azurerm_nginx_deployment - support NGINX App Protect WAF

internal/services/nginx/nginx_deployment_data_source.go

@@ -36,6 +36,7 @@ type DeploymentDataSourceModel struct {
 	FrontendPrivate        []FrontendPrivate                          `tfschema:"frontend_private"`
 	NetworkInterface       []NetworkInterface                         `tfschema:"network_interface"`
 	UpgradeChannel         string                                     `tfschema:"automatic_upgrade_channel"`
+	NginxAppProtect        []NginxAppProtect                          `tfschema:"nginx_app_protect"`
 	Tags                   map[string]string                          `tfschema:"tags"`
 }
 
@@ -194,6 +195,27 @@ func (m DeploymentDataSource) Attributes() map[string]*pluginsdk.Schema {
 			Computed: true,
 		},
 
+		"nginx_app_protect": {
+			Type:     pluginsdk.TypeList,
+			Computed: true,
+			Elem: &pluginsdk.Resource{
+				Schema: map[string]*pluginsdk.Schema{
+					"web_application_firewall_settings": {
+						Type:     pluginsdk.TypeList,
+						Computed: true,
+						Elem: &pluginsdk.Resource{
+							Schema: map[string]*pluginsdk.Schema{
+								"activation_state": {
+									Type:     pluginsdk.TypeString,
+									Computed: true,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+
 		"tags": commonschema.TagsDataSource(),
 	}
 }

internal/services/nginx/nginx_deployment_data_source_test.go

@@ -69,3 +69,27 @@ func TestAccNginxDeploymentDataSource_autoscaling(t *testing.T) {
 		},
 	})
 }
+
+func (d NginxDeploymentDataSource) basicNginxAppProtect(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%s
+data "azurerm_nginx_deployment" "test" {
+  name                = azurerm_nginx_deployment.test.name
+  resource_group_name = azurerm_nginx_deployment.test.resource_group_name
+}
+`, DeploymentResource{}.basicNginxAppProtect(data))
+}
+
+func TestAccNginxDeploymentDataSource_nginxappprotect(t *testing.T) {
+	data := acceptance.BuildTestData(t, "data.azurerm_nginx_deployment", "test")
+	r := NginxDeploymentDataSource{}
+
+	data.DataSourceTest(t, []acceptance.TestStep{
+		{
+			Config: r.basicNginxAppProtect(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).Key("nginx_app_protect.0.web_application_firewall_settings.0.activation_state").HasValue("Enabled"),
+			),
+		},
+	})
+}

internal/services/nginx/nginx_deployment_resource.go

@@ -62,6 +62,14 @@ type AutoScaleProfile struct {
 	Max  int64  `tfschema:"max_capacity"`
 }
 
+type WebApplicationFirewallSettings struct {
+	ActivationState string `tfschema:"activation_state"`
+}
+
+type NginxAppProtect struct {
+	WebApplicationFirewallSettings []WebApplicationFirewallSettings `tfschema:"web_application_firewall_settings"`
+}
+
 type DeploymentModel struct {
 	ResourceGroupName      string                                     `tfschema:"resource_group_name"`
 	Name                   string                                     `tfschema:"name"`
@@ -80,6 +88,7 @@ type DeploymentModel struct {
 	FrontendPrivate        []FrontendPrivate                          `tfschema:"frontend_private"`
 	NetworkInterface       []NetworkInterface                         `tfschema:"network_interface"`
 	UpgradeChannel         string                                     `tfschema:"automatic_upgrade_channel"`
+	NginxAppProtect        []NginxAppProtect                          `tfschema:"nginx_app_protect"`
 	// Deprecated: remove in next major version
 	Configuration []Configuration   `tfschema:"configuration,removedInNextMajorVersion"`
 	Tags          map[string]string `tfschema:"tags"`
@@ -262,6 +271,32 @@ func (m DeploymentResource) Arguments() map[string]*pluginsdk.Schema {
 				}, false),
 		},
 
+		"nginx_app_protect": {
+			Type:     pluginsdk.TypeList,
+			Optional: true,
+			Elem: &pluginsdk.Resource{
+				Schema: map[string]*pluginsdk.Schema{
+					"web_application_firewall_settings": {
+						Type:     pluginsdk.TypeList,
+						Required: true,
+						Elem: &pluginsdk.Resource{
+							Schema: map[string]*pluginsdk.Schema{
+								"activation_state": {
+									Type:     pluginsdk.TypeString,
+									Optional: true,
+									ValidateFunc: validation.StringInSlice(
+										[]string{
+											"Enabled",
+											"Disabled",
+										}, false),
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+
 		"tags": commonschema.Tags(),
 	}
 
@@ -496,6 +531,17 @@ func (m DeploymentResource) Create() sdk.ResourceFunc {
 				}
 			}
 
+			if len(model.NginxAppProtect) > 0 && len(model.NginxAppProtect[0].WebApplicationFirewallSettings) > 0 {
+				activationState := nginxdeployment.ActivationState(model.NginxAppProtect[0].WebApplicationFirewallSettings[0].ActivationState)
+				if activationState != "" {
+					prop.NginxAppProtect = &nginxdeployment.NginxDeploymentPropertiesNginxAppProtect{
+						WebApplicationFirewallSettings: nginxdeployment.WebApplicationFirewallSettings{
+							ActivationState: &activationState,
+						},
+					}
+				}
+			}
+
 			req.Properties = prop
 
 			req.Identity, err = identity.ExpandSystemAndUserAssignedMapFromModel(model.Identity)
@@ -627,6 +673,18 @@ func (m DeploymentResource) Read() sdk.ResourceFunc {
 						output.UpgradeChannel = props.AutoUpgradeProfile.UpgradeChannel
 					}
 
+					if props.NginxAppProtect != nil && props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState != nil {
+						output.NginxAppProtect = []NginxAppProtect{
+							{
+								WebApplicationFirewallSettings: []WebApplicationFirewallSettings{
+									{
+										string(*props.NginxAppProtect.WebApplicationFirewallSettings.ActivationState),
+									},
+								},
+							},
+						}
+					}
+
 					flattenedIdentity, err := identity.FlattenSystemAndUserAssignedMapToModel(model.Identity)
 					if err != nil {
 						return fmt.Errorf("flattening `identity`: %v", err)
@@ -766,6 +824,15 @@ func (m DeploymentResource) Update() sdk.ResourceFunc {
 				return fmt.Errorf("basic SKUs are incompatible with `capacity` or `auto_scale_profiles`")
 			}
 
+			if meta.ResourceData.HasChange("nginx_app_protect") {
+				activationState := nginxdeployment.ActivationState(model.NginxAppProtect[0].WebApplicationFirewallSettings[0].ActivationState)
+				req.Properties.NginxAppProtect = &nginxdeployment.NginxDeploymentUpdatePropertiesNginxAppProtect{
+					WebApplicationFirewallSettings: &nginxdeployment.WebApplicationFirewallSettings{
+						ActivationState: &activationState,
+					},
+				}
+			}
+
 			if err := client.DeploymentsUpdateThenPoll(ctx, *id, req); err != nil {
 				return fmt.Errorf("updating %s: %v", id, err)
 			}

internal/services/nginx/nginx_deployment_resource_test.go

@@ -316,6 +316,40 @@ resource "azurerm_nginx_deployment" "test" {
 `, a.template(data), data.RandomInteger)
 }
 
+func (a DeploymentResource) basicNginxAppProtect(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+%s
+resource "azurerm_nginx_deployment" "test" {
+  name                      = "acctest-%[2]d"
+  resource_group_name       = azurerm_resource_group.test.name
+  sku                       = "standard_Monthly"
+  location                  = azurerm_resource_group.test.location
+  diagnose_support_enabled  = false
+  automatic_upgrade_channel = "stable"
+  frontend_public {
+    ip_address = [azurerm_public_ip.test.id]
+  }
+  network_interface {
+    subnet_id = azurerm_subnet.test.id
+  }
+  nginx_app_protect {
+    web_application_firewall_settings {
+      activation_state = "Enabled"
+    }
+  }
+  email = "test@test.com"
+  tags = {
+    foo = "bar"
+  }
+  lifecycle {
+    ignore_changes = [
+      capacity,
+    ]
+  }
+}
+`, a.template(data), data.RandomInteger, data.Locations.Primary)
+}
+
 func (a DeploymentResource) template(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {

website/docs/d/nginx_deployment.html.markdown

@@ -67,6 +67,8 @@ In addition to the Arguments listed above - the following Attributes are exporte
 
 * `automatic_upgrade_channel` - The automatic upgrade channel for this NGINX deployment.
 
+* `nginx_app_protect` - A `nginx_app_protect` block as defined below.
+
 * `tags` - A mapping of tags assigned to the NGINX Deployment.
 
 ---
@@ -117,6 +119,15 @@ An `auto_scale_profile` block exports the following:
 
 * `max_capacity` - The maximum number of NGINX capacity units for this NGINX Deployment.
 
+---
+
+A `nginx_app_protect` block exports the following:
+
+* `web_application_firewall_settings` - A `web_application_firewall_settings` block as defined below.
+
+A `web_application_firewall_settings` block exports the following:
+* `activation_state` - Whether WAF is enabled/disabled for this NGINX Deployment.
+
 ## Timeouts
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions:

website/docs/r/nginx_deployment.html.markdown

@@ -170,6 +170,13 @@ An `auto_scale_profile` block supports the following:
 
 -> **NOTE:** If you're using autoscaling with deployments created before v4.0, you may need to use [Terraform's `ignore_changes` functionality](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes) to ignore changes to the `capacity` field.
 
+A `nginx_app_protect` block exports the following:
+
+* `web_application_firewall_settings` - (Required) A `web_application_firewall_settings` block as defined below.
+
+A `web_application_firewall_settings` block exports the following:
+* `activation_state` - (Optional) Whether WAF is enabled/disabled for this NGINX Deployment.
+
 ## Attributes Reference
 
 In addition to the Arguments listed above - the following Attributes are exported: