From b33b9cb47d3992246b64ee4aab440f2d0987e644 Mon Sep 17 00:00:00 2001
From: Rupa Lahiri <rupacoach@gmail.com>
Date: Fri, 20 Oct 2023 00:39:46 +0530
Subject: [PATCH] Add anomaly detection (#105)

* Add anomaly detection

Signed-off-by: Rupa Lahiri <rupacoach@gmail.com>

* Add test for update

Signed-off-by: Rupa Lahiri <rupacoach@gmail.com>

* Add audit config in anomaly detector test

Signed-off-by: Rupa Lahiri <rupacoach@gmail.com>

* Format terraform in test

Signed-off-by: Rupa Lahiri <rupacoach@gmail.com>

---------

Signed-off-by: Rupa Lahiri <rupacoach@gmail.com>
---
 docs/resources/anomaly_detection.md           |  82 +++++
 .../opensearch_anomaly_detection/resource.tf  |  53 ++++
 provider/diff_suppress_funcs.go               |  20 ++
 provider/provider.go                          |   1 +
 .../resource_opensearch_anomaly_detection.go  | 224 ++++++++++++++
 ...ource_opensearch_anomaly_detection_test.go | 289 ++++++++++++++++++
 provider/util.go                              |   4 +
 7 files changed, 673 insertions(+)
 create mode 100644 docs/resources/anomaly_detection.md
 create mode 100644 examples/resources/opensearch_anomaly_detection/resource.tf
 create mode 100644 provider/resource_opensearch_anomaly_detection.go
 create mode 100644 provider/resource_opensearch_anomaly_detection_test.go

diff --git a/docs/resources/anomaly_detection.md b/docs/resources/anomaly_detection.md
new file mode 100644
index 0000000..a2abbd9
--- /dev/null
+++ b/docs/resources/anomaly_detection.md
@@ -0,0 +1,82 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "opensearch_anomaly_detection Resource - terraform-provider-opensearch"
+subcategory: ""
+description: |-
+  Provides an OpenSearch anonaly detection. Please refer to the OpenSearch anomaly detection documentation for details.
+---
+
+# opensearch_anomaly_detection (Resource)
+
+Provides an OpenSearch anonaly detection. Please refer to the OpenSearch anomaly detection documentation for details.
+
+## Example Usage
+
+```terraform
+resource "opensearch_anomaly_detection" "foo" {
+  body = <<EOF
+{
+  "name": "foo",
+  "description": "Test detector",
+  "time_field": "@timestamp",
+  "indices": [
+    "security-auditlog*"
+  ],
+  "feature_attributes": [
+    {
+      "feature_name": "test",
+      "feature_enabled": true,
+      "aggregation_query": {
+        "test": {
+          "value_count": {
+            "field": "audit_category.keyword"
+          }
+        }
+      }
+    }
+  ],
+  "filter_query": {
+    "bool": {
+      "filter": [
+        {
+          "range": {
+            "value": {
+              "gt": 1
+            }
+          }
+        }
+      ],
+      "adjust_pure_negative": true,
+      "boost": 1
+    }
+  },
+  "detection_interval": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "window_delay": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "result_index" : "opensearch-ad-plugin-result-test"
+}
+EOF
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `body` (String) The anomaly detection document
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+
+
diff --git a/examples/resources/opensearch_anomaly_detection/resource.tf b/examples/resources/opensearch_anomaly_detection/resource.tf
new file mode 100644
index 0000000..cb1a5c1
--- /dev/null
+++ b/examples/resources/opensearch_anomaly_detection/resource.tf
@@ -0,0 +1,53 @@
+resource "opensearch_anomaly_detection" "foo" {
+  body = <<EOF
+{
+  "name": "foo",
+  "description": "Test detector",
+  "time_field": "@timestamp",
+  "indices": [
+    "security-auditlog*"
+  ],
+  "feature_attributes": [
+    {
+      "feature_name": "test",
+      "feature_enabled": true,
+      "aggregation_query": {
+        "test": {
+          "value_count": {
+            "field": "audit_category.keyword"
+          }
+        }
+      }
+    }
+  ],
+  "filter_query": {
+    "bool": {
+      "filter": [
+        {
+          "range": {
+            "value": {
+              "gt": 1
+            }
+          }
+        }
+      ],
+      "adjust_pure_negative": true,
+      "boost": 1
+    }
+  },
+  "detection_interval": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "window_delay": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "result_index" : "opensearch-ad-plugin-result-test"
+}
+EOF
+}
diff --git a/provider/diff_suppress_funcs.go b/provider/diff_suppress_funcs.go
index e804715..0f8aeb4 100644
--- a/provider/diff_suppress_funcs.go
+++ b/provider/diff_suppress_funcs.go
@@ -142,3 +142,23 @@ func diffSuppressPolicy(k, old, new string, d *schema.ResourceData) bool {
 
 	return reflect.DeepEqual(oo, no)
 }
+
+func diffSuppressAnomalyDetection(k, old, new string, d *schema.ResourceData) bool {
+	var oo, no interface{}
+	if err := json.Unmarshal([]byte(old), &oo); err != nil {
+		return false
+	}
+	if err := json.Unmarshal([]byte(new), &no); err != nil {
+		return false
+	}
+
+	if om, ok := oo.(map[string]interface{}); ok {
+		normalizeAnomalyDetection(om)
+	}
+
+	if nm, ok := no.(map[string]interface{}); ok {
+		normalizeAnomalyDetection(nm)
+	}
+
+	return reflect.DeepEqual(oo, no)
+}
diff --git a/provider/provider.go b/provider/provider.go
index 036b06b..5f6842f 100644
--- a/provider/provider.go
+++ b/provider/provider.go
@@ -236,6 +236,7 @@ func Provider() *schema.Provider {
 			"opensearch_script":                    resourceOpensearchScript(),
 			"opensearch_snapshot_repository":       resourceOpensearchSnapshotRepository(),
 			"opensearch_channel_configuration":     resourceOpenSearchChannelConfiguration(),
+			"opensearch_anomaly_detection":         resourceOpenSearchAnomalyDetection(),
 		},
 
 		DataSourcesMap: map[string]*schema.Resource{
diff --git a/provider/resource_opensearch_anomaly_detection.go b/provider/resource_opensearch_anomaly_detection.go
new file mode 100644
index 0000000..0888ca7
--- /dev/null
+++ b/provider/resource_opensearch_anomaly_detection.go
@@ -0,0 +1,224 @@
+package provider
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/structure"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+	"github.com/olivere/elastic/uritemplates"
+	elastic7 "github.com/olivere/elastic/v7"
+)
+
+var anomalyDetectionSchema = map[string]*schema.Schema{
+	"body": {
+		Description:      "The anomaly detection document",
+		Type:             schema.TypeString,
+		Required:         true,
+		DiffSuppressFunc: diffSuppressAnomalyDetection,
+		StateFunc: func(v interface{}) string {
+			json, _ := structure.NormalizeJsonString(v)
+			return json
+		},
+		ValidateFunc: validation.StringIsJSON,
+	},
+}
+
+func resourceOpenSearchAnomalyDetection() *schema.Resource {
+	return &schema.Resource{
+		Description: "Provides an OpenSearch anonaly detection. Please refer to the OpenSearch anomaly detection documentation for details.",
+		Create:      resourceOpensearchAnomalyDetectionCreate,
+		Read:        resourceOpensearchAnomalyDetectionRead,
+		Update:      resourceOpensearchAnomalyDetectionUpdate,
+		Delete:      resourceOpensearchAnomalyDetectionDelete,
+		Schema:      anomalyDetectionSchema,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+	}
+}
+
+func resourceOpensearchAnomalyDetectionCreate(d *schema.ResourceData, m interface{}) error {
+	res, err := resourceOpensearchPostAnomalyDetection(d, m)
+
+	if err != nil {
+		log.Printf("[INFO] Failed to put anomaly detector: %+v", err)
+		return err
+	}
+
+	d.SetId(res.ID)
+	log.Printf("[INFO] Object ID: %s", d.Id())
+
+	return resourceOpensearchAnomalyDetectionRead(d, m)
+}
+
+func resourceOpensearchAnomalyDetectionRead(d *schema.ResourceData, m interface{}) error {
+	res, err := resourceOpensearchAnomalyDetectionGet(d.Id(), m)
+
+	if elastic7.IsNotFound(err) {
+		log.Printf("[WARN] Anomaly Detector (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
+		return err
+	}
+
+	d.SetId(res.ID)
+
+	anomalyDetectionJSON, err := json.Marshal(res.AnomalyDetector)
+	if err != nil {
+		return err
+	}
+	anomalyDetectionJsonNormalized, err := structure.NormalizeJsonString(string(anomalyDetectionJSON))
+	if err != nil {
+		return err
+	}
+	err = d.Set("body", anomalyDetectionJsonNormalized)
+	return err
+}
+
+func resourceOpensearchAnomalyDetectionUpdate(d *schema.ResourceData, m interface{}) error {
+	_, err := resourceOpensearchPutAnomalyDetection(d, m)
+
+	if err != nil {
+		return err
+	}
+
+	return resourceOpensearchAnomalyDetectionRead(d, m)
+}
+
+func resourceOpensearchAnomalyDetectionGet(anomalyDetectionID string, m interface{}) (*anomalyDetectionResponse, error) {
+	var err error
+	response := new(anomalyDetectionResponse)
+
+	path, err := uritemplates.Expand("/_plugins/_anomaly_detection/detectors/{id}", map[string]string{
+		"id": anomalyDetectionID,
+	})
+	if err != nil {
+		return response, fmt.Errorf("error building URL path for anomaly detector: %+v", err)
+	}
+
+	var body json.RawMessage
+	osClient, err := getClient(m.(*ProviderConf))
+	if err != nil {
+		return nil, err
+	}
+	var res *elastic7.Response
+	res, err = osClient.PerformRequest(context.TODO(), elastic7.PerformRequestOptions{
+		Method: "GET",
+		Path:   path,
+	})
+	if err != nil {
+		return response, err
+	}
+	body = res.Body
+
+	if err := json.Unmarshal(body, response); err != nil {
+		return response, fmt.Errorf("error unmarshalling anomaly detector body: %+v: %+v", err, body)
+	}
+	log.Printf("[INFO] Response: %+v", response)
+	normalizeAnomalyDetection(response.AnomalyDetector)
+	log.Printf("[INFO] Response: %+v", response)
+	log.Printf("The version %v", response.Version)
+	return response, err
+}
+
+func resourceOpensearchPostAnomalyDetection(d *schema.ResourceData, m interface{}) (*anomalyDetectionResponse, error) {
+	anomalyDetectionJSON := d.Get("body").(string)
+
+	var err error
+	response := new(anomalyDetectionResponse)
+
+	path := "/_plugins/_anomaly_detection/detectors/"
+
+	var body json.RawMessage
+	osClient, err := getClient(m.(*ProviderConf))
+	if err != nil {
+		return nil, err
+	}
+	var res *elastic7.Response
+	res, err = osClient.PerformRequest(context.TODO(), elastic7.PerformRequestOptions{
+		Method: "POST",
+		Path:   path,
+		Body:   anomalyDetectionJSON,
+	})
+	if err != nil {
+		return response, err
+	}
+	body = res.Body
+
+	if err := json.Unmarshal(body, response); err != nil {
+		return response, fmt.Errorf("error unmarshalling anomaly detector body: %+v: %+v", err, body)
+	}
+	normalizeAnomalyDetection(response.AnomalyDetector)
+	return response, nil
+}
+
+func resourceOpensearchPutAnomalyDetection(d *schema.ResourceData, m interface{}) (*anomalyDetectionResponse, error) {
+	anomalyDetectionJSON := d.Get("body").(string)
+
+	var err error
+	response := new(anomalyDetectionResponse)
+
+	path, err := uritemplates.Expand("/_plugins/_anomaly_detection/detectors/{id}", map[string]string{
+		"id": d.Id(),
+	})
+	if err != nil {
+		return response, fmt.Errorf("error building URL path for anomaly detector: %+v", err)
+	}
+
+	var body json.RawMessage
+	osClient, err := getClient(m.(*ProviderConf))
+	if err != nil {
+		return nil, err
+	}
+	var res *elastic7.Response
+	res, err = osClient.PerformRequest(context.TODO(), elastic7.PerformRequestOptions{
+		Method: "PUT",
+		Path:   path,
+		Body:   anomalyDetectionJSON,
+	})
+	if err != nil {
+		return response, err
+	}
+	body = res.Body
+
+	if err := json.Unmarshal(body, response); err != nil {
+		return response, fmt.Errorf("error unmarshalling anomaly detector body: %+v: %+v", err, body)
+	}
+
+	return response, nil
+}
+
+func resourceOpensearchAnomalyDetectionDelete(d *schema.ResourceData, m interface{}) error {
+	var err error
+
+	path, err := uritemplates.Expand("/_plugins/_anomaly_detection/detectors/{id}", map[string]string{
+		"id": d.Id(),
+	})
+	if err != nil {
+		return fmt.Errorf("error building URL path for anomaly detector: %+v", err)
+	}
+
+	osClient, err := getClient(m.(*ProviderConf))
+	if err != nil {
+		return err
+	}
+	_, err = osClient.PerformRequest(context.TODO(), elastic7.PerformRequestOptions{
+		Method: "DELETE",
+		Path:   path,
+	})
+
+	return err
+}
+
+type anomalyDetectionResponse struct {
+	Version         int                    `json:"_version"`
+	ID              string                 `json:"_id"`
+	AnomalyDetector map[string]interface{} `json:"anomaly_detector"`
+}
diff --git a/provider/resource_opensearch_anomaly_detection_test.go b/provider/resource_opensearch_anomaly_detection_test.go
new file mode 100644
index 0000000..28f55e8
--- /dev/null
+++ b/provider/resource_opensearch_anomaly_detection_test.go
@@ -0,0 +1,289 @@
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+func TestAccOpensearchAnomalyDetection(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck: func() {
+			testAccPreCheck(t)
+		},
+		Providers:    testAccOpendistroProviders,
+		CheckDestroy: testCheckOpensearchAnomalyDetectionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccOpensearchAnomalyDetection,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckOpensearchAnomalyDetectionExists("opensearch_anomaly_detection.test-detector12"),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+			{
+				Config: testAccOpensearchAnomalyDetectionUpdate,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckOpensearchAnomalyDetectionExists("opensearch_anomaly_detection.test-detector12"),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+func testCheckOpensearchAnomalyDetectionExists(name string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[name]
+		if !ok {
+			return fmt.Errorf("Not found: %s", name)
+		}
+		if rs.Primary.ID == "" {
+			return fmt.Errorf("No monitor ID is set")
+		}
+
+		meta := testAccOpendistroProvider.Meta()
+
+		var err error
+		_, err = resourceOpensearchAnomalyDetectionGet(rs.Primary.ID, meta.(*ProviderConf))
+
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+}
+
+func testCheckOpensearchAnomalyDetectionDestroy(s *terraform.State) error {
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "opensearch_anomaly_detection" {
+			continue
+		}
+
+		meta := testAccOpendistroProvider.Meta()
+
+		var err error
+		_, err = resourceOpensearchAnomalyDetectionGet(rs.Primary.ID, meta.(*ProviderConf))
+
+		if err != nil {
+			return nil // should be not found error
+		}
+
+		return fmt.Errorf("Monitor %q still exists", rs.Primary.ID)
+	}
+
+	return nil
+}
+
+var testAccOpensearchAnomalyDetection = `
+resource "opensearch_audit_config" "test" {
+  enabled = true
+
+  audit {
+    enable_rest              = true
+    disabled_rest_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]
+
+    enable_transport              = true
+    disabled_transport_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]
+
+    resolve_bulk_requests = true
+    log_request_body      = true
+    resolve_indices       = true
+
+    # Note: if set false, AWS OpenSearch will return HTTP 409 (Conflict)
+    exclude_sensitive_headers = true
+
+    ignore_users    = ["dashboardserver"]
+    ignore_requests = ["SearchRequest", "indices:data/read/*", "/_cluster/health"]
+  }
+
+  compliance {
+    enabled = true
+
+    # Note: if both internal/external are set true, AWS OpenSearch will return HTTP 409 (Conflict)
+    internal_config = true
+    external_config = false
+
+    read_metadata_only = true
+    read_ignore_users  = ["read-ignore-1"]
+
+    read_watched_field {
+      index  = "read-index-1"
+      fields = ["field-1", "field-2"]
+    }
+
+    read_watched_field {
+      index  = "read-index-2"
+      fields = ["field-3"]
+    }
+
+    write_metadata_only   = true
+    write_log_diffs       = false
+    write_watched_indices = ["write-index-1", "write-index-2", "log-*", "*"]
+    write_ignore_users    = ["write-ignore-1"]
+  }
+}
+
+resource "opensearch_anomaly_detection" "test-detector12" {
+  depends_on = [opensearch_audit_config.test]
+  body       = <<EOF
+{
+  "name": "test-detector12",
+  "description": "Test detector",
+  "time_field": "@timestamp",
+  "indices": [
+    "security-auditlog*"
+  ],
+  "feature_attributes": [
+    {
+      "feature_name": "test",
+      "feature_enabled": true,
+      "aggregation_query": {
+        "test": {
+          "value_count": {
+            "field": "audit_category.keyword"
+          }
+        }
+      }
+    }
+  ],
+  "filter_query": {
+    "bool": {
+      "filter": [
+        {
+          "range": {
+            "value": {
+              "gt": 1
+            }
+          }
+        }
+      ],
+      "adjust_pure_negative": true,
+      "boost": 1
+    }
+  },
+  "detection_interval": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "window_delay": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "result_index" : "opensearch-ad-plugin-result-test"
+}
+EOF
+}
+`
+
+var testAccOpensearchAnomalyDetectionUpdate = `
+resource "opensearch_audit_config" "test" {
+  enabled = true
+
+  audit {
+    enable_rest              = true
+    disabled_rest_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]
+
+    enable_transport              = true
+    disabled_transport_categories = ["GRANTED_PRIVILEGES", "AUTHENTICATED"]
+
+    resolve_bulk_requests = true
+    log_request_body      = true
+    resolve_indices       = true
+
+    # Note: if set false, AWS OpenSearch will return HTTP 409 (Conflict)
+    exclude_sensitive_headers = true
+
+    ignore_users    = ["dashboardserver"]
+    ignore_requests = ["SearchRequest", "indices:data/read/*", "/_cluster/health"]
+  }
+
+  compliance {
+    enabled = true
+
+    # Note: if both internal/external are set true, AWS OpenSearch will return HTTP 409 (Conflict)
+    internal_config = true
+    external_config = false
+
+    read_metadata_only = true
+    read_ignore_users  = ["read-ignore-1"]
+
+    read_watched_field {
+      index  = "read-index-1"
+      fields = ["field-1", "field-2"]
+    }
+
+    read_watched_field {
+      index  = "read-index-2"
+      fields = ["field-3"]
+    }
+
+    write_metadata_only   = true
+    write_log_diffs       = false
+    write_watched_indices = ["write-index-1", "write-index-2", "log-*", "*"]
+    write_ignore_users    = ["write-ignore-1"]
+  }
+}
+
+resource "opensearch_anomaly_detection" "test-detector12" {
+  depends_on = [opensearch_audit_config.test]
+  body       = <<EOF
+{
+  "name": "test-detector12",
+  "description": "Test detector 12",
+  "time_field": "@timestamp",
+  "indices": [
+    "security-auditlog*"
+  ],
+  "feature_attributes": [
+    {
+      "feature_name": "test",
+      "feature_enabled": true,
+      "aggregation_query": {
+        "test": {
+          "value_count": {
+            "field": "audit_category.keyword"
+          }
+        }
+      }
+    }
+  ],
+  "filter_query": {
+    "bool": {
+      "filter": [
+        {
+          "range": {
+            "value": {
+              "gt": 1
+            }
+          }
+        }
+      ],
+      "adjust_pure_negative": true,
+      "boost": 1
+    }
+  },
+  "detection_interval": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "window_delay": {
+    "period": {
+      "interval": 1,
+      "unit": "Minutes"
+    }
+  },
+  "result_index" : "opensearch-ad-plugin-result-test"
+}
+EOF
+}
+`
diff --git a/provider/util.go b/provider/util.go
index 38b975a..c3db0a7 100644
--- a/provider/util.go
+++ b/provider/util.go
@@ -166,6 +166,10 @@ func normalizedIndexSettings(settings map[string]interface{}) map[string]interfa
 	return f
 }
 
+func normalizeAnomalyDetection(tpl map[string]interface{}) {
+	delete(tpl, "last_update_time")
+}
+
 func flattenMap(m map[string]interface{}) map[string]interface{} {
 	f := make(map[string]interface{})
 	for k, v := range m {