feat: Added new resource for Cloud Application Control rule management (

#46) * feat: Added new resource for Cloud Application Control rule management * fix: Applied Ansible sanity and lint to core code * fix: Updated Github Workflows with Ansible 2.17
zscaler · Sep 7, 2024 · 1537a09 · 1537a09
1 parent 02da673
commit 1537a09
Showing 24 changed files with 2,431 additions and 963 deletions.
diff --git a/.github/workflows/ansible-test-sanity.yml b/.github/workflows/ansible-test-sanity.yml
@@ -28,6 +28,8 @@ jobs:
             python_ver: "3.11"
           - ansible: "2.16"
             python_ver: "3.11"
+          - ansible: "2.17"
+            python_ver: "3.11"
     runs-on: ubuntu-latest
     defaults:
       run:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -25,6 +25,8 @@ jobs:
             python_ver: "3.11"
           - ansible: "2.16"
             python_ver: "3.11"
+          - ansible: "2.17"
+            python_ver: "3.11"
     runs-on: ubuntu-latest
     defaults:
       run:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,11 +1,14 @@
-## [1.2.0](https://github.com/zscaler/ziacloud-ansible/compare/v1.1.0...v1.2.0) (2024-07-24)
+# Zscaler Internet Access (ZIA) Ansible Collection Changelog
 
+## v1.3.0 (September, 6 2024)
 
-### Features
+### Notes
 
-* Added support to Ansible check_mode ([#40](https://github.com/zscaler/ziacloud-ansible/issues/40)) ([14373dd](https://github.com/zscaler/ziacloud-ansible/commit/14373dd809ef73ebd7914371c6950bd92ee0488a))
+- Python Versions: **v3.9, v3.10, v3.11**
 
-# Zscaler Internet Access (ZIA) Ansible Collection Changelog
+### New Feature
+
+- [PR #46](https://github.com/zscaler/zscaler-sdk-go/pull/46) Added new resource `zia_cloud_app_control_rule` for Cloud Application Control rule management.
 
 ## v1.2.0 (July, 22 2024)
 

diff --git a/docs/dev_requirements.txt b/docs/dev_requirements.txt
@@ -1,6 +1,6 @@
-sphinx==7.0.1
+sphinx==7.4.7
 sphinx-rtd-theme
 sphinx_ansible_theme
-antsibull-docs==2.10.0
+antsibull-docs==2.11.0
 antsibull-changelog==0.26.0
 rstcheck
diff --git a/docs/source/conf.py b/docs/source/conf.py
@@ -21,7 +21,7 @@
 html_title = "Ansible Collections Documentation"
 
 # The full version, including alpha/beta/rc tags
-release = "1.2.0"
+release = "1.3.0"
 
 # Disable the Copyright footer for Read the docs at the bottom of the page
 # by setting property html_show_copyright = False

diff --git a/docs/source/release_notes.rst b/docs/source/release_notes.rst
@@ -9,6 +9,20 @@ Releases
 Zscaler Internet Access (ZIA) Ansible Collection Changelog
 ----------------------------------------------------------
 
+1.3.0 (September, 6 2024)
+-------------------------
+
+Notes
+^^^^^
+
+- Python Versions: **v3.9, v3.10, v3.11**
+
+New Feature
+^^^^^^^^^^^
+
+- (`#46 <https://github.com/zscaler/ziacloud-ansible/issues/46>`_) Added new resource `zia_cloud_app_control_rule` and `zia_cloud_app_control_rule_info` for Cloud Application Control rule management.
+
+
 1.2.0 (July, 22 2024)
 ----------------------
 

diff --git a/plugins/module_utils/utils.py b/plugins/module_utils/utils.py
@@ -371,3 +371,22 @@ def process_vpn_credentials(vpn_creds):
                 }
             )
     return processed_creds
+
+
+# Utility Function: normalize_boolean_attributes
+def normalize_boolean_attributes(rule, bool_attributes):
+    """
+    Ensures that boolean attributes in the rule are normalized.
+    If the attribute is None, it will be set to False.
+
+    Args:
+        rule (dict): The rule dictionary containing attributes.
+        bool_attributes (list): List of attribute names that should be treated as boolean.
+
+    Returns:
+        dict: The rule with normalized boolean attributes.
+    """
+    for attr in bool_attributes:
+        if rule.get(attr) is None:
+            rule[attr] = False
+    return rule
diff --git a/plugins/modules/zia_activation_status.py b/plugins/modules/zia_activation_status.py
@@ -97,13 +97,13 @@ def core(module):
     if desired_status not in [None, "ACTIVE"]:
         module.fail_json(msg=f"Invalid activation status '{desired_status}'")
 
-    original_activation_status = client.config.status()
+    original_activation_status = client.activate.status()
 
     # If state is 'present' and the desired activation status does not match the current one, attempt to activate
     if module.params.get("state") == "present":
         if original_activation_status != desired_status:
-            client.config.activate()
-            new_status = client.config.status()
+            client.activate.activate()
+            new_status = client.activate.status()
 
             if new_status == "PENDING":
                 message = (

diff --git a/plugins/modules/zia_cloud_app_control_rules.py b/plugins/modules/zia_cloud_app_control_rules.py
diff --git a/plugins/modules/zia_cloud_app_control_rules_info.py b/plugins/modules/zia_cloud_app_control_rules_info.py
@@ -0,0 +1,209 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2023 Zscaler Inc, <devrel@zscaler.com>
+
+#                             MIT License
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+from __future__ import absolute_import, division, print_function
+
+__metaclass__ = type
+
+DOCUMENTATION = r"""
+---
+module: zia_cloud_app_control_rules_info
+short_description: Gets the list of cloud application rules by the type of rule..
+description: Gets the list of cloud application rules by the type of rule..
+author:
+  - William Guilherme (@willguibr)
+version_added: "1.3.0"
+requirements:
+    - Zscaler SDK Python can be obtained from PyPI U(https://pypi.org/project/zscaler-sdk-python/)
+notes:
+    - Check mode is not supported.
+extends_documentation_fragment:
+  - zscaler.ziacloud.fragments.provider
+  - zscaler.ziacloud.fragments.documentation
+
+options:
+  id:
+    description:
+        - The universally unique identifier (UUID) for the browser isolation profile.
+    type: str
+    required: false
+  name:
+    description:
+        - Name of the cloud application control rule.
+    required: false
+    type: str
+  rule_type:
+    description:
+        - The rule type selected from the available options.
+    required: true
+    type: str
+    choices:
+      - SOCIAL_NETWORKING
+      - STREAMING_MEDIA
+      - WEBMAIL
+      - INSTANT_MESSAGING
+      - BUSINESS_PRODUCTIVITY
+      - ENTERPRISE_COLLABORATION
+      - SALES_AND_MARKETING
+      - SYSTEM_AND_DEVELOPMENT
+      - CONSUMER
+      - HOSTING_PROVIDER
+      - IT_SERVICES
+      - FILE_SHARE
+      - DNS_OVER_HTTPS
+      - HUMAN_RESOURCES
+      - LEGAL
+      - HEALTH_CARE
+      - FINANCE
+      - CUSTOM_CAPP
+      - AI_ML
+"""
+
+EXAMPLES = r"""
+- name: Gather Information Details of a cloud application control rule by Name
+  zscaler.ziacloud.zia_cloud_app_control_rules_info:
+    provider: '{{ provider }}'
+    name: "Webmail Rule-1"
+    rule_type: "WEBMAIL"
+"""
+
+RETURN = r"""
+rules:
+    description: A list of cloud application control rules that match the specified criteria.
+    returned: always
+    type: list
+    elements: dict
+    sample: [
+        {
+            "access_control": "READ_WRITE",
+            "actions": [
+                "ALLOW_WEBMAIL_VIEW",
+                "ALLOW_WEBMAIL_ATTACHMENT_SEND"
+            ],
+            "applications": [
+                "GOOGLE_WEBMAIL",
+                "YAHOO_WEBMAIL",
+                "WINDOWS_LIVE_HOTMAIL"
+            ],
+            "browser_eun_template_id": 0,
+            "cascading_enabled": false,
+            "enforce_time_validity": false,
+            "eun_enabled": false,
+            "eun_template_id": 0,
+            "id": 552617,
+            "name": "Webmail Rule-1",
+            "order": 2,
+            "predefined": false,
+            "rank": 7,
+            "state": "DISABLED",
+            "type": "WEBMAIL"
+        }
+    ]
+"""
+
+from traceback import format_exc
+
+from ansible.module_utils._text import to_native
+from ansible.module_utils.basic import AnsibleModule
+from ansible_collections.zscaler.ziacloud.plugins.module_utils.zia_client import (
+    ZIAClientHelper,
+)
+
+
+def core(module):
+    rule_id = module.params.get("id", None)
+    rule_name = module.params.get("name", None)
+    rule_type = module.params.get("rule_type", None)
+    client = ZIAClientHelper(module)
+    rules = []
+
+    if rule_id is not None:
+        # Fetch rule by ID directly using rule_type
+        rule_box = client.cloudappcontrol.get_rule(rule_type=rule_type, rule_id=rule_id)
+        if rule_box is None:
+            module.fail_json(
+                msg=f"Failed to retrieve Cloud App Control Rule with ID: '{rule_id}' under rule type: '{rule_type}'"
+            )
+        rules = [rule_box]
+    else:
+        # Fetch all rules for the specified rule_type
+        all_rules = client.cloudappcontrol.list_rules(rule_type=rule_type)
+
+        if rule_name is not None:
+            # Search for the specific rule by name
+            rule_box = client.cloudappcontrol.get_rule_by_name(
+                rule_type=rule_type, rule_name=rule_name
+            )
+            if rule_box is None:
+                module.fail_json(
+                    msg=f"Failed to retrieve Cloud App Control Rule with Name: '{rule_name}' under rule type: '{rule_type}'"
+                )
+            rules = [rule_box]
+        else:
+            # Return all rules for the specified rule_type
+            rules = list(all_rules)
+
+    module.exit_json(changed=False, rules=rules)
+
+
+def main():
+    argument_spec = ZIAClientHelper.zia_argument_spec()
+    argument_spec.update(
+        name=dict(type="str", required=False),
+        rule_type=dict(  # This is mapped to `type` in the payload
+            type="str",
+            required=True,
+            choices=[
+                "SOCIAL_NETWORKING",
+                "STREAMING_MEDIA",
+                "WEBMAIL",
+                "INSTANT_MESSAGING",
+                "BUSINESS_PRODUCTIVITY",
+                "ENTERPRISE_COLLABORATION",
+                "SALES_AND_MARKETING",
+                "SYSTEM_AND_DEVELOPMENT",
+                "CONSUMER",
+                "HOSTING_PROVIDER",
+                "IT_SERVICES",
+                "FILE_SHARE",
+                "DNS_OVER_HTTPS",
+                "HUMAN_RESOURCES",
+                "LEGAL",
+                "HEALTH_CARE",
+                "FINANCE",
+                "CUSTOM_CAPP",
+                "AI_ML",
+            ],
+        ),
+        id=dict(type="str", required=False),
+    )
+    module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True)
+    try:
+        core(module)
+    except Exception as e:
+        module.fail_json(msg=to_native(e), exception=format_exc())
+
+
+if __name__ == "__main__":
+    main()
diff --git a/plugins/modules/zia_cloud_firewall_network_application_info.py b/plugins/modules/zia_cloud_firewall_network_application_info.py
@@ -123,16 +123,22 @@ def core(module):
             network_app = client.firewall.get_network_app(str(network_app_id)).to_dict()
             network_apps = [network_app]
         except Exception as e:
-            module.fail_json(msg=f"Failed to retrieve network application by ID '{network_app_id}': {str(e)}")
+            module.fail_json(
+                msg=f"Failed to retrieve network application by ID '{network_app_id}': {str(e)}"
+            )
 
     # If no ID provided, handle by name or list all
     else:
         all_apps = client.firewall.list_network_apps().to_list()
         if network_app_name:
             # Filter apps by name
-            network_app = next((app for app in all_apps if app.get("name") == network_app_name), None)
+            network_app = next(
+                (app for app in all_apps if app.get("name") == network_app_name), None
+            )
             if not network_app:
-                module.fail_json(msg=f"No network application found with name: '{network_app_name}'")
+                module.fail_json(
+                    msg=f"No network application found with name: '{network_app_name}'"
+                )
             network_apps = [network_app]
         else:
             network_apps = all_apps
@@ -143,7 +149,9 @@ def core(module):
 def main():
     argument_spec = ZIAClientHelper.zia_argument_spec()
     argument_spec.update(
-        id=dict(type="str", required=False),  # Changed type to 'str' to accept string input
+        id=dict(
+            type="str", required=False
+        ),  # Changed type to 'str' to accept string input
         name=dict(type="str", required=False),
         locale=dict(type="str", required=False),
     )

diff --git a/plugins/modules/zia_url_categories.py b/plugins/modules/zia_url_categories.py
@@ -291,15 +291,15 @@ def core(module):
     desired_category_preprocessed = preprocess_category(desired_category, params)
 
     # Exclude 'super_category' from the comparison
-    if 'super_category' in desired_category_preprocessed:
-        desired_category_preprocessed.pop('super_category')
-    if 'super_category' in existing_category_preprocessed:
-        existing_category_preprocessed.pop('super_category')
+    if "super_category" in desired_category_preprocessed:
+        desired_category_preprocessed.pop("super_category")
+    if "super_category" in existing_category_preprocessed:
+        existing_category_preprocessed.pop("super_category")
 
     # Comparison logic
     differences_detected = False
     for key in params:
-        if key == 'super_category':
+        if key == "super_category":
             continue
         desired_value = desired_category_preprocessed.get(key)
         current_value = existing_category_preprocessed.get(key)

diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "ziacloud-ansible"
-version = "1.2.0"
+version = "1.3.0"
 description = "Ansible collection for Zscaler Internet Access"
 authors = ["Zscaler Technology Alliances <devrel@zscaler.com>"]
 license = "MIT"
@@ -11,9 +11,9 @@ repository = "https://github.com/zscaler/ziacloud-ansible"
 
 [tool.poetry.dependencies]
 python = "^3.9"
-#zscaler-sdk-python = ">=0.6.2"
+#zscaler-sdk-python = ">=0.9.1"
 xmltodict = ">=0.12.0"
-aiohttp = ">=3.9.0"
+aiohttp = ">=3.10.5"
 dpath = "^2.1.5"
 pytz = ">=2024.1"
 netaddr = ">=1.2.1"
@@ -33,11 +33,11 @@ pytest-xdist = "*"
 pytest-mock = "*"
 voluptuous = "*"
 yamllint = "*"
-sphinx = "^7.0.1"
+sphinx = "^7.4.7"
 sphinx-rtd-theme = "*"
 sphinx_ansible_theme = "*"
 #ansible-doc-extractor = "*"
-antsibull-docs = "^2.10.0"
+antsibull-docs = "^2.11.0"
 antsibull-changelog = "^0.26.0"
 ansible-core = "*"
 ansible-lint = "*"

diff --git a/requirements.txt b/requirements.txt
diff --git a/tests/integration/run_all_tests.yml b/tests/integration/run_all_tests.yml
@@ -20,6 +20,7 @@
       ansible.builtin.include_tasks: "{{ item }}"
       loop:
         - targets/zia_authentication_settings/tasks/main.yml
+        - targets/zia_cloud_app_control_rules/tasks/main.yml
         - targets/zia_cloud_firewall_filtering_rule/tasks/main.yml
         - targets/zia_cloud_firewall_ip_destination_groups/tasks/main.yml
         - targets/zia_cloud_firewall_ip_source_groups/tasks/main.yml

diff --git a/tests/integration/targets/zia_cloud_app_control_rules/defaults/main.yml b/tests/integration/targets/zia_cloud_app_control_rules/defaults/main.yml
@@ -0,0 +1,21 @@
+---
+rule_name: test_zia_ansible
+description: test_zia_ansible
+rule_type: WEBMAIL
+rule_order: 1
+enabled: true
+actions:
+  - ALLOW_WEBMAIL_VIEW
+  - ALLOW_WEBMAIL_ATTACHMENT_SEND
+  - ALLOW_WEBMAIL_SEND
+applications:
+  - GOOGLE_WEBMAIL
+  - YAHOO_WEBMAIL
+device_trust_levels:
+  - UNKNOWN_DEVICETRUSTLEVEL
+  - LOW_TRUST
+  - MEDIUM_TRUST
+  - HIGH_TRUST
+
+# Cloud App Control Rule Update
+description_update: test_zia_ansible_update
diff --git a/tests/integration/targets/zia_cloud_app_control_rules/meta/main.yml b/tests/integration/targets/zia_cloud_app_control_rules/meta/main.yml
@@ -0,0 +1,2 @@
+---
+dependencies: []
diff --git a/tests/integration/targets/zia_cloud_app_control_rules/tasks/main.yml b/tests/integration/targets/zia_cloud_app_control_rules/tasks/main.yml
@@ -0,0 +1,207 @@
+---
+- name: Include default variables
+  ansible.builtin.include_vars:
+    file: ../defaults/main.yml
+
+- name: Import Random String Generator Tasks
+  ansible.builtin.import_tasks: ../../../generate_random_string.yml
+
+- name: Set dynamic name values with random string
+  ansible.builtin.set_fact:
+    rule_name: "{{ rule_name }}_{{ random_string }}"
+    description: "{{ description }}_{{ random_string }}"
+    description_update: "{{ description_update }}_{{ random_string }}"
+
+- name: Ensure required environment variables are set
+  ansible.builtin.fail:
+    msg: "{{ env_var }} is not defined as environment variable"
+  when: lookup('env', env_var) is none
+  loop:
+    - ZIA_USERNAME
+    - ZIA_PASSWORD
+    - ZIA_API_KEY
+    - ZIA_CLOUD
+  loop_control:
+    loop_var: env_var
+
+- name: Ensure ZIA Credential environment variables are set
+  ansible.builtin.set_fact:
+    zia_cloud:
+      username: "{{ lookup('env', 'ZIA_USERNAME') }}"
+      password: "{{ lookup('env', 'ZIA_PASSWORD') }}"
+      api_key: "{{ lookup('env', 'ZIA_API_KEY') }}"
+      cloud: "{{ lookup('env', 'ZIA_CLOUD') | default(omit) }}"
+  no_log: true
+
+- name: Main block to Test Cloud App Control Rule Configuration
+  block:
+    - name: Ensure Cloud App Control Rule (leftover)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: absent
+        name: "{{ rule_name }}"
+        rule_type: "{{ rule_type }}"
+      register: result
+
+  rescue:
+    - name: Handle errors
+      ansible.builtin.debug:
+        msg: An error occurred.
+
+  always:
+    - name: Cleanup operations
+      ansible.builtin.debug:
+        msg: Cleanup complete.
+
+    - name: Ensure Cloud App Control Rule is absent
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: absent
+        name: "{{ rule_name }}"
+        rule_type: "{{ rule_type }}"
+      register: result
+
+    - name: Verify Cloud App Control Rule is absent
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+          - result.data is defined
+
+    - name: Ensure Cloud App Control Rule is (Present)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: present
+        name: "{{ rule_name }}"
+        description: "{{ description }}"
+        rule_type: WEBMAIL
+        actions: "{{ actions }}"
+        order: "{{ rule_order }}"
+        enabled: "{{ enabled }}"
+        applications: "{{ applications }}"
+        device_trust_levels: "{{ device_trust_levels }}"
+      register: result
+
+    - name: Verify Cloud App Control Rule is present
+      ansible.builtin.assert:
+        that:
+          - result.changed
+          - result.data is defined
+          - result.data.name is defined
+
+    - name: Ensure Cloud App Control Rule (again; idempotency check)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: present
+        name: "{{ rule_name }}"
+        description: "{{ description }}"
+        rule_type: WEBMAIL
+        actions: "{{ actions }}"
+        order: "{{ rule_order }}"
+        enabled: "{{ enabled }}"
+        applications: "{{ applications }}"
+        device_trust_levels: "{{ device_trust_levels }}"
+      register: result
+
+    - name: Ensure Cloud App Control Rule is present (idempotency check)
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+
+    - name: Update Cloud App Control Rule (Present)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: present
+        name: "{{ rule_name }}"
+        description: "{{ description_update }}"
+        rule_type: "{{ rule_type }}"
+        actions: "{{ actions }}"
+        order: "{{ rule_order }}"
+        enabled: "{{ enabled }}"
+        applications: "{{ applications }}"
+        device_trust_levels: "{{ device_trust_levels }}"
+      register: result
+
+    - name: Verify Cloud App Control Rule is Updated
+      ansible.builtin.assert:
+        that:
+          - result.changed
+          - result.data is defined
+          - result.data.name == rule_name
+          - result.data.description == description_update
+
+    - name: Ensure Cloud App Control Rule is Updated (again; idempotency check)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: present
+        name: "{{ rule_name }}"
+        description: "{{ description_update }}"
+        rule_type: "{{ rule_type }}"
+        actions: "{{ actions }}"
+        order: "{{ rule_order }}"
+        enabled: "{{ enabled }}"
+        applications: "{{ applications }}"
+        device_trust_levels: "{{ device_trust_levels }}"
+      register: result
+
+    - name: Ensure Cloud App Control Rule update is idempotent
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+
+    - name: Fetch all Cloud App Control Rule
+      zscaler.ziacloud.zia_cloud_app_control_rules_info:
+        provider: "{{ zia_cloud }}"
+        rule_type: "WEBMAIL"
+      register: result
+
+    - name: Ensure all Cloud App Control Rule found
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+          - result.rules[0] is defined
+
+    - name: Fetch this Cloud App Control Rule
+      zscaler.ziacloud.zia_cloud_app_control_rules_info:
+        provider: "{{ zia_cloud }}"
+        name: "{{ rule_name }}"
+        rule_type: "WEBMAIL"
+      register: result
+
+    - name: Ensure this Cloud App Control Rule is found
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+          - result.rules is defined
+          - result.rules[0].name is defined
+          - result.rules[0].name == rule_name
+
+    - name: Give the ZIA Cloud a 5 seconds to settle
+      ansible.builtin.pause:
+        seconds: 5
+
+    - name: Delete Cloud App Control Rule
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: absent
+        name: "{{ rule_name }}"
+        rule_type: "WEBMAIL"
+      register: result
+
+    - name: Verify Cloud App Control Rule is Deleted
+      ansible.builtin.assert:
+        that:
+          - result.changed
+
+    - name: Delete Cloud App Control Rule (again; idempotency check)
+      zscaler.ziacloud.zia_cloud_app_control_rules:
+        provider: "{{ zia_cloud }}"
+        state: absent
+        name: "{{ rule_name }}"
+        rule_type: "WEBMAIL"
+      register: result
+
+    - name: Verify Cloud App Control Rule is absent
+      ansible.builtin.assert:
+        that:
+          - not result.changed
+          - result.data is defined
diff --git a/tests/sanity/ignore-2.13.txt b/tests/sanity/ignore-2.13.txt
@@ -56,3 +56,5 @@ plugins/modules/zia_traffic_forwarding_static_ip_info.py validate-modules:missin
 plugins/modules/zia_cloud_firewall_network_application_group.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules_info.py validate-modules:missing-gplv3-license
diff --git a/tests/sanity/ignore-2.14.txt b/tests/sanity/ignore-2.14.txt
@@ -56,3 +56,5 @@ plugins/modules/zia_traffic_forwarding_static_ip_info.py validate-modules:missin
 plugins/modules/zia_cloud_firewall_network_application_group.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules_info.py validate-modules:missing-gplv3-license
diff --git a/tests/sanity/ignore-2.15.txt b/tests/sanity/ignore-2.15.txt
@@ -56,3 +56,5 @@ plugins/modules/zia_traffic_forwarding_static_ip_info.py validate-modules:missin
 plugins/modules/zia_cloud_firewall_network_application_group.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules_info.py validate-modules:missing-gplv3-license
diff --git a/tests/sanity/ignore-2.16.txt b/tests/sanity/ignore-2.16.txt
@@ -56,3 +56,5 @@ plugins/modules/zia_traffic_forwarding_static_ip_info.py validate-modules:missin
 plugins/modules/zia_cloud_firewall_network_application_group.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule.py validate-modules:missing-gplv3-license
 plugins/modules/zia_forwarding_control_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules_info.py validate-modules:missing-gplv3-license
diff --git a/tests/sanity/ignore-2.17.txt b/tests/sanity/ignore-2.17.txt
@@ -0,0 +1,60 @@
+plugins/modules/zia_activation_status_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_activation_status.py validate-modules:missing-gplv3-license
+plugins/modules/zia_admin_role_management_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_user_management_department_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_user_management_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_user_management_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_rule_labels_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_engine_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_dictionaries_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_ip_source_anchoring_zpa_gateway.py validate-modules:missing-gplv3-license
+plugins/modules/zia_ip_source_anchoring_zpa_gateway_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_location_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_location_management.py validate-modules:missing-gplv3-license
+plugins/modules/zia_location_management_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_engine.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_filtering_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_rule_labels.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_icap_server_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_ip_destination_groups.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_idm_profile_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_web_rules_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_services_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_vpn_credentials_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_sandbox_submission.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_application_group_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_ip_source_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_application_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_ip_source_groups.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_notification_template_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_static_ip.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_gre_internal_ranges_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_services.py validate-modules:missing-gplv3-license
+plugins/modules/zia_workload_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_vpn_credentials.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_incident_receiver_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_sandbox_advanced_settings_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_ip_destination_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_url_categories.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_dictionaries.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_filtering_rule.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_services_groups_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_sandbox_advanced_settings.py validate-modules:missing-gplv3-license
+plugins/modules/zia_authentication_settings.py validate-modules:missing-gplv3-license
+plugins/modules/zia_url_filtering_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_security_policy_settings.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_gre_tunnels.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_browser_isolation_profile_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_web_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_gre_tunnel_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_url_filtering_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_url_categories_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_services_groups.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_time_windows_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_dlp_notification_template.py validate-modules:missing-gplv3-license
+plugins/modules/zia_traffic_forwarding_static_ip_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_firewall_network_application_group.py validate-modules:missing-gplv3-license
+plugins/modules/zia_forwarding_control_rule.py validate-modules:missing-gplv3-license
+plugins/modules/zia_forwarding_control_rule_info.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules.py validate-modules:missing-gplv3-license
+plugins/modules/zia_cloud_app_control_rules_info.py validate-modules:missing-gplv3-license