Skip to content

Commit 89ca71a

Browse files
stonithstonith
committed
convert to wafv2 resources and add relevant AWS managed rules
1 parent 2ccbc5e commit 89ca71a

1 file changed

Lines changed: 229 additions & 74 deletions

File tree

‎config/terraform/aws/waf.tf‎

Lines changed: 229 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,113 +1,268 @@
11
###
2-
# AWS WAF - Key Submission - /claim-key
2+
# AWS WAF - Managed Rules
33
###
4+
resource "aws_wafv2_web_acl" "key_submission" {
5+
name = "key_submission"
6+
scope = "REGIONAL"
47

5-
resource "aws_wafregional_byte_match_set" "key_submission_claim_key_uri" {
6-
name = "KeySubmissionClaimKeyURI"
7-
byte_match_tuples {
8-
text_transformation = "NONE"
9-
target_string = "/claim-key"
10-
positional_constraint = "CONTAINS"
8+
default_action {
9+
block {}
10+
}
11+
12+
rule {
13+
name = "AWSManagedRulesAmazonIpReputationList"
14+
priority = 1
15+
16+
override_action {
17+
none {}
18+
}
1119

12-
field_to_match {
13-
type = "URI"
20+
statement {
21+
managed_rule_group_statement {
22+
name = "AWSManagedRulesAmazonIpReputationList"
23+
vendor_name = "AWS"
24+
}
25+
}
26+
27+
visibility_config {
28+
cloudwatch_metrics_enabled = true
29+
metric_name = "AWSManagedRulesAmazonIpReputationList"
30+
sampled_requests_enabled = true
1431
}
1532
}
16-
}
1733

18-
resource "aws_wafregional_rate_based_rule" "key_submission_claim_key_uri" {
19-
name = "KeySubmissionClaimKeyURIRateLimit"
20-
metric_name = "KeySubmissionClaimKeyURIRateLimit"
21-
rate_key = "IP"
34+
rule {
35+
name = "AWSManagedRulesCommonRuleSet"
36+
priority = 2
2237

23-
rate_limit = 100
38+
override_action {
39+
none {}
40+
}
41+
42+
statement {
43+
managed_rule_group_statement {
44+
name = "AWSManagedRulesCommonRuleSet"
45+
vendor_name = "AWS"
46+
}
47+
}
2448

25-
predicate {
26-
type = "ByteMatch"
27-
data_id = aws_wafregional_byte_match_set.key_submission_claim_key_uri.id
28-
negated = false
49+
visibility_config {
50+
cloudwatch_metrics_enabled = true
51+
metric_name = "AWSManagedRulesCommonRuleSet"
52+
sampled_requests_enabled = true
53+
}
2954
}
30-
}
3155

32-
###
33-
# AWS WAF - Key Submission - /new-key-claim
34-
###
56+
rule {
57+
name = "AWSManagedRulesKnownBadInputsRuleSet"
58+
priority = 3
59+
60+
override_action {
61+
none {}
62+
}
3563

36-
resource "aws_wafregional_byte_match_set" "key_submission_new_key_claim_uri" {
37-
name = "KeySubmissionNewKeyClaimURI"
38-
byte_match_tuples {
39-
text_transformation = "NONE"
40-
target_string = "/new-key-claim"
41-
positional_constraint = "CONTAINS"
64+
statement {
65+
managed_rule_group_statement {
66+
name = "AWSManagedRulesKnownBadInputsRuleSet"
67+
vendor_name = "AWS"
68+
}
69+
}
4270

43-
field_to_match {
44-
type = "URI"
71+
visibility_config {
72+
cloudwatch_metrics_enabled = true
73+
metric_name = "AWSManagedRulesKnownBadInputsRuleSet"
74+
sampled_requests_enabled = true
4575
}
4676
}
47-
}
4877

49-
resource "aws_wafregional_byte_match_set" "key_submission_authorization_header" {
50-
name = "KeySubmissionAuthorizationHeader"
51-
byte_match_tuples {
52-
text_transformation = "NONE"
53-
target_string = "Bearer"
54-
positional_constraint = "CONTAINS"
78+
rule {
79+
name = "AWSManagedRulesLinuxRuleSet"
80+
priority = 4
5581

56-
field_to_match {
57-
type = "HEADER"
58-
data = "authorization"
82+
override_action {
83+
none {}
5984
}
60-
}
61-
}
6285

63-
resource "aws_wafregional_rule" "key_submission_new_key_claim_authorization_header" {
64-
name = "KeySubmissionNewKeyClaimURIMissingAuthorizationHeader"
65-
metric_name = "KeySubmissionNewKeyClaimURIMissingAuthorizationHeader"
86+
statement {
87+
managed_rule_group_statement {
88+
name = "AWSManagedRulesLinuxRuleSet"
89+
vendor_name = "AWS"
90+
}
91+
}
6692

67-
predicate {
68-
type = "ByteMatch"
69-
data_id = aws_wafregional_byte_match_set.key_submission_authorization_header.id
70-
negated = true
71-
}
72-
predicate {
73-
type = "ByteMatch"
74-
data_id = aws_wafregional_byte_match_set.key_submission_new_key_claim_uri.id
75-
negated = false
93+
visibility_config {
94+
cloudwatch_metrics_enabled = true
95+
metric_name = "AWSManagedRulesLinuxRuleSet"
96+
sampled_requests_enabled = true
97+
}
7698
}
77-
}
7899

79-
###
80-
# AWS WAF ACL - Key Submission
81-
###
100+
rule {
101+
name = "AWSManagedRulesSQLiRuleSet"
102+
priority = 5
82103

83-
resource "aws_wafregional_web_acl" "key_submission" {
84-
name = "KeySubmission"
85-
metric_name = "KeySubmission"
104+
override_action {
105+
none {}
106+
}
86107

87-
default_action {
88-
type = "ALLOW"
108+
statement {
109+
managed_rule_group_statement {
110+
name = "AWSManagedRulesSQLiRuleSet"
111+
vendor_name = "AWS"
112+
}
113+
}
114+
115+
visibility_config {
116+
cloudwatch_metrics_enabled = true
117+
metric_name = "AWSManagedRulesSQLiRuleSet"
118+
sampled_requests_enabled = true
119+
}
89120
}
90121

91122
rule {
92-
type = "RATE_BASED"
93-
priority = 1
94-
rule_id = aws_wafregional_rate_based_rule.key_submission_claim_key_uri.id
123+
name = "KeySubmissionClaimKeyURIRateLimit"
124+
priority = 100
125+
95126
action {
96-
type = "BLOCK"
127+
block {}
128+
}
129+
130+
statement {
131+
rate_based_statement {
132+
limit = 100
133+
aggregate_key_type = "IP"
134+
scope_down_statement {
135+
byte_match_statement {
136+
positional_constraint = "EXACTLY"
137+
field_to_match {
138+
uri_path {}
139+
}
140+
search_string = "/claim-key"
141+
text_transformation {
142+
priority = 1
143+
type = "COMPRESS_WHITE_SPACE"
144+
}
145+
text_transformation {
146+
priority = 2
147+
type = "LOWERCASE"
148+
}
149+
}
150+
}
151+
}
152+
}
153+
154+
visibility_config {
155+
cloudwatch_metrics_enabled = true
156+
metric_name = "KeySubmissionClaimKeyURIRateLimit"
157+
sampled_requests_enabled = true
97158
}
98159
}
99160

100161
rule {
101-
type = "REGULAR"
102-
priority = 2
103-
rule_id = aws_wafregional_rule.key_submission_new_key_claim_authorization_header.id
162+
name = "KeySubmissionURI"
163+
priority = 200
164+
104165
action {
105-
type = "BLOCK"
166+
allow {}
167+
}
168+
169+
statement {
170+
and_statement {
171+
statement {
172+
or_statement {
173+
statement {
174+
byte_match_statement {
175+
positional_constraint = "STARTS_WITH"
176+
field_to_match {
177+
uri_path {}
178+
}
179+
search_string = "/new-key-claim"
180+
text_transformation {
181+
priority = 1
182+
type = "COMPRESS_WHITE_SPACE"
183+
}
184+
text_transformation {
185+
priority = 2
186+
type = "LOWERCASE"
187+
}
188+
}
189+
}
190+
statement {
191+
byte_match_statement {
192+
positional_constraint = "EXACTLY"
193+
field_to_match {
194+
uri_path {}
195+
}
196+
search_string = "/upload"
197+
text_transformation {
198+
priority = 1
199+
type = "COMPRESS_WHITE_SPACE"
200+
}
201+
text_transformation {
202+
priority = 2
203+
type = "LOWERCASE"
204+
}
205+
}
206+
}
207+
statement {
208+
byte_match_statement {
209+
positional_constraint = "EXACTLY"
210+
field_to_match {
211+
uri_path {}
212+
}
213+
search_string = "/claim-key"
214+
text_transformation {
215+
priority = 1
216+
type = "COMPRESS_WHITE_SPACE"
217+
}
218+
text_transformation {
219+
priority = 2
220+
type = "LOWERCASE"
221+
}
222+
}
223+
}
224+
}
225+
}
226+
statement {
227+
byte_match_statement {
228+
positional_constraint = "STARTS_WITH"
229+
field_to_match {
230+
single_header {
231+
name = "authorization"
232+
}
233+
}
234+
search_string = "Bearer"
235+
text_transformation {
236+
priority = 1
237+
type = "NONE"
238+
}
239+
}
240+
}
241+
}
242+
}
243+
244+
visibility_config {
245+
cloudwatch_metrics_enabled = true
246+
metric_name = "KeySubmissionURI"
247+
sampled_requests_enabled = false
106248
}
107249
}
250+
251+
tags = {
252+
(var.billing_tag_key) = var.billing_tag_value
253+
}
254+
255+
visibility_config {
256+
cloudwatch_metrics_enabled = true
257+
metric_name = "key_submission"
258+
sampled_requests_enabled = false
259+
}
108260
}
109261

110-
resource "aws_wafregional_web_acl_association" "key_submission" {
262+
###
263+
# AWS WAF - Resource Assocation
264+
###
265+
resource "aws_wafv2_web_acl_association" "key_submission_assocation" {
111266
resource_arn = aws_lb.covidshield_key_submission.arn
112-
web_acl_id = aws_wafregional_web_acl.key_submission.id
267+
web_acl_arn = aws_wafv2_web_acl.key_submission.arn
113268
}

0 commit comments

Comments
 (0)