for review October 30, 2025 01:15

daniel-almeida reviewed Oct 30, 2025

View reviewed changes

harshampatel-sysdig added 3 commits October 30, 2025 10:08

Handle error and git ignore vscode

9fd8297

Merge branch 'feature-oktaml-terraform' of https://github.com/harsham…

9c2b3c8

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

Remove pointer and pass &policy

c509dba

harshampatel-sysdig mentioned this pull request Oct 30, 2025

Add terraform support to Okta ML Policy #676

Merged

ombellare reviewed Oct 30, 2025

View reviewed changes

harshampatel-sysdig added 2 commits October 30, 2025 17:06

Updated documentations

62d7809

docs: update threshold descriptions to Default/High/Higher

8443bcd

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

tembleking closed this Nov 3, 2025

		// TODO: Iterate over a list of rules instead of hard-coding the index values
		// TODO: Should we assume that only a single Malware rule can be attached to a policy?

Conversation

harshampatel-sysdig commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daniel-almeida left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ombellare left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tembleking commented Nov 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harshampatel-sysdig commented Oct 30, 2025 •

edited

Loading