|
| 1 | +## Context |
| 2 | + |
| 3 | +The `tencentcloud_teo_security_policy_config` resource manages TEO (TencentCloud EdgeOne) security policy configurations. It uses: |
| 4 | +- `ModifySecurityPolicy` API for create/update operations |
| 5 | +- `DescribeSecurityPolicy` API for read operations |
| 6 | + |
| 7 | +The resource already exists at `tencentcloud/services/teo/resource_tc_teo_security_policy_config.go` with the following top-level schema fields: |
| 8 | +- `zone_id` (Required, ForceNew) - Zone ID |
| 9 | +- `entity` (Optional, ForceNew) - Security policy type (ZoneDefaultPolicy/Template/Host) |
| 10 | +- `host` (Optional, ForceNew) - Domain name for Host entity type |
| 11 | +- `template_id` (Optional, ForceNew) - Template ID for Template entity type |
| 12 | +- `security_policy` (Optional, TypeList, MaxItems: 1) - Security policy configuration using expression grammar |
| 13 | +- `security_config` (Optional, Computed, TypeList, MaxItems: 1) - Classic web protection settings |
| 14 | + |
| 15 | +The `SecurityPolicy` parameter in the `ModifySecurityPolicy` API maps to the `security_policy` schema field and contains sub-structures for: |
| 16 | +- `CustomRules` - Custom rule configuration |
| 17 | +- `ManagedRules` - Managed rules configuration |
| 18 | +- `HttpDDoSProtection` - HTTP DDoS protection configuration |
| 19 | +- `RateLimitingRules` - Rate limiting rules configuration |
| 20 | +- `ExceptionRules` - Exception rules configuration |
| 21 | +- `BotManagement` - Bot management configuration |
| 22 | +- `BotManagementLite` - Basic bot management configuration |
| 23 | +- `DefaultDenySecurityActionParameters` - Default deny action parameters |
| 24 | + |
| 25 | +The `DescribeSecurityPolicy` API returns `response.Response.SecurityPolicy` which is read back into the `security_policy` terraform attribute. |
| 26 | + |
| 27 | +## Goals / Non-Goals |
| 28 | + |
| 29 | +**Goals:** |
| 30 | +- Ensure the `security_policy` parameter is properly supported in the `ModifySecurityPolicy` API call (create/update) |
| 31 | +- Ensure the `DescribeSecurityPolicy` API properly reads back the `SecurityPolicy` response into the `security_policy` attribute |
| 32 | +- Ensure proper input parameters (`ZoneId`, `Entity`, `Host`, `TemplateId`) are passed to `DescribeSecurityPolicy` |
| 33 | +- Maintain backward compatibility with existing terraform configurations |
| 34 | + |
| 35 | +**Non-Goals:** |
| 36 | +- Modifying the `security_config` (classic) parameter handling |
| 37 | +- Adding new sub-fields within the `SecurityPolicy` structure beyond what the vendor SDK supports |
| 38 | +- Changing the resource ID format or import behavior |
| 39 | + |
| 40 | +## Decisions |
| 41 | + |
| 42 | +1. **Parameter mapping**: The `request.SecurityPolicy` field in `ModifySecurityPolicy` maps to the terraform schema field `security_policy`. This is a complex nested structure (TypeList with MaxItems: 1) containing all security policy sub-configurations. |
| 43 | + |
| 44 | +2. **Read operation**: The `DescribeSecurityPolicy` API requires `ZoneId`, `Entity`, `Host`, and `TemplateId` as input parameters (extracted from the resource ID) and returns `SecurityPolicy` in the response which is flattened into the `security_policy` attribute. |
| 45 | + |
| 46 | +3. **Resource lifecycle**: Since there is no `CreateSecurityPolicy` or `DeleteSecurityPolicy` API, the resource uses `ModifySecurityPolicy` for both create and update operations. Delete is a no-op (the security policy always exists for a zone). |
| 47 | + |
| 48 | +4. **Retry handling**: API calls use `tccommon.ReadRetryTimeout` with `resource.RetryContext` for retry logic, wrapping errors with `tccommon.RetryError()`. |
| 49 | + |
| 50 | +## Risks / Trade-offs |
| 51 | + |
| 52 | +- [Risk] The `SecurityPolicy` structure is complex with deeply nested fields → Mitigation: Follow existing patterns in the resource code for flattening/expanding nested structures. |
| 53 | +- [Risk] Backward compatibility with existing state files → Mitigation: Only add Optional fields, never modify existing Required fields or change field types. |
0 commit comments