Skip to content

Commit 4a6ec11

Browse files
iac-agentiac-agent
committed
feat(teo): add new parameters to tencentcloud_teo_security_policy_config
1 parent e3683c9 commit 4a6ec11

12 files changed

Lines changed: 942 additions & 325 deletions

File tree

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ require (
9393
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tdcpg v1.0.533
9494
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tdmq v1.3.46
9595
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tem v1.0.578
96-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.90
96+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.108
9797
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.3.86
9898
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/trocket v1.1.0
9999
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tse v1.0.857

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1073,8 +1073,8 @@ github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tdmq v1.3.46 h1:hnBTV4y
10731073
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tdmq v1.3.46/go.mod h1:brB63yRDKDgCzEBFU5G3OBV+wQ+lpnOnedxwdnLgjjk=
10741074
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tem v1.0.578 h1:vBpQhUroO+FAslUmsDWGi8nvczsqZBWVgQwlnyT0Aj8=
10751075
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tem v1.0.578/go.mod h1:UlojGQh/9wb7/uXPNi7PvMral1CNAskVDNgqJEV83l0=
1076-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.90 h1:UAefUxiVLj639m5jplPyTyOkF5vT8W0d8TrWZ7cepj4=
1077-
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.90/go.mod h1:YV/JlZueAHyf9eyLmowdbeX90MR5jJmy0Dn6gZwPT2M=
1076+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.108 h1:cAw2o4gMuAUZnjdo+WDZmUTHgH6FdysXeUDI1YcBjgI=
1077+
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo v1.3.108/go.mod h1:/+JtDwgVSkaDGMU42zTWtidw/p56hl2N46zkWJLAr9U=
10781078
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/thpc v1.0.998 h1:f4/n0dVKQTD06xJ84B5asHViNJHrZmGojdAWEPIsITM=
10791079
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/thpc v1.0.998/go.mod h1:fyi/HUwCwVe2NCCCjz8k/C5GwPu3QazCZO+OBJ3MhLk=
10801080
github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke v1.3.86 h1:vTpLGPpzAbZHOv0F6hmy8C9IBwJIUfhTrXH0vi7eiGA=

‎openspec/changes/archive/2026-06-04-add-teo-security-policy-config-params/.openspec.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
schema: spec-driven
2+
created: 2026-06-04

‎openspec/changes/archive/2026-06-04-add-teo-security-policy-config-params/design.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
## Context
2+
3+
The `tencentcloud_teo_security_policy_config` resource manages TEO (TencentCloud EdgeOne) security policy configurations. It needs to support the full parameter set of the `ModifySecurityPolicy` and `DescribeSecurityPolicy` cloud APIs from the `github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo/v20220901` package.
4+
5+
The resource is a RESOURCE_KIND_GENERAL type that uses:
6+
- `ModifySecurityPolicy` for Create and Update operations
7+
- `DescribeSecurityPolicy` for Read operations
8+
- No dedicated Delete API (delete is a no-op or resets to defaults)
9+
10+
The resource supports three entity types for targeting policies:
11+
- `ZoneDefaultPolicy`: Site-level policy (ID format: `{zone_id}#ZoneDefaultPolicy`)
12+
- `Host`: Domain-level policy (ID format: `{zone_id}#Host#{host}`)
13+
- `Template`: Template-level policy (ID format: `{zone_id}#Template#{template_id}`)
14+
15+
## Goals / Non-Goals
16+
17+
**Goals:**
18+
- Support all parameters of `ModifySecurityPolicy` API: `zone_id`, `entity`, `host`, `template_id`, `security_config`, `security_policy`
19+
- Support reading back `security_policy` from `DescribeSecurityPolicy` response
20+
- Use composite ID with `tccommon.FILED_SP` separator based on entity type
21+
- Implement retry logic with `tccommon.ReadRetryTimeout` for API calls
22+
- Maintain backward compatibility with existing configurations
23+
24+
**Non-Goals:**
25+
- Adding new sub-fields within `SecurityPolicy` or `SecurityConfig` structs beyond what the SDK provides
26+
- Implementing a dedicated Delete API (the resource uses a no-op delete)
27+
- Modifying the existing resource ID format
28+
29+
## Decisions
30+
31+
1. **Resource ID format**: Use composite ID `{zone_id}#{entity}[#{host_or_template_id}]` with `tccommon.FILED_SP` as separator. This allows import support and uniquely identifies the policy target.
32+
33+
2. **ForceNew fields**: `zone_id`, `entity`, `host`, and `template_id` are ForceNew since changing them targets a different policy entirely.
34+
35+
3. **security_config vs security_policy**: Both are Optional. `security_config` is the legacy configuration format, while `security_policy` is the newer expression-based format. The API handles precedence between them.
36+
37+
4. **Read behavior**: `DescribeSecurityPolicy` returns `SecurityPolicy` in the response. The `security_config` field is write-only since the Describe API does not return it.
38+
39+
## Risks / Trade-offs
40+
41+
- [Risk] `security_config` is write-only (not returned by DescribeSecurityPolicy) → Mark as Computed to avoid perpetual diffs; document this behavior.
42+
- [Risk] Complex nested structures in `SecurityPolicy` → Use careful nil checks in Read to avoid panics on optional fields.

‎openspec/changes/archive/2026-06-04-add-teo-security-policy-config-params/proposal.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
## Why
2+
3+
The `tencentcloud_teo_security_policy_config` resource needs to support the full set of parameters for the `ModifySecurityPolicy` and `DescribeSecurityPolicy` cloud APIs, enabling users to manage TEO security policy configurations including zone-level, template-level, and host-level policies through Terraform.
4+
5+
## What Changes
6+
7+
- Add parameters to `tencentcloud_teo_security_policy_config` resource to support the `ModifySecurityPolicy` API inputs: `zone_id`, `entity`, `host`, `template_id`, `security_config`, and `security_policy`.
8+
- Add parameters to support the `DescribeSecurityPolicy` API inputs (`zone_id`, `entity`, `host`, `template_id`) and output (`security_policy`).
9+
- The resource uses `ModifySecurityPolicy` for create/update operations and `DescribeSecurityPolicy` for read operations.
10+
11+
## Capabilities
12+
13+
### New Capabilities
14+
- `teo-security-policy-config-params`: Add full parameter support for the TEO security policy config resource, covering zone_id, entity, host, template_id, security_config, and security_policy fields mapped to the ModifySecurityPolicy and DescribeSecurityPolicy cloud APIs.
15+
16+
### Modified Capabilities
17+
18+
## Impact
19+
20+
- `tencentcloud/services/teo/resource_tc_teo_security_policy_config.go`: Resource schema and CRUD logic
21+
- `tencentcloud/services/teo/resource_tc_teo_security_policy_config_test.go`: Unit tests
22+
- `tencentcloud/services/teo/resource_tc_teo_security_policy_config.md`: Documentation
23+
- `tencentcloud/services/teo/service_tencentcloud_teo.go`: Service layer for API calls
24+
- `tencentcloud/provider.go`: Resource registration
25+
- Depends on `github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/teo/v20220901` SDK package

‎openspec/changes/archive/2026-06-04-add-teo-security-policy-config-params/specs/teo-security-policy-config-params/spec.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## ADDED Requirements
2+
3+
### Requirement: Resource supports full ModifySecurityPolicy API parameters
4+
5+
The `tencentcloud_teo_security_policy_config` resource SHALL support the following parameters mapped to the `ModifySecurityPolicy` cloud API:
6+
- `zone_id` (Required, ForceNew, String): Maps to `request.ZoneId`. The site ID.
7+
- `entity` (Optional, ForceNew, String): Maps to `request.Entity`. Security policy type, valid values: `ZoneDefaultPolicy`, `Template`, `Host`.
8+
- `host` (Optional, ForceNew, String): Maps to `request.Host`. Domain name, used when entity is `Host`.
9+
- `template_id` (Optional, ForceNew, String): Maps to `request.TemplateId`. Template ID, used when entity is `Template`.
10+
- `security_config` (Optional, Computed, List): Maps to `request.SecurityConfig`. Legacy security configuration.
11+
- `security_policy` (Optional, List): Maps to `request.SecurityPolicy`. Expression-based security policy configuration.
12+
13+
#### Scenario: Create security policy with ZoneDefaultPolicy entity
14+
- **WHEN** user specifies `zone_id` and `entity = "ZoneDefaultPolicy"` with `security_policy` configuration
15+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#ZoneDefaultPolicy`
16+
17+
#### Scenario: Create security policy with Host entity
18+
- **WHEN** user specifies `zone_id`, `entity = "Host"`, and `host = "www.example.com"` with `security_policy` configuration
19+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#Host#{host}`
20+
21+
#### Scenario: Create security policy with Template entity
22+
- **WHEN** user specifies `zone_id`, `entity = "Template"`, and `template_id = "temp-xxx"` with `security_policy` configuration
23+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#Template#{template_id}`
24+
25+
### Requirement: Resource supports DescribeSecurityPolicy API for reading state
26+
27+
The resource SHALL use the `DescribeSecurityPolicy` API to read back the current state, passing `zone_id`, `entity`, `host`, and `template_id` as request parameters, and mapping `response.Response.SecurityPolicy` to the `security_policy` attribute.
28+
29+
#### Scenario: Read security policy state
30+
- **WHEN** the resource performs a Read operation
31+
- **THEN** the resource SHALL call `DescribeSecurityPolicy` with `zone_id`, `entity`, `host`, and `template_id` extracted from the resource ID, and populate the `security_policy` attribute from the response
32+
33+
#### Scenario: Resource not found during read
34+
- **WHEN** the `DescribeSecurityPolicy` API returns nil for `SecurityPolicy`
35+
- **THEN** the resource SHALL remove itself from state by calling `d.SetId("")`
36+
37+
### Requirement: Resource supports import via composite ID
38+
39+
The resource SHALL support import using the composite ID format based on entity type.
40+
41+
#### Scenario: Import ZoneDefaultPolicy
42+
- **WHEN** user imports with ID `{zone_id}#ZoneDefaultPolicy`
43+
- **THEN** the resource SHALL parse the ID and read the zone-level security policy
44+
45+
#### Scenario: Import Host policy
46+
- **WHEN** user imports with ID `{zone_id}#Host#{host}`
47+
- **THEN** the resource SHALL parse the ID and read the domain-level security policy
48+
49+
#### Scenario: Import Template policy
50+
- **WHEN** user imports with ID `{zone_id}#Template#{template_id}`
51+
- **THEN** the resource SHALL parse the ID and read the template-level security policy

‎openspec/changes/archive/2026-06-04-add-teo-security-policy-config-params/tasks.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
## 1. Resource Schema and CRUD Implementation
2+
3+
- [x] 1.1 Add/verify schema definitions for `zone_id`, `entity`, `host`, `template_id`, `security_config`, and `security_policy` parameters in `tencentcloud/services/teo/resource_tc_teo_security_policy_config.go`
4+
- [x] 1.2 Implement Create function using `ModifySecurityPolicy` API with all parameters and composite ID generation
5+
- [x] 1.3 Implement Read function using `DescribeSecurityPolicy` API with `zone_id`, `entity`, `host`, `template_id` inputs and `security_policy` output mapping
6+
- [x] 1.4 Implement Update function using `ModifySecurityPolicy` API with all parameters
7+
- [x] 1.5 Implement Delete function (no-op or reset to defaults)
8+
9+
## 2. Service Layer
10+
11+
- [x] 2.1 Add/verify `DescribeTeoSecurityPolicyConfigById` function in `tencentcloud/services/teo/service_tencentcloud_teo.go` with retry logic using `tccommon.ReadRetryTimeout`
12+
13+
## 3. Provider Registration
14+
15+
- [x] 3.1 Register `tencentcloud_teo_security_policy_config` resource in `tencentcloud/provider.go` and `tencentcloud/provider.md`
16+
17+
## 4. Documentation
18+
19+
- [x] 4.1 Update `tencentcloud/services/teo/resource_tc_teo_security_policy_config.md` with Example Usage for all entity types and Import section with composite ID format
20+
21+
## 5. Unit Tests
22+
23+
- [x] 5.1 Add unit tests in `tencentcloud/services/teo/resource_tc_teo_security_policy_config_test.go` using gomonkey to mock cloud API calls, covering Create/Read/Update/Delete operations

‎openspec/specs/teo-security-policy-config-params/spec.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## ADDED Requirements
2+
3+
### Requirement: Resource supports full ModifySecurityPolicy API parameters
4+
5+
The `tencentcloud_teo_security_policy_config` resource SHALL support the following parameters mapped to the `ModifySecurityPolicy` cloud API:
6+
- `zone_id` (Required, ForceNew, String): Maps to `request.ZoneId`. The site ID.
7+
- `entity` (Optional, ForceNew, String): Maps to `request.Entity`. Security policy type, valid values: `ZoneDefaultPolicy`, `Template`, `Host`.
8+
- `host` (Optional, ForceNew, String): Maps to `request.Host`. Domain name, used when entity is `Host`.
9+
- `template_id` (Optional, ForceNew, String): Maps to `request.TemplateId`. Template ID, used when entity is `Template`.
10+
- `security_config` (Optional, Computed, List): Maps to `request.SecurityConfig`. Legacy security configuration.
11+
- `security_policy` (Optional, List): Maps to `request.SecurityPolicy`. Expression-based security policy configuration.
12+
13+
#### Scenario: Create security policy with ZoneDefaultPolicy entity
14+
- **WHEN** user specifies `zone_id` and `entity = "ZoneDefaultPolicy"` with `security_policy` configuration
15+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#ZoneDefaultPolicy`
16+
17+
#### Scenario: Create security policy with Host entity
18+
- **WHEN** user specifies `zone_id`, `entity = "Host"`, and `host = "www.example.com"` with `security_policy` configuration
19+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#Host#{host}`
20+
21+
#### Scenario: Create security policy with Template entity
22+
- **WHEN** user specifies `zone_id`, `entity = "Template"`, and `template_id = "temp-xxx"` with `security_policy` configuration
23+
- **THEN** the resource SHALL call `ModifySecurityPolicy` with the provided parameters and set the resource ID to `{zone_id}#Template#{template_id}`
24+
25+
### Requirement: Resource supports DescribeSecurityPolicy API for reading state
26+
27+
The resource SHALL use the `DescribeSecurityPolicy` API to read back the current state, passing `zone_id`, `entity`, `host`, and `template_id` as request parameters, and mapping `response.Response.SecurityPolicy` to the `security_policy` attribute.
28+
29+
#### Scenario: Read security policy state
30+
- **WHEN** the resource performs a Read operation
31+
- **THEN** the resource SHALL call `DescribeSecurityPolicy` with `zone_id`, `entity`, `host`, and `template_id` extracted from the resource ID, and populate the `security_policy` attribute from the response
32+
33+
#### Scenario: Resource not found during read
34+
- **WHEN** the `DescribeSecurityPolicy` API returns nil for `SecurityPolicy`
35+
- **THEN** the resource SHALL remove itself from state by calling `d.SetId("")`
36+
37+
### Requirement: Resource supports import via composite ID
38+
39+
The resource SHALL support import using the composite ID format based on entity type.
40+
41+
#### Scenario: Import ZoneDefaultPolicy
42+
- **WHEN** user imports with ID `{zone_id}#ZoneDefaultPolicy`
43+
- **THEN** the resource SHALL parse the ID and read the zone-level security policy
44+
45+
#### Scenario: Import Host policy
46+
- **WHEN** user imports with ID `{zone_id}#Host#{host}`
47+
- **THEN** the resource SHALL parse the ID and read the domain-level security policy
48+
49+
#### Scenario: Import Template policy
50+
- **WHEN** user imports with ID `{zone_id}#Template#{template_id}`
51+
- **THEN** the resource SHALL parse the ID and read the template-level security policy

0 commit comments

Comments
 (0)