feat(secure): Add Malware, Drift, ML and AWS ML policy resources

[alexeyovriakh]

Summary

• This PR adds support for Malware, Drift, ML and AWS ML policies.
• See the screenshots below for the draft TF resource design (the final design might deviate).

Testing steps

1. Run make install in local terraform-provider-sysdig directory
2. Create a new directory for customer-side TF script
3. Create a new file called main.tf in that directory
4. Run terraform init (precede with rm .terraform.lock.hcl if you've changed the code), update the values if needed, and run terraform apply. Enter "yes" to confirm the changes.
5. You should see a successful message

// main.tf
terraform {
  required_providers {
    sysdig = {
      source  = "local/sysdiglabs/sysdig"
      version = "~> 1.0.0"
    }
  }
}

provider "sysdig" {
  sysdig_secure_url          = "https://secure-staging.sysdig.com"
  sysdig_secure_api_token    = "<TOKEN>"
  sysdig_secure_insecure_tls = true
}

resource "sysdig_secure_notification_channel_email" "email" {
  name       = "Test Email Channel 14"
  recipients = ["[email protected]"]
}

data "sysdig_secure_malware_policy" "p" {
  name = "Test Malware Policy 9"
}

resource "sysdig_secure_malware_policy" "test_policy" {
  name        = "Test Malware Policy 14"
  description = "Test Malware Policy Description"
  enabled     = true
  severity    = 4

  rules {
    enabled = true
    description = "Test Malware Rule Description"
    tags        = ["tag1", "tag2"]

    details {
      use_managed_hashes = true

      additional_hashes {
        hash         = "304ef4cdda3463b24bf53f9cdd69ad3ecdab0842e7e70e2f3cfbb9f14e1c4ae6"
        hash_aliases = ["hash_name", "hash_name_2"]
      }

      ignore_hashes {
        hash         = "6ac3c336e4094835293a3fed8a4b5fedde1b5e2626d9838fed50693bba00af0e"
        hash_aliases = ["ignore_hashes", "ignore_hashes_2"]
      }
    }
  }
  
  actions {
    prevent_malware = true
    container = "stop"
    # capture
  }

  notification_channels = [sysdig_secure_notification_channel_email.email.id]
}

output "sysdig_secure_malware_policy_1" {
  value = sysdig_secure_malware_policy.test_policy
}

output "sysdig_secure_malware_policy_x" {
  value = data.sysdig_secure_malware_policy.p
}

Draft design

[ombellare]

Sorry for the late review, still checking some files

[ombellare]

Should the message be more clear here "custom AWS ML policy"? Similarly for other types

[ombellare]

I think it is possible to extract most of this method to make it common for all types by taking the policyType as a parameter. Only the final transformation from resource data to the appropriate policy type seems to be different

[ombellare]

Is this needed as you are already doing the check for DRIFT type on line 333 and performing an unmarshal on line 355?

[ombellare]

Retrieves a Sysdig Secure AWS ML Policy

[ombellare]

For the data source, isn't the rule block exported? Would it be required?

[ombellare]

Can we remove the word managed from here and description please? Also for other types

[ombellare]

Should this be an enum? On the UI I see the dropdown for Default, Higher and Highest

[ombellare]

Or probably keep it as 1, 2, 3 but in the doc mention what they mean internally

[ombellare]

We don't expose severity of rule for ML, it is defined at the policy level

[ombellare]

Should we mention the agent version that these container actions are supported by?