Skip to content

Commit cf74308

Browse files
authored
fix: Added Receiver attribute feature to Web and CASB DLP Rules (#468)
* fix: Fixed Firiewall Rule reordering logic, and EUN Heredocs * fix: Added Receiver attribute feature to Web and CASB DLP Rules * fix: Fixed Drift with emtpy receiver attribute in DLP Rules
1 parent f0c93e1 commit cf74308

25 files changed

+1566
-141
lines changed

CHANGELOG.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,28 @@
11
# Changelog
22

3+
## 4.4.9 (August, 26 2025)
4+
5+
### Notes
6+
7+
- Release date: **(August, 26 2025)**
8+
- Supported Terraform version: **v1.x**
9+
10+
### Enhancements
11+
12+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added data source `zia_cloud_to_cloud_ir` - Retrieves the Cloud-to-Cloud Incident Receiver (C2CIR) information configured in the ZIA Admin Portal. This data source can be used to set the corresponding receiver when configuring the resource `zia_dlp_web_rules` or `zia_casb_dlp_rules`
13+
14+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added attribute `receiver` to `zia_dlp_web_rules` and `zia_casb_dlp_rules` resources to allow configuration of Cloud-to-Cloud Incident Receivers.
15+
16+
### Bug Fixes
17+
18+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added `val` attribute to `zia_url_categories` resource to enable consistent referencing of URL categories in DLP web rules and other resources
19+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Fixed performance issue in firewall filtering rules reordering by removing unnecessary predefined rule processing that was causing excessive wait times
20+
21+
### Documentation
22+
23+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Updated documentation for `zia_url_categories` resource to include new `val` attribute
24+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Updated documentation for `zia_forwarding_control_rule` to remove unsupported attributes `devices` and `device_groups`
25+
326
## 4.4.8 (August, 22 2025)
427

528
### Notes

GNUmakefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -196,14 +196,14 @@ test\:integration\:zscalertwo:
196196
build13: GOOS=$(shell go env GOOS)
197197
build13: GOARCH=$(shell go env GOARCH)
198198
ifeq ($(OS),Windows_NT) # is Windows_NT on XP, 2000, 7, Vista, 10...
199-
build13: DESTINATION=$(APPDATA)/terraform.d/plugins/$(ZIA_PROVIDER_NAMESPACE)/4.4.7/$(GOOS)_$(GOARCH)
199+
build13: DESTINATION=$(APPDATA)/terraform.d/plugins/$(ZIA_PROVIDER_NAMESPACE)/4.4.9/$(GOOS)_$(GOARCH)
200200
else
201-
build13: DESTINATION=$(HOME)/.terraform.d/plugins/$(ZIA_PROVIDER_NAMESPACE)/4.4.7/$(GOOS)_$(GOARCH)
201+
build13: DESTINATION=$(HOME)/.terraform.d/plugins/$(ZIA_PROVIDER_NAMESPACE)/4.4.9/$(GOOS)_$(GOARCH)
202202
endif
203203
build13: fmtcheck
204204
@echo "==> Installing plugin to $(DESTINATION)"
205205
@mkdir -p $(DESTINATION)
206-
go build -o $(DESTINATION)/terraform-provider-zia_v4.4.7
206+
go build -o $(DESTINATION)/terraform-provider-zia_v4.4.9
207207

208208
coverage: test
209209
@echo "✓ Opening coverage for unit tests ..."
Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
subcategory: "Data Loss Prevention"
3+
layout: "zscaler"
4+
page_title: "ZIA: dlp_cloud_to_cloud_ir"
5+
description: |-
6+
Official documentation https://help.zscaler.com/zia/dlp-cloud-cloud-incident-forwarding
7+
API documentation https://help.zscaler.com/zia/data-loss-prevention#/cloudToCloudIR-get
8+
Retrieves Cloud-to-Cloud Incident Receiver (C2CIR) information configured in the ZIA Admin Portal
9+
---
10+
11+
# zia_dlp_cloud_to_cloud_ir (Data Source)
12+
13+
* [Official documentation](https://help.zscaler.com/zia/dlp-cloud-cloud-incident-forwarding)
14+
* [API documentation](https://help.zscaler.com/zia/data-loss-prevention#/cloudToCloudIR-get)
15+
16+
Use the **zia_dlp_cloud_to_cloud_ir** data source to get information about Cloud-to-Cloud Incident Receiver (C2CIR) tenants configured in the ZIA Admin Portal. This data source retrieves detailed information about C2CIR configurations including tenant authorization, onboardable entities, and validation status. The retrieved information can be used in Web DLP Rules [zia_dlp_web_rules](https://registry.terraform.io/providers/zscaler/zia/latest/docs/resources/zia_dlp_web_rules) or CASB DLP Rules [zia_casb_dlp_rules](https://registry.terraform.io/providers/zscaler/zia/latest/docs/resources/zia_casb_dlp_rules).
17+
18+
## Example Usage
19+
20+
```hcl
21+
# Retrieve the C2CIR by name
22+
data "zia_dlp_cloud_to_cloud_ir" "this" {
23+
name = "AzureTenant01"
24+
}
25+
26+
# Output the retrieved information
27+
output "zia_dlp_cloud_to_cloud_ir" {
28+
value = data.zia_dlp_cloud_to_cloud_ir.this
29+
}
30+
```
31+
32+
## Argument Reference
33+
34+
The following arguments are supported:
35+
36+
### Required
37+
38+
* `name` - (Required) The name of the Cloud-to-Cloud Incident Receiver tenant to retrieve.
39+
40+
## Attributes Reference
41+
42+
The following attributes are exported:
43+
44+
* `id` - (Number) The unique identifier for the C2CIR tenant.
45+
* `name` - (String) The name of the C2CIR tenant.
46+
* `status` - (List of String) The current status of the C2CIR tenant (e.g., `CASB_TENANT_ACTIVE`).
47+
* `modified_time` - (Number) Timestamp when the C2CIR tenant was last modified.
48+
* `last_tenant_validation_time` - (Number) Timestamp of the last tenant validation.
49+
* `last_validation_msg` - (List) Last validation message information.
50+
* `error_msg` - (String) Error message from validation.
51+
* `error_code` - (Number) Error code from validation.
52+
* `last_modified_by` - (List) Information about who last modified the C2CIR tenant.
53+
* `id` - (Number) Unique identifier for the modifier.
54+
* `name` - (String) Name of the modifier.
55+
* `external_id` - (String) External identifier for the modifier.
56+
* `extensions` - (Map) Additional properties for the modifier.
57+
* `onboardable_entity` - (List) Information about the onboardable entity.
58+
* `id` - (Number) Unique identifier for the onboardable entity.
59+
* `name` - (String) Name of the onboardable entity.
60+
* `type` - (String) Type of the onboardable entity (e.g., `SAAS_TENANT`).
61+
* `enterprise_tenant_id` - (String) Enterprise tenant ID.
62+
* `application` - (String) Application name (e.g., `SLACK`).
63+
* `last_validation_msg` - (List) Last validation message for the onboardable entity.
64+
* `error_msg` - (String) Error message from validation.
65+
* `error_code` - (Number) Error code from validation.
66+
* `tenant_authorization_info` - (List) Tenant authorization information.
67+
* `access_token` - (String) Access token for authorization.
68+
* `bot_token` - (String) Bot token for authorization.
69+
* `redirect_url` - (String) Redirect URL for authorization.
70+
* `type` - (String) Authorization type (e.g., `SLACK_BOT`).
71+
* `env` - (String) Environment (e.g., `SALESFORCE_PRODUCTION`).
72+
* `temp_auth_code` - (String) Temporary authorization code.
73+
* `subdomain` - (String) Subdomain for the tenant.
74+
* `apicp` - (String) API CP configuration.
75+
* `client_id` - (String) Client ID for authorization.
76+
* `client_secret` - (String) Client secret for authorization.
77+
* `secret_token` - (String) Secret token for authorization.
78+
* `user_name` - (String) Username for authorization.
79+
* `user_pwd` - (String) User password for authorization.
80+
* `instance_url` - (String) Instance URL for the tenant.
81+
* `role_arn` - (String) Role ARN for authorization.
82+
* `quarantine_bucket_name` - (String) Quarantine bucket name.
83+
* `cloud_trail_bucket_name` - (String) Cloud trail bucket name.
84+
* `bot_id` - (String) Bot ID for authorization.
85+
* `org_api_key` - (String) Organization API key.
86+
* `external_id` - (String) External identifier.
87+
* `enterprise_id` - (String) Enterprise identifier.
88+
* `cred_json` - (String) Credential JSON.
89+
* `role` - (String) Role for authorization (e.g., `READ`).
90+
* `organization_id` - (String) Organization identifier.
91+
* `workspace_name` - (String) Workspace name.
92+
* `workspace_id` - (String) Workspace identifier.
93+
* `qtn_channel_url` - (String) Quarantine channel URL.
94+
* `features_supported` - (List of String) Supported features (e.g., `CASB`).
95+
* `mal_qtn_lib_name` - (String) Malware quarantine library name.
96+
* `dlp_qtn_lib_name` - (String) DLP quarantine library name.
97+
* `credentials` - (String) Credentials for authorization.
98+
* `token_endpoint` - (String) Token endpoint for authorization.
99+
* `rest_api_endpoint` - (String) REST API endpoint.
100+
* `smir_bucket_config` - (List) SMIR bucket configuration.
101+
* `id` - (Number) Unique identifier for the SMIR bucket.
102+
* `config_name` - (String) Configuration name for the bucket.
103+
* `metadata_bucket_name` - (String) Metadata bucket name URL.
104+
* `data_bucket_name` - (String) Data bucket name URL.
105+
* `qtn_info` - (List) Quarantine information.
106+
* `admin_id` - (String) Administrator identifier.
107+
* `qtn_folder_path` - (String) Quarantine folder path.
108+
* `mod_time` - (Number) Modification time.
109+
* `qtn_info_cleared` - (Boolean) Whether quarantine information is cleared.
110+
* `zscaler_app_tenant_id` - (List) Zscaler app tenant ID information.
111+
* `id` - (Number) Unique identifier for the Zscaler app tenant.
112+
* `name` - (String) Name of the Zscaler app tenant.
113+
* `external_id` - (String) External identifier for the Zscaler app tenant.
114+
* `extensions` - (Map) Additional properties for the Zscaler app tenant

docs/data-sources/zia_dlp_web_rules.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,13 @@ rules.
129129
* `workload_groups` (List) The list of preconfigured workload groups to which the policy must be applied
130130
* `id` - (Number) A unique identifier assigned to the workload group
131131
* `name` - (String) The name of the workload group
132+
133+
* `receiver` - (Optional) The receiver information for the DLP policy rule.
134+
* `id` - (Number) Unique identifier for the receiver
135+
* `name` - (String) Name of the receiver
136+
* `type` - (String) Type of the receiver
137+
* `tenant` - (Optional) Tenant information for the receiver
138+
* `id` - (Number) Unique identifier for the tenant
139+
* `name` - (String) Name of the tenant
140+
* `external_id` - (String) External identifier for the tenant
141+
* `extensions` - (Map) Additional properties for the tenant

docs/guides/release-notes.md

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,33 @@ description: |-
1212
Track all ZIA Terraform provider's releases. New resources, features, and bug fixes will be tracked here.
1313

1414
---
15-
``Last updated: v4.4.8``
15+
``Last updated: v4.4.9``
1616

1717
---
1818

19+
## 4.4.9 (August, 26 2025)
20+
21+
### Notes
22+
23+
- Release date: **(August, 26 2025)**
24+
- Supported Terraform version: **v1.x**
25+
26+
### Enhancements
27+
28+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added data source `zia_cloud_to_cloud_ir` - Retrieves the Cloud-to-Cloud Incident Receiver (C2CIR) information configured in the ZIA Admin Portal. This data source can be used to set the corresponding receiver when configuring the resource `zia_dlp_web_rules` or `zia_casb_dlp_rules`
29+
30+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added attribute `receiver` to `zia_dlp_web_rules` and `zia_casb_dlp_rules` resources to allow configuration of Cloud-to-Cloud Incident Receivers.
31+
32+
### Bug Fixes
33+
34+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Added `val` attribute to `zia_url_categories` resource to enable consistent referencing of URL categories in DLP web rules and other resources
35+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Fixed performance issue in firewall filtering rules reordering by removing unnecessary predefined rule processing that was causing excessive wait times
36+
37+
### Documentation
38+
39+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Updated documentation for `zia_url_categories` resource to include new `val` attribute
40+
- [PR #468](https://github.com/zscaler/terraform-provider-zia/pull/468) - Updated documentation for `zia_forwarding_control_rule` to remove unsupported attributes `devices` and `device_groups`
41+
1942
## 4.4.8 (August, 22 2025)
2043

2144
### Notes

docs/guides/troubleshooting.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,3 +157,13 @@ This error is commonly returned when attempting to create a `zia_dlp_dictionarie
157157
```sh
158158
│ Error: no dictionary found with name: Social Security Numbers (US)
159159
```
160+
161+
### │ Error: deletion of the predefined rule i.e 'Office 365 One Click Rule' is not allowed
162+
163+
This error occurs when attempting to delete a predefined firewall filtering rule. Predefined rules such as "Office 365 One Click Rule", "UCaaS One Click Rule", "Block All IPv6", "Block malicious IPs and domains", and "Default Firewall Filtering Rule" cannot be deleted as they are system-managed rules.
164+
165+
**Solution**: Remove the rule from your Terraform configuration and run `terraform apply` instead of `terraform destroy`. The rule will remain in the ZIA system but will no longer be managed by Terraform.
166+
167+
```sh
168+
│ Error: deletion of the predefined rule 'Office 365 One Click Rule' is not allowed
169+
```

docs/resources/zia_casb_dlp_rules.md

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,92 @@ resource "zia_casb_dlp_rules" "this" {
8080
}
8181
```
8282

83+
## Example Usage - Configure Cloud to Cloud Forwarding
84+
85+
```hcl
86+
data "zia_casb_tenant" "this" {
87+
tenant_name = "Jira_Tenant01"
88+
}
89+
90+
data "zia_dlp_incident_receiver_servers" "this" {
91+
name = "ZS_Incident_Receiver"
92+
}
93+
94+
data "zia_rule_labels" "this" {
95+
name = "RuleLabel01
96+
}
97+
98+
data "zia_dlp_engines" "this" {
99+
name = "PCI"
100+
}
101+
102+
data "zia_admin_users" "this" {
103+
username = auditor01
104+
}
105+
106+
# Retrieve Cloud-to-Cloud Incident Receiver (C2CIR) information
107+
data "zia_dlp_cloud_to_cloud_ir" "this" {
108+
name = "AzureTenant01"
109+
}
110+
111+
# Output the retrieved C2CIR information for reference
112+
output "zia_dlp_cloud_to_cloud_ir" {
113+
value = data.zia_dlp_cloud_to_cloud_ir.this
114+
}
115+
116+
resource "zia_casb_dlp_rules" "this" {
117+
name = "SaaS_ITSM_App_Rule"
118+
description = "SaaS_ITSM_App_Rule"
119+
order = 1
120+
rank = 7
121+
type = "OFLCASB_DLP_ITSM"
122+
action = "OFLCASB_DLP_REPORT_INCIDENT"
123+
severity = "RULE_SEVERITY_HIGH"
124+
without_content_inspection = false
125+
external_auditor_email = "[email protected]"
126+
file_types = [
127+
"FTCATEGORY_APPX",
128+
"FTCATEGORY_SQL",
129+
]
130+
collaboration_scope = [
131+
"ANY",
132+
]
133+
components = [
134+
"COMPONENT_ITSM_OBJECTS",
135+
"COMPONENT_ITSM_ATTACHMENTS",
136+
]
137+
cloud_app_tenants {
138+
id = [data.zia_casb_tenant.this.tenant_id]
139+
}
140+
dlp_engines {
141+
id = [data.zia_dlp_engines.this.id]
142+
}
143+
object_types {
144+
id = [32, 33, 34]
145+
}
146+
labels {
147+
id = [data.zia_rule_labels.this.id]
148+
}
149+
zscaler_incident_receiver {
150+
id = data.zia_dlp_incident_receiver_servers.this.id
151+
}
152+
auditor_notification {
153+
id = data.zia_admin_users.this.id
154+
}
155+
156+
# Configure receiver using values from the C2CIR data source
157+
receiver {
158+
id = tostring(data.zia_dlp_cloud_to_cloud_ir.this.onboardable_entity[0].tenant_authorization_info[0].smir_bucket_config[0].id)
159+
name = data.zia_dlp_cloud_to_cloud_ir.this.onboardable_entity[0].tenant_authorization_info[0].smir_bucket_config[0].config_name
160+
type = data.zia_dlp_cloud_to_cloud_ir.this.onboardable_entity[0].type
161+
tenant {
162+
id = tostring(data.zia_dlp_cloud_to_cloud_ir.this.id)
163+
name = data.zia_dlp_cloud_to_cloud_ir.this.name
164+
}
165+
}
166+
}
167+
```
168+
83169
## Schema
84170

85171
### Required

0 commit comments

Comments
 (0)