Add terraform support to Okta ML Policy #676

harshampatel-sysdig · 2025-10-30T23:42:10Z

Key changes:

Added resource and data source for sysdig_secure_okta_ml_policy
Implemented CRUD operations with proper error handling
Added tests and documentation

Similar open PR: #675 (I'll close this once new one merged)

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

ombellare

LGTM!

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

tembleking

Hello @harshampatel-sysdig, thank you for this implementation, it's really nice.
I left you some comments to address before merging it, with some small improvements we can benefit from.

tembleking · 2025-11-05T09:55:39Z

sysdig/tfresource.go

+			"enabled":   rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Enabled,
+			"threshold": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Threshold,


What happens if at some point rule.Details is not a *v2.OktaMLRuleDetails or AnomalousConsoleLogin is nil? We should check this for robustness.

For example

if d, ok := rule.Details.(*v2.OktaMLRuleDetails); ok && d.AnomalousConsoleLogin != nil { enabled := d.AnomalousConsoleLogin.Enabled threshold := int(d.AnomalousConsoleLogin.Threshold) // ... }

tembleking · 2025-11-05T10:06:19Z

sysdig/tfresource.go

+			"enabled":   rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Enabled,
+			"threshold": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Threshold,


Here we are passing from Threshold (float64) to int, because in MLRuleThresholdAndSeveritySchema we are defining it as TypeInt.

"threshold": { Type: schema.TypeInt, Required: true, },

Either we define the Threshold as int in the model, or we transform it:

Suggested change

"enabled": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Enabled,

"threshold": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Threshold,

"enabled": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Enabled,

"threshold": int(rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Threshold),

I prefer the first solution, to define the Threshold as int because in the documentation you also specify:

`threshold` - Confidence level threshold for triggering alerts. Valid values are: 1 (Default), 2 (High), 3 (Higher).

tembleking · 2025-11-05T10:08:06Z

website/docs/r/secure_okta_ml_policy.md

+
+# Resource: sysdig_secure_okta_ml_policy
+
+Retrieves the information of an existing Sysdig Secure Okta ML Policy.


Resources not only retrieve info, they also manage.

Suggested change

Retrieves the information of an existing Sysdig Secure Okta ML Policy.

Manages a Sysdig Secure Okta ML Policy.

tembleking · 2025-11-05T10:08:54Z

website/docs/r/secure_okta_ml_policy.md

+```terraform
+resource "sysdig_secure_okta_ml_policy" "policy" {
+  name        = "Test Okta ML Policy 1"
+  description = "Test Okta ML Policy Description"
+  enabled     = true
+  severity    = 4
+
+  rule {
+    description = "Test Okta ML Rule Description"
+
+    anomalous_console_login {
+      enabled   = true
+      threshold = 1
+    }
+}
+```


You are missing a } in the example:

Suggested change

```terraform

resource "sysdig_secure_okta_ml_policy" "policy" {

name = "Test Okta ML Policy 1"

description = "Test Okta ML Policy Description"

enabled = true

severity = 4

rule {

description = "Test Okta ML Rule Description"

anomalous_console_login {

enabled = true

threshold = 1

}

}

```

```terraform

resource "sysdig_secure_okta_ml_policy" "policy" {

name = "Test Okta ML Policy 1"

description = "Test Okta ML Policy Description"

enabled = true

severity = 4

rule {

description = "Test Okta ML Rule Description"

anomalous_console_login {

enabled = true

threshold = 1

}

}

}

tembleking · 2025-11-05T10:10:08Z

website/docs/r/secure_okta_ml_policy.md

+* `description` - (Required) Rule description.
+* `anomalous_console_login` - (Required) This attribute allows you to activate anomaly detection for logins and adjust its settings.
+    * `enabled` - (Optional) Whether anomaly detection is enabled. Defaults to `true`.
+    * `threshold` - (Required) Trigger at or above confidence level. Valid values are: 1 (Default), 2 (High), 3 (Higher).


Since threshold can only be 3 values, we should validate it in the Terraform schema with something like:

validation.IntInSlice([]int{1,2,3})

tembleking · 2025-11-05T10:17:45Z

sysdig/tfresource.go

+	if _, ok := d.GetOk("rule"); ok {
+
+		anomalousLogin := &v2.MLRuleThresholdAndSeverity{}
+		if _, ok := d.GetOk("rule.0.anomalous_console_login"); ok { // TODO: Do not hardcode the indexes


Only one rule can be created for this policy type? If so, then rule.0.* is fine here 👍 We can change it if we start supporting multiple rules.
Nevertheless, please add a MaxItems: 1 to the block:

"rule": { Type: schema.TypeList, Required: true, Elem: &schema.Resource{ Schema: map[string]*schema.Schema{ "id": ReadOnlyIntSchema(), "name": ReadOnlyStringSchema(), // Do not allow switching off individual rules // "enabled": EnabledSchema(), "description": DescriptionSchema(), "tags": TagsSchema(), "version": VersionSchema(), "anomalous_console_login": MLRuleThresholdAndSeveritySchema(), }, }, },

tembleking · 2025-11-05T10:21:59Z

sysdig/resource_sysdig_secure_okta_ml_policy.go

+		return diag.FromErr(err)
+	}
+
+	policy, err := oktaMLPolicyFromResourceData(d)


Do we need to construct a whole policy from the resource data just to grab the ID? Maybe we can just read d.Id().

tembleking · 2025-11-05T10:24:20Z

sysdig/data_source_sysdig_secure_okta_ml_policy_test.go

+	})
+}
+
+func oktaOktaMLPolicyDataSource(name string) string {


Weird name here 😄 did you meant oktaMLPolicyDataSource?

Suggested change

func oktaOktaMLPolicyDataSource(name string) string {

func oktaMLPolicyDataSource(name string) string {

tembleking · 2025-11-05T10:29:14Z

sysdig/data_source_sysdig_secure_okta_ml_policy_test.go

+			{
+				Config: oktaOktaMLPolicyDataSource(rText),
+			},


This test is not checking that the parameters are correctly received and assigned to the data source.

Suggested change

{

Config: oktaOktaMLPolicyDataSource(rText),

},

{

Config: oktaOktaMLPolicyDataSource(rText),

Check: resource.ComposeTestCheckFunc(

resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "name", fmt.Sprintf("Test Okta ML Policy %s", rText)),

resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "description", fmt.Sprintf("Test Okta ML Policy Description %s", rText)),

resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "enabled", "true"),

resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "severity", "4"),

),

},

harshampatel-sysdig · 2025-11-05T22:33:53Z

Thank you Fede for reviewing and providing valuable feedback. I have pushed changes to cover feedback points. Seems like my commits aren't taking secrets and failing same common test cases. Could you please push empty commit from your end?

harshampatel-sysdig added 5 commits October 29, 2025 17:34

Add terraform support to Okta ML Policy

df22c77

Merge branch 'master' into feature-oktaml-terraform

7d69eab

Handle error and git ignore vscode

9fd8297

Merge branch 'feature-oktaml-terraform' of https://github.com/harsham…

9c2b3c8

…patel-sysdig/terraform-provider-sysdig into feature-oktaml-terraform

Remove pointer and pass &policy

c509dba

harshampatel-sysdig requested review from airadier, daniel-almeida, ivanlysiuk-sysdig, jbainbridgesysdig, mateobur, ombellare, rosenbloomb-sysdig and tembleking as code owners October 30, 2025 23:42

Updated documentations

62d7809

ombellare previously approved these changes Oct 31, 2025

View reviewed changes

docs: update threshold descriptions to Default/High/Higher

8443bcd

Changed threshold value descriptions from 'High/Medium/Low' to 'Default/High/Higher' for ML policies

harshampatel-sysdig dismissed ombellare’s stale review via 8443bcd October 31, 2025 01:30

ombellare previously approved these changes Oct 31, 2025

View reviewed changes

tembleking mentioned this pull request Nov 3, 2025

Add terraform support to Okta ML Policy #675

Closed

chore: empty commit to re-run CI

a8855e0

tembleking requested changes Nov 5, 2025

View reviewed changes

harshampatel-sysdig added 2 commits November 5, 2025 12:46

Merge branch 'master' into feature-oktaml-terraform

72d220d

fix: address reviewer feedback for Okta ML policy

b526cd9

harshampatel-sysdig dismissed ombellare’s stale review via b526cd9 November 5, 2025 20:48

chore: trigger CI

662b1ab

tembleking approved these changes Nov 7, 2025

View reviewed changes

chore: empty commit

faa7518

		"enabled": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Enabled,
		"threshold": rule.Details.(*v2.OktaMLRuleDetails).AnomalousConsoleLogin.Threshold,


		# Resource: sysdig_secure_okta_ml_policy

		Retrieves the information of an existing Sysdig Secure Okta ML Policy.

	Retrieves the information of an existing Sysdig Secure Okta ML Policy.
	Manages a Sysdig Secure Okta ML Policy.

	func oktaOktaMLPolicyDataSource(name string) string {
	func oktaMLPolicyDataSource(name string) string {

-			{
-				Config: oktaOktaMLPolicyDataSource(rText),
-			},
+			{
+				Config: oktaOktaMLPolicyDataSource(rText),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "name", fmt.Sprintf("Test Okta ML Policy %s", rText)),
+					resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "description", fmt.Sprintf("Test Okta ML Policy Description %s", rText)),
+					resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "enabled", "true"),
+					resource.TestCheckResourceAttr("data.sysdig_secure_okta_ml_policy.policy_2", "severity", "4"),
+				),
+			},

Add terraform support to Okta ML Policy #676

Are you sure you want to change the base?

Add terraform support to Okta ML Policy #676

Uh oh!

Conversation

harshampatel-sysdig commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ombellare left a comment

Choose a reason for hiding this comment

Uh oh!

tembleking left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

harshampatel-sysdig commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

harshampatel-sysdig commented Oct 30, 2025 •

edited

Loading