Unable to activate adaptive protection on Security Policy

[hjorth]

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewSecurityPolicy(ctx, "my-policy", &compute.SecurityPolicyArgs{
			Name: pulumi.String("my-policy"),
			AdaptiveProtectionConfig: &compute.SecurityPolicyAdaptiveProtectionConfigArgs{
				Layer7DdosDefenseConfig: &compute.SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfigArgs{
					Enable: pulumi.Bool(true),
				},
			},
			Rules: compute.SecurityPolicyRuleArray{
				&compute.SecurityPolicyRuleArgs{
					Action:      pulumi.String("deny(403)"),
					Description: pulumi.String("Deny access to IPs in 9.9.9.0/24"),
					Match: &compute.SecurityPolicyRuleMatchArgs{
						Config: &compute.SecurityPolicyRuleMatchConfigArgs{
							SrcIpRanges: pulumi.StringArray{
								pulumi.String("9.9.9.0/24"),
							},
						},
						VersionedExpr: pulumi.String("SRC_IPS_V1"),
					},
					Priority: pulumi.Int(1000),
				},
				&compute.SecurityPolicyRuleArgs{
					Action:      pulumi.String("allow"),
					Description: pulumi.String("default rule"),
					Match: &compute.SecurityPolicyRuleMatchArgs{
						Config: &compute.SecurityPolicyRuleMatchConfigArgs{
							SrcIpRanges: pulumi.StringArray{
								pulumi.String("*"),
							},
						},
						VersionedExpr: pulumi.String("SRC_IPS_V1"),
					},
					Priority: pulumi.Int(2147483647),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

This code does not work

Fails with:

    error: gcp:compute/securityPolicy:SecurityPolicy resource 'my-policy' has a problem: Invalid or unknown key. Examine values at 'SecurityPolicy.AdaptiveProtectionConfig.Layer7DdosDefenseConfig'.

Similar code in python also fails.

It works in google-native - but Rules cannot be updated in that - so that is useless for my case.

[leezen]

I commented on the google-native side with a potential workaround using replaceOnChanges

[hjorth]

Doesn't really makes pulumi-gcp work :-)

[geekflyer]

running into exact same error message with the typescript SDK/API. Is there any workaround to enable adaptive protection?

[mikhailshilkov]

Tried reproducing today with

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

new gcp.compute.SecurityPolicy("my-policy", {
    adaptiveProtectionConfig: {
        layer7DdosDefenseConfig: {
            enable: true,
        },
    },
    rules: [
        {
            action: "deny(403)",
            description: "Deny access to IPs in 9.9.9.0/24",
            match: {
                config: {
                    srcIpRanges: ["9.9.9.0/24"]
                },
                versionedExpr: "SRC_IPS_V1",
            },
            priority: 1000,
        },
        {
            action: "allow",
            description: "default rule",
            match: {
                config: {
                    srcIpRanges: ["*"],
                },
                versionedExpr: "SRC_IPS_V1",
            },
            priority: 2147483647,
        },
    ],
});

and it worked fine. I think this has been fixed upstream in hashicorp/terraform-provider-google#12554.