Add security exception item

CODING_STANDARDS.md

@@ -36,6 +36,7 @@ This document outlines the coding standards and conventions used in the terrafor
 - Prefer using existing util functions over longer form, duplicated code:
   - `utils.IsKnown(val)` instead of `!val.IsNull() && !val.IsUnknown()`
   - `utils.ListTypeAs` instead of `val.ElementsAs` or similar for other collection types
+  - `typeutils.StringishValue` instead of casting to a string eg `types.StringValue(string(apiResp.Id))`. Use `typeutils.StringishPointerValue` for pointers
 - The final state for a resource should be derived from a read request following a mutative request (eg create or update). We should not use the response from a mutative request to build the final resource state.
 
 ## Schema Definitions
@@ -75,6 +76,12 @@ This document outlines the coding standards and conventions used in the terrafor
   - Define any required variables within the module
   - Reference the test code via `ConfigDirectory: acctest.NamedTestCaseDirectory("<step description>")`
   - Define any required variables via `ConfigVariables`
+- Resources should include tests for the following
+  - Creating a resource
+  - Updating a resource
+  - Deleting a resource
+  - Importing a resource
+  - Creating a resoure in another space (if applicable)
 
 ## API Client Usage
 

examples/resources/elasticstack_kibana_security_exception_item/resource.tf

@@ -0,0 +1,36 @@
+resource "elasticstack_kibana_security_exception_list" "example" {
+  list_id        = "my-exception-list"
+  name           = "My Exception List"
+  description    = "List of exceptions"
+  type           = "detection"
+  namespace_type = "single"
+}
+
+resource "elasticstack_kibana_security_exception_item" "complex_entry" {
+  list_id        = elasticstack_kibana_security_exception_list.example.list_id
+  item_id        = "complex-exception"
+  name           = "Complex Exception with Multiple Entries"
+  description    = "Exception with multiple conditions"
+  type           = "simple"
+  namespace_type = "single"
+
+  # Multiple entries with different operators
+  entries = [
+    {
+      type     = "match"
+      field    = "host.name"
+      operator = "included"
+      value    = "trusted-host"
+    },
+    {
+      type     = "match_any"
+      field    = "user.name"
+      operator = "excluded"
+      values   = ["admin", "root"]
+    }
+  ]
+
+  os_types = ["linux"]
+  tags     = ["complex", "multi-condition"]
+}
+

internal/kibana/security_exception_item/create.go

@@ -0,0 +1,74 @@
+package security_exception_item
+
+import (
+	"context"
+
+	"github.com/elastic/terraform-provider-elasticstack/generated/kbapi"
+	"github.com/elastic/terraform-provider-elasticstack/internal/clients/kibana_oapi"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+func (r *ExceptionItemResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan ExceptionItemModel
+
+	diags := req.Plan.Get(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := r.client.GetKibanaOapiClient()
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to get Kibana client", err.Error())
+		return
+	}
+
+	// Build the request body using model method
+	body, diags := plan.toCreateRequest(ctx)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Create the exception item
+	createResp, diags := kibana_oapi.CreateExceptionListItem(ctx, client, plan.SpaceID.ValueString(), *body)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if createResp == nil {
+		resp.Diagnostics.AddError("Failed to create exception item", "API returned empty response")
+		return
+	}
+
+	/*
+	 * In create/update paths we typically follow the write operation with a read, and then set the state from the read.
+	 * We want to avoid a dirty plan immediately after an apply.
+	 */
+	// Read back the created resource to get the final state
+	readParams := &kbapi.ReadExceptionListItemParams{
+		Id: (*kbapi.SecurityExceptionsAPIExceptionListItemId)(&createResp.Id),
+	}
+
+	readResp, diags := kibana_oapi.GetExceptionListItem(ctx, client, plan.SpaceID.ValueString(), readParams)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if readResp == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	// Update state with read response using model method
+	diags = plan.fromAPI(ctx, readResp)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	diags = resp.State.Set(ctx, plan)
+	resp.Diagnostics.Append(diags...)
+}

internal/kibana/security_exception_item/delete.go

@@ -0,0 +1,42 @@
+package security_exception_item
+
+import (
+	"context"
+
+	"github.com/elastic/terraform-provider-elasticstack/generated/kbapi"
+	"github.com/elastic/terraform-provider-elasticstack/internal/clients"
+	"github.com/elastic/terraform-provider-elasticstack/internal/clients/kibana_oapi"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+)
+
+func (r *ExceptionItemResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state ExceptionItemModel
+
+	diags := req.State.Get(ctx, &state)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Parse composite ID to get space_id and resource_id
+	compId, compIdDiags := clients.CompositeIdFromStrFw(state.ID.ValueString())
+	resp.Diagnostics.Append(compIdDiags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	client, err := r.client.GetKibanaOapiClient()
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to get Kibana client", err.Error())
+		return
+	}
+
+	// Delete by ID
+	id := kbapi.SecurityExceptionsAPIExceptionListItemId(compId.ResourceId)
+	params := &kbapi.DeleteExceptionListItemParams{
+		Id: &id,
+	}
+
+	diags = kibana_oapi.DeleteExceptionListItem(ctx, client, state.SpaceID.ValueString(), params)
+	resp.Diagnostics.Append(diags...)
+}