Add network scopes to firewall policy rules

[LucaPrete]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

Add source and destination network scopes to firewall policy rules.
This applies to hierarchical firewall policy rules, global network firewall policy rules and regional network firewall policy rules.

New or Affected Resource(s)

• google_compute_network_firewall_policy_rule
• google_compute_network_firewall_policy_with_rules
• google_compute_firewall_policy_rule
• google_compute_firewall_policy_with_rules
• google_compute_region_network_firewall_policy_rule
• google_compute_region_network_firewall_policy_with_rules

Potential Terraform Configuration

This is an example of a google_compute_firewall_policy_rule that uses dest_network_scope = "INTERNET".

resource "google_compute_firewall_policy_rule" "policy_rule" {
  firewall_policy = google_compute_firewall_policy.default.name
  description     = "Resource created for Terraform acceptance testing"
  priority        = 9000
  enable_logging  = true
  action          = "allow"
  direction       = "EGRESS"
  disabled        = false

  match {
    layer4_configs {
      ip_protocol = "tcp"
      ports = [8080]
    }
    layer4_configs {
      ip_protocol = "udp"
      ports = [22]
    }
    dest_ip_ranges = ["11.100.0.1/32"]
    dest_network_scope = "INTERNET"
  }
}

Users should be able to configure firewall policy rules with src_network_scope and dest_network_scope. Possible values (ENUM) are: INTERNET , NON_INTERNET, VPC_NETWORKS, INTRA_VPC.

References

• Docs Reference
• API Reference for hierarchical fw policy rules
• API Reference for network fw policy rules

[LucaPrete]

Working on this. You can assign it to me.