Add datasource for security groups

[bddvlpr]

Currently only handles the groups themselves, no rules yet. Even if this functionality gets added, It'd be better to keep them separate. Same filter function applied as other datasources do. Minimal amount of attributes but this is primarily to fetch IDs from separate states.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sureshanaparti]

Hi @bddvlpr Can you check the failed tests here. Thanks.

[bddvlpr]

Same as #327 (comment).

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[sureshanaparti]

Hi @bddvlpr Can you check & address the copilot comments if relevant. Thanks.

[bddvlpr]

None of these are actually relevant; the naming convention follows the other unit tests. The regex is also ma minor efficiency improvement but I opted into following (and not deviating from) the current shared implementation of all other data sources.

[sudo87]

clgtm

[kiranchavala]

LGTM tested manually

resource "cloudstack_security_group_rule" "web_ssh" {
  security_group_id = cloudstack_security_group.web.id
  rule {
    cidr_list = ["0.0.0.0/0"]
    protocol  = "tcp"
    ports     = ["22"]
  }
}

data "cloudstack_security_group" "web_lookup" {
  filter {
    name  = "name"
    value = "^tf-pr328-web-servers$"
  }

  depends_on = [cloudstack_security_group.web]
}

output "sg_id" {
  value = data.cloudstack_security_group.web_lookup.id
}

output "sg_description" {
  value = data.cloudstack_security_group.web_lookup.description
}

terraform apply 

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated
with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # data.cloudstack_security_group.web_lookup will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "cloudstack_security_group" "web_lookup" {
      + description = (known after apply)
      + id          = (known after apply)
      + name        = (known after apply)
      + project     = (known after apply)

      + filter {
          + name  = "name"
          + value = "^tf-pr328-web-servers$"
        }
    }

  # cloudstack_security_group.web will be created
  + resource "cloudstack_security_group" "web" {
      + description = "Security group data source test"
      + id          = (known after apply)
      + name        = "tf-pr328-web-servers"
      + project     = (known after apply)
    }

  # cloudstack_security_group_rule.web_ssh will be created
  + resource "cloudstack_security_group_rule" "web_ssh" {
      + id                = (known after apply)
      + parallelism       = 2
      + security_group_id = (known after apply)

      + rule {
          + cidr_list                = [
              + "0.0.0.0/0",
            ]
          + icmp_code                = (known after apply)
          + icmp_type                = (known after apply)
          + ports                    = [
              + "22",
            ]
          + protocol                 = "tcp"
          + traffic_type             = "ingress"
          + user_security_group_list = []
          + uuids                    = (known after apply)
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + sg_description = (known after apply)
  + sg_id          = (known after apply)

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

cloudstack_security_group.web: Creating...
cloudstack_security_group.web: Creation complete after 1s [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
data.cloudstack_security_group.web_lookup: Reading...
cloudstack_security_group_rule.web_ssh: Creating...
data.cloudstack_security_group.web_lookup: Read complete after 0s [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
cloudstack_security_group_rule.web_ssh: Creation complete after 1s [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

sg_description = "Security group data source test"
sg_id = "a06dcd15-58ae-4e04-81e1-7f5267ee5997"


terraform destroy
cloudstack_security_group.web: Refreshing state... [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
data.cloudstack_security_group.web_lookup: Reading...
cloudstack_security_group_rule.web_ssh: Refreshing state... [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
data.cloudstack_security_group.web_lookup: Read complete after 0s [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated
with the following symbols:
  - destroy

Terraform will perform the following actions:

  # cloudstack_security_group.web will be destroyed
  - resource "cloudstack_security_group" "web" {
      - description = "Security group data source test" -> null
      - id          = "a06dcd15-58ae-4e04-81e1-7f5267ee5997" -> null
      - name        = "tf-pr328-web-servers" -> null
        # (1 unchanged attribute hidden)
    }

  # cloudstack_security_group_rule.web_ssh will be destroyed
  - resource "cloudstack_security_group_rule" "web_ssh" {
      - id                = "a06dcd15-58ae-4e04-81e1-7f5267ee5997" -> null
      - parallelism       = 2 -> null
      - security_group_id = "a06dcd15-58ae-4e04-81e1-7f5267ee5997" -> null

      - rule {
          - cidr_list                = [
              - "0.0.0.0/0",
            ] -> null
          - icmp_code                = 0 -> null
          - icmp_type                = 0 -> null
          - ports                    = [
              - "22",
            ] -> null
          - protocol                 = "tcp" -> null
          - traffic_type             = "ingress" -> null
          - user_security_group_list = [] -> null
          - uuids                    = {
              - "0.0.0.0/022" = "26e62b15-d7d3-4a14-b1bd-052cd5a8a499"
            } -> null
        }
    }

Plan: 0 to add, 0 to change, 2 to destroy.

Changes to Outputs:
  - sg_description = "Security group data source test" -> null
  - sg_id          = "a06dcd15-58ae-4e04-81e1-7f5267ee5997" -> null

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value: yes

cloudstack_security_group_rule.web_ssh: Destroying... [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
cloudstack_security_group_rule.web_ssh: Destruction complete after 1s
cloudstack_security_group.web: Destroying... [id=a06dcd15-58ae-4e04-81e1-7f5267ee5997]
cloudstack_security_group.web: Destruction complete after 1s

Destroy complete! Resources: 2 destroyed.