add disabled property to firewall

google/resource_compute_firewall.go

@@ -106,6 +106,11 @@ func resourceComputeFirewall() *schema.Resource {
 				ForceNew:     true,
 			},
 
+			"disabled": {
+				Type:     schema.TypeBool,
+				Optional: true,
+			},
+
 			"project": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -271,6 +276,7 @@ func resourceComputeFirewallRead(d *schema.ResourceData, meta interface{}) error
 	d.Set("priority", int(firewall.Priority))
 	d.Set("source_service_accounts", firewall.SourceServiceAccounts)
 	d.Set("target_service_accounts", firewall.TargetServiceAccounts)
+	d.Set("disabled", firewall.Disabled)
 	return nil
 }
 
@@ -289,7 +295,7 @@ func resourceComputeFirewallUpdate(d *schema.ResourceData, meta interface{}) err
 		return err
 	}
 
-	op, err := config.clientComputeBeta.Firewalls.Update(project, d.Id(), firewall).Do()
+	op, err := config.clientComputeBeta.Firewalls.Patch(project, d.Id(), firewall).Do()
 	if err != nil {
 		return fmt.Errorf("Error updating firewall: %s", err)
 	}
@@ -411,5 +417,7 @@ func resourceFirewall(d *schema.ResourceData, meta interface{}) (*computeBeta.Fi
 		Priority:              int64(d.Get("priority").(int)),
 		SourceServiceAccounts: convertStringSet(d.Get("source_service_accounts").(*schema.Set)),
 		TargetServiceAccounts: convertStringSet(d.Get("target_service_accounts").(*schema.Set)),
+		Disabled:              d.Get("disabled").(bool),
+		ForceSendFields:       []string{"Disabled"},
 	}, nil
 }

google/resource_compute_firewall_test.go

@@ -229,6 +229,37 @@ func TestAccComputeFirewall_serviceAccounts(t *testing.T) {
 	})
 }
 
+func TestAccComputeFirewall_disabled(t *testing.T) {
+	t.Parallel()
+
+	networkName := fmt.Sprintf("firewall-test-%s", acctest.RandString(10))
+	firewallName := fmt.Sprintf("firewall-test-%s", acctest.RandString(10))
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckComputeFirewallDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccComputeFirewall_disabled(networkName, firewallName),
+			},
+			resource.TestStep{
+				ResourceName:      "google_compute_firewall.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			resource.TestStep{
+				Config: testAccComputeFirewall_basic(networkName, firewallName),
+			},
+			resource.TestStep{
+				ResourceName:      "google_compute_firewall.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeFirewallDestroy(s *terraform.State) error {
 	config := testAccProvider.Meta().(*Config)
 
@@ -541,3 +572,25 @@ func testAccComputeFirewall_serviceAccounts(sourceSa, targetSa, network, firewal
 		target_service_accounts = ["${google_service_account.target.email}"]
 	}`, sourceSa, targetSa, network, firewall)
 }
+
+func testAccComputeFirewall_disabled(network, firewall string) string {
+	return fmt.Sprintf(`
+	resource "google_compute_network" "foobar" {
+		name = "%s"
+		auto_create_subnetworks = false
+		ipv4_range = "10.0.0.0/16"
+	}
+
+	resource "google_compute_firewall" "foobar" {
+		name = "firewall-test-%s"
+		description = "Resource created for Terraform acceptance testing"
+		network = "${google_compute_network.foobar.name}"
+		source_tags = ["foo"]
+
+		allow {
+			protocol = "icmp"
+		}
+
+		disabled = true
+	}`, network, firewall)
+}

website/docs/r/compute_firewall.html.markdown

@@ -53,6 +53,9 @@ The following arguments are supported:
 
 * `description` - (Optional) Textual description field.
 
+* `disabled` - (Optional) Denotes whether the firewall rule is disabled, i.e not applied to the network it is associated with.
+    When set to true, the firewall rule is not enforced and the network behaves as if it did not exist.
+
 * `project` - (Optional) The ID of the project in which the resource belongs. If it
     is not provided, the provider project is used.