使用Pulumi为Google Cloud Armor安全策略关联规则失败

问题场景 #

尝试通过Pulumi为GCP Cloud Armor安全策略关联速率限流规则时，收到以下错误：

Diagnostics:
  gcp:compute:SecurityPolicy (ddos-layer7-defense-policy):
    error: gcp:compute/securityPolicy:SecurityPolicy resource 'ddos-layer7-defense-policy' has a problem: Attribute must be a list. Examine values at 'ddos-layer7-defense-policy.rules'.

已传入包含gcp.compute.SecurityPolicyRuleArgs变量的列表，但仍提示类型不一致。

问题代码 #

速率限流规则定义 #

rate_based_throttling_rule = gcp.compute.SecurityPolicyRuleArgs(
    action="throttle",
    match=gcp.compute.SecurityPolicyRuleMatchArgs(
        config=gcp.compute.SecurityPolicyRuleMatchConfigArgs(
            src_ip_ranges='*'
        )
    ),
    priority=110,
    description='Rate based throttling for security policies. Currently, in preview mode.',
    preview=True,
    rate_limit_options=gcp.compute.SecurityPolicyRuleRateLimitOptionsArgs(
        conform_action="allow",
        exceed_action="deny(429)",
        rate_limit_threshold=gcp.compute.SecurityPolicyRuleRateLimitOptionsRateLimitThresholdArgs(
            count=100,
            interval_sec=60
        )
    )
)

安全策略定义 #

ddos_layer7_defense_policy_name = "ddos-layer7-defense-policy"
layer7_ddos_defense_config_var = gcp.compute.SecurityPolicyAdaptiveProtectionConfigLayer7DdosDefenseConfigArgs(
    enable=True
)
adaptive_protection_args_var = gcp.compute.SecurityPolicyAdaptiveProtectionConfigArgs(
    layer7_ddos_defense_config=layer7_ddos_defense_config_var
)
ddos_layer7_defense_policy = gcp.compute.SecurityPolicy(
    ddos_layer7_defense_policy_name,
    project=gcp_project,
    description="Policy for enabling DDoS defence on L7",
    name="{}-{}".format(ddos_layer7_defense_policy_name, gcp_subdomain),
    adaptive_protection_config=adaptive_protection_args_var,
    rules=[rate_based_throttling_rule]
)

SecurityPolicy的rules参数文档说明：

rules: Input[Sequence[Input[InputType[SecurityPolicyRuleArgs]]]] | None = None,

解决方案 #

错误根源在于SecurityPolicyRuleMatchConfigArgs的src_ip_ranges参数类型错误：该参数要求为字符串列表，但代码中传入了单个字符串'*'，导致整个规则结构不符合预期，进而触发rules列表的校验错误。

修改规则定义中的src_ip_ranges为列表形式：

rate_based_throttling_rule = gcp.compute.SecurityPolicyRuleArgs(
    action="throttle",
    match=gcp.compute.SecurityPolicyRuleMatchArgs(
        config=gcp.compute.SecurityPolicyRuleMatchConfigArgs(
            src_ip_ranges=['*']  # 改为列表类型
        )
    ),
    priority=110,
    description='Rate based throttling for security policies. Currently, in preview mode.',
    preview=True,
    rate_limit_options=gcp.compute.SecurityPolicyRuleRateLimitOptionsArgs(
        conform_action="allow",
        exceed_action="deny(429)",
        rate_limit_threshold=gcp.compute.SecurityPolicyRuleRateLimitOptionsRateLimitThresholdArgs(
            count=100,
            interval_sec=60
        )
    )
)

重新执行Pulumi部署即可解决该类型错误。

内容的提问来源于stack exchange，提问作者Aviral Srivastava