Add terraform support to Okta ML Policy #675

harshampatel-sysdig · 2025-10-30T00:50:17Z

Key changes:

Added resource and data source for sysdig_secure_okta_ml_policy
Implemented CRUD operations with proper error handling
Added tests and documentation

daniel-almeida

Left some minor comments. I'll let someone else look at the implication of the changes as I don't have any experience with this repo.

daniel-almeida · 2025-10-30T16:26:53Z

.vscode/launch.json

@@ -0,0 +1,15 @@
+{


No need to push this. If you can, please add it to gitignore so this isn't tracked in the future.

You might need to delete it from your local machine and push once to remove it from here

daniel-almeida · 2025-10-30T16:30:23Z

sysdig/tfresource.go

+		// TODO: Iterate over a list of rules instead of hard-coding the index values
+		// TODO: Should we assume that only a single Malware rule can be attached to a policy?


These TODOs are intentionally kept to match the AWS ML implementation pattern. Both AWS ML and Okta ML policies currently support a single rule per policy.

For now yes the behavior is 1 rule per policy for these non-Falco types like malware, drift and ML ones. So we can remove the comment if needed

daniel-almeida · 2025-10-30T16:31:02Z

sysdig/tfresource.go

+		})
+	}
+
+	_ = d.Set("rule", rules)


Is this an error being ignored? We should handle it if so.

daniel-almeida · 2025-10-30T16:33:35Z

sysdig/resource_sysdig_secure_okta_ml_policy.go

+}
+
+func oktaMLPolicyFromResourceData(d *schema.ResourceData) (v2.PolicyRulesComposite, error) {
+	policy := &v2.PolicyRulesComposite{


I see there's similar code for other types, but I think it makes more sense to avoid the pointer in this function and pass &policy to oktaMLPolicyReducer, which is where a pointer is actually needed.

daniel-almeida · 2025-10-30T16:35:07Z

sysdig/resource_sysdig_secure_okta_ml_policy.go

+		return diag.FromErr(err)
+	}
+
+	id, _ := strconv.Atoi(d.Id())


Let's handle the error here.

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

ombellare

Added some minor comments. Let me know if you want me to add it to your other branch that you plan to merge

ombellare · 2025-10-30T20:20:52Z

.vscode/launch.json

@@ -0,0 +1,15 @@
+{


You might need to delete it from your local machine and push once to remove it from here

ombellare · 2025-10-30T21:41:56Z

sysdig/tfresource.go

+		// TODO: Iterate over a list of rules instead of hard-coding the index values
+		// TODO: Should we assume that only a single Malware rule can be attached to a policy?


For now yes the behavior is 1 rule per policy for these non-Falco types like malware, drift and ML ones. So we can remove the comment if needed

ombellare · 2025-10-30T21:44:56Z

website/docs/d/secure_okta_ml_policy.md

+
+* `anomalous_console_login` - Anomaly detection settings for logins.
+    * `enabled` - Whether anomaly detection is enabled.
+    * `threshold` - Confidence level threshold for triggering alerts.


Could you add that only supported values for the threshold are 1, 2 and 3 please? If you would like you can update for the other ML types as well (I think they were missed there too)

ombellare · 2025-10-30T21:45:38Z

website/docs/r/secure_okta_ml_policy.md

+
+* `description` - (Required) Rule description.
+* `anomalous_console_login` - (Required) This attribute allows you to activate anomaly detection for logins and adjust its settings.
+    * `threshold` - (Required) Trigger at or above confidence level.


I think there should be an enabled field here too similar to how you have on your data source.

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

Add terraform support to Okta ML Policy

df22c77

harshampatel-sysdig requested review from airadier, daniel-almeida, ivanlysiuk-sysdig, jbainbridgesysdig, mateobur, ombellare, rosenbloomb-sysdig and tembleking as code owners October 30, 2025 00:50

Merge branch 'master' into feature-oktaml-terraform

7d69eab

harshampatel-sysdig marked this pull request as draft October 30, 2025 00:51

harshampatel-sysdig marked this pull request as ready for review October 30, 2025 01:15

daniel-almeida reviewed Oct 30, 2025

View reviewed changes

harshampatel-sysdig added 3 commits October 30, 2025 10:08

Handle error and git ignore vscode

9fd8297

Merge branch 'feature-oktaml-terraform' of https://github.com/harsham…

9c2b3c8

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

Remove pointer and pass &policy

c509dba

harshampatel-sysdig mentioned this pull request Oct 30, 2025

Add terraform support to Okta ML Policy #676

Open

ombellare reviewed Oct 30, 2025

View reviewed changes

harshampatel-sysdig added 2 commits October 30, 2025 17:06

Updated documentations

62d7809

docs: update threshold descriptions to Default/High/Higher

8443bcd

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

		// TODO: Iterate over a list of rules instead of hard-coding the index values
		// TODO: Should we assume that only a single Malware rule can be attached to a policy?

Add terraform support to Okta ML Policy #675

Are you sure you want to change the base?

Add terraform support to Okta ML Policy #675

Uh oh!

Conversation

harshampatel-sysdig commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daniel-almeida left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ombellare left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

harshampatel-sysdig commented Oct 30, 2025 •

edited

Loading