Feature/waf onboard custom rule group

docs/data-sources/alb_waf_custom_rule_group.md

@@ -0,0 +1,87 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_custom_rule_group Data Source - stackit"
+subcategory: ""
+description: |-
+  ALB WAF Custom Rule Group resource schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+  ~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources for how to opt-in to use beta resources.
+---
+
+# stackit_alb_waf_custom_rule_group (Data Source)
+
+ALB WAF Custom Rule Group resource schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our [guide](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources) for how to opt-in to use beta resources.
+
+## Example Usage
+
+```terraform
+data "stackit_alb_waf_custom_rule_group" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-custom-rule-group"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Custom rule group configuration name.
+- `project_id` (String) STACKIT project ID associated with the ALB WAF Custom Rule Group.
+
+### Optional
+
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
+- `rules` (Attributes List) Enriched rules containing auto-generated IDs and computed severity values. (see [below for nested schema](#nestedatt--rules))
+
+<a id="nestedatt--rules"></a>
+### Nested Schema for `rules`
+
+Read-Only:
+
+- `behavior` (Attributes) (see [below for nested schema](#nestedatt--rules--behavior))
+- `conditions` (Attributes List) (see [below for nested schema](#nestedatt--rules--conditions))
+- `description` (String) A clear description explaining the threat vector or criteria addressed by this rule.
+- `id` (Number) Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
+
+<a id="nestedatt--rules--behavior"></a>
+### Nested Schema for `rules.behavior`
+
+Read-Only:
+
+- `action` (String) The protective stance action. ACTION_DENY forces a 403 status response code.
+- `log` (Boolean) Determines whether an entry should be generated in the security ledger upon a rule hit.
+- `log_msg` (String) Custom notification message string mapped to underlying logdata contexts. Required if log is true.
+- `severity` (String) Severity classification metric used by internal analytics graphs.
+
+
+<a id="nestedatt--rules--conditions"></a>
+### Nested Schema for `rules.conditions`
+
+Read-Only:
+
+- `operator` (Attributes) The comparison logic executed against the transformed variable. (see [below for nested schema](#nestedatt--rules--conditions--operator))
+- `transformations` (List of String) Ordered normalization steps applied before the operator runs.
+- `variable` (Attributes) The part of the HTTP transaction to inspect. (see [below for nested schema](#nestedatt--rules--conditions--variable))
+
+<a id="nestedatt--rules--conditions--operator"></a>
+### Nested Schema for `rules.conditions.operator`
+
+Read-Only:
+
+- `type` (String) The operational evaluation type definition macro.
+- `value` (String) The text or rule regex pattern arguments applied inside the operator execution loop.
+
+
+<a id="nestedatt--rules--conditions--variable"></a>
+### Nested Schema for `rules.conditions.variable`
+
+Read-Only:
+
+- `type` (String) The targeted validation engine variable macro.
+- `value` (String) Optional key element context for map variables (e.g., matching a 'Host' header key).

docs/data-sources/alb_waf_managed_rule_set.md

@@ -39,7 +39,6 @@ data "stackit_alb_waf_managed_rule_set" "example" {
 - `groups` (Attributes Map) Inventory of all available Managed Rule Set groups and their current configuration. (see [below for nested schema](#nestedatt--groups))
 - `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
 - `type` (String) Type of the Managed Rule Set.
-- `usage` (Attributes) Managed Rule Set usage (see [below for nested schema](#nestedatt--usage))
 - `version` (String) Managed Rule Set version.
 
 <a id="nestedatt--groups"></a>
@@ -59,13 +58,3 @@ Read-Only:
 - `description` (String) A description of what this rule does.
 - `mode` (String) The current mode of the rule.
 - `severity` (String) Impact level.
-
-
-
-<a id="nestedatt--usage"></a>
-### Nested Schema for `usage`
-
-Read-Only:
-
-- `count` (Number) Number of WAFs using this Managed Rule Set.
-- `items` (List of String) List of WAFs that use this Managed Rule Set.

docs/resources/alb_waf_custom_rule_group.md

@@ -0,0 +1,133 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "stackit_alb_waf_custom_rule_group Resource - stackit"
+subcategory: ""
+description: |-
+  ALB WAF Custom Rule Group resource schema. Uses the default_region specified in the provider configuration as a fallback in case no region is defined on resource level.
+  ~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources for how to opt-in to use beta resources.
+---
+
+# stackit_alb_waf_custom_rule_group (Resource)
+
+ALB WAF Custom Rule Group resource schema. Uses the `default_region` specified in the provider configuration as a fallback in case no `region` is defined on resource level.
+
+~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our [guide](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources) for how to opt-in to use beta resources.
+
+## Example Usage
+
+```terraform
+resource "stackit_alb_waf_custom_rule_group" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-custom-rule-group"
+  rules = [
+    {
+      description = "My custom rule group"
+      behavior = {
+        action = "ACTION_DENY"
+        log    = true
+        logMsg = "Some custom notification message string"
+      }
+      conditions = [
+        {
+          operator = {
+            type  = "OPERATOR_BEGINS_WITH"
+            value = "allowed objects"
+          }
+          transformations = [
+            "TRANSFORMATION_LOWERCASE"
+          ]
+          variable = {
+            type  = "VARIABLE_REQUEST_HEADERS"
+            value = "Host"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) Custom rule group configuration name.
+- `project_id` (String) STACKIT project ID associated with the ALB WAF Custom Rule Group.
+- `rules` (Attributes List) Enriched rules containing auto-generated IDs and computed severity values. (see [below for nested schema](#nestedatt--rules))
+
+### Optional
+
+- `region` (String) STACKIT region name the resource is located in. If not defined, the provider region is used.
+
+### Read-Only
+
+- `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
+
+<a id="nestedatt--rules"></a>
+### Nested Schema for `rules`
+
+Required:
+
+- `behavior` (Attributes) (see [below for nested schema](#nestedatt--rules--behavior))
+- `conditions` (Attributes List) (see [below for nested schema](#nestedatt--rules--conditions))
+
+Optional:
+
+- `description` (String) A clear description explaining the threat vector or criteria addressed by this rule.
+
+Read-Only:
+
+- `id` (Number) Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
+
+<a id="nestedatt--rules--behavior"></a>
+### Nested Schema for `rules.behavior`
+
+Required:
+
+- `action` (String) The protective stance action. ACTION_DENY forces a 403 status response code.
+
+Optional:
+
+- `log` (Boolean) Determines whether an entry should be generated in the security ledger upon a rule hit.
+- `log_msg` (String) Custom notification message string mapped to underlying logdata contexts. Required if log is true.
+
+Read-Only:
+
+- `severity` (String) Severity classification metric used by internal analytics graphs.
+
+
+<a id="nestedatt--rules--conditions"></a>
+### Nested Schema for `rules.conditions`
+
+Required:
+
+- `operator` (Attributes) The comparison logic executed against the transformed variable. (see [below for nested schema](#nestedatt--rules--conditions--operator))
+- `variable` (Attributes) The part of the HTTP transaction to inspect. (see [below for nested schema](#nestedatt--rules--conditions--variable))
+
+Optional:
+
+- `transformations` (List of String) Ordered normalization steps applied before the operator runs.
+
+<a id="nestedatt--rules--conditions--operator"></a>
+### Nested Schema for `rules.conditions.operator`
+
+Required:
+
+- `type` (String) The operational evaluation type definition macro.
+
+Optional:
+
+- `value` (String) The text or rule regex pattern arguments applied inside the operator execution loop.
+
+
+<a id="nestedatt--rules--conditions--variable"></a>
+### Nested Schema for `rules.conditions.variable`
+
+Required:
+
+- `type` (String) The targeted validation engine variable macro.
+
+Optional:
+
+- `value` (String) Optional key element context for map variables (e.g., matching a 'Host' header key).

docs/resources/alb_waf_managed_rule_set.md

@@ -40,7 +40,6 @@ resource "stackit_alb_waf_managed_rule_set" "example" {
 
 - `groups` (Attributes Map) Inventory of all available Managed Rule Set groups and their current configuration. (see [below for nested schema](#nestedatt--groups))
 - `id` (String) Terraform's internal resource identifier. Structured as "`project_id`,`region`,`name`".
-- `usage` (Attributes) Managed Rule Set usage (see [below for nested schema](#nestedatt--usage))
 - `version` (String) Managed Rule Set version.
 
 <a id="nestedatt--groups"></a>
@@ -60,13 +59,3 @@ Read-Only:
 - `description` (String) A description of what this rule does.
 - `mode` (String) The current mode of the rule.
 - `severity` (String) Impact level.
-
-
-
-<a id="nestedatt--usage"></a>
-### Nested Schema for `usage`
-
-Read-Only:
-
-- `count` (Number) Number of WAFs using this Managed Rule Set.
-- `items` (List of String) List of WAFs that use this Managed Rule Set.

examples/data-sources/stackit_alb_waf_custom_rule_group/data-source.tf

@@ -0,0 +1,4 @@
+data "stackit_alb_waf_custom_rule_group" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-custom-rule-group"
+}

examples/resources/stackit_alb_waf_custom_rule_group/resource.tf

@@ -0,0 +1,29 @@
+resource "stackit_alb_waf_custom_rule_group" "example" {
+  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+  name       = "example-custom-rule-group"
+  rules = [
+    {
+      description = "My custom rule group"
+      behavior = {
+        action = "ACTION_DENY"
+        log    = true
+        logMsg = "Some custom notification message string"
+      }
+      conditions = [
+        {
+          operator = {
+            type  = "OPERATOR_BEGINS_WITH"
+            value = "allowed objects"
+          }
+          transformations = [
+            "TRANSFORMATION_LOWERCASE"
+          ]
+          variable = {
+            type  = "VARIABLE_REQUEST_HEADERS"
+            value = "Host"
+          }
+        }
+      ]
+    }
+  ]
+}

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/hashicorp/terraform-plugin-testing v1.16.0
 	github.com/stackitcloud/stackit-sdk-go/core v0.26.0
 	github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0
-	github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0
+	github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0
 	github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0
 	github.com/stackitcloud/stackit-sdk-go/services/certificates v1.9.0
 	github.com/stackitcloud/stackit-sdk-go/services/dns v0.21.0

go.sum

@@ -672,8 +672,8 @@ github.com/stackitcloud/stackit-sdk-go/core v0.26.0 h1:jQEb9gkehfp6VCP6TcYk7BI10
 github.com/stackitcloud/stackit-sdk-go/core v0.26.0/go.mod h1:WU1hhxnjXw2EV7CYa1nlEvNpMiRY6CvmIOaHuL3pOaA=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0 h1:WoWlHdzISGXPEaJOYt6HP5F9M5nbyCJL6VqRJZIaOQs=
 github.com/stackitcloud/stackit-sdk-go/services/alb v0.16.0/go.mod h1:eK6oRB5Tmpt6KbXQ4UYBGg2LgW5bPtVoncL9E8JSRww=
-github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0 h1:0WsTSSZ0LjNpM3E1d3MgkBXmzMQThVQ7IuXhL2w4EyM=
-github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.10.0/go.mod h1:4M9G1I64kZwlXO32ZoIpt0GAN4SpZ1SYerwCVVIBGoE=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0 h1:ejTZTnGKFUWs9Ch9U30Jd+tpDA/SnHuSF9DpfD6w+To=
+github.com/stackitcloud/stackit-sdk-go/services/albwaf v0.11.0/go.mod h1:4M9G1I64kZwlXO32ZoIpt0GAN4SpZ1SYerwCVVIBGoE=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2 h1:b7WJ/vwxlVmNNX91kI3obqGcuoPAyaCbDL5aCMQ/sNg=
 github.com/stackitcloud/stackit-sdk-go/services/authorization v0.15.2/go.mod h1:T/JF25XGJ3GqER/1L2N//DgY8x5tY7gA3N+/0nvmOWY=
 github.com/stackitcloud/stackit-sdk-go/services/cdn v1.19.0 h1:k+KJ4gp9awhJMY5y55vDqRSr6G/S9+8haTNILGbgH9s=