Skip to content

Commit 17f62cd

Browse files
stonithstonith
committed
convert to wafv2 resources and add relevant AWS managed rules
1 parent 2ccbc5e commit 17f62cd

File tree

1 file changed

+278
-73
lines changed

1 file changed

+278
-73
lines changed

‎config/terraform/aws/waf.tf

+278-73
Original file line numberDiff line numberDiff line change
@@ -1,113 +1,318 @@
11
###
2-
# AWS WAF - Key Submission - /claim-key
2+
# AWS WAF - Managed Rules
33
###
4+
resource "aws_wafv2_web_acl" "key_submission" {
5+
name = "key_submission"
6+
scope = "REGIONAL"
47

5-
resource "aws_wafregional_byte_match_set" "key_submission_claim_key_uri" {
6-
name = "KeySubmissionClaimKeyURI"
7-
byte_match_tuples {
8-
text_transformation = "NONE"
9-
target_string = "/claim-key"
10-
positional_constraint = "CONTAINS"
8+
default_action {
9+
block {}
10+
}
11+
12+
rule {
13+
name = "AWSManagedRulesAmazonIpReputationList"
14+
priority = 1
15+
16+
override_action {
17+
none {}
18+
}
19+
20+
statement {
21+
managed_rule_group_statement {
22+
name = "AWSManagedRulesAmazonIpReputationList"
23+
vendor_name = "AWS"
24+
}
25+
}
1126

12-
field_to_match {
13-
type = "URI"
27+
visibility_config {
28+
cloudwatch_metrics_enabled = true
29+
metric_name = "AWSManagedRulesAmazonIpReputationList"
30+
sampled_requests_enabled = true
1431
}
1532
}
16-
}
1733

18-
resource "aws_wafregional_rate_based_rule" "key_submission_claim_key_uri" {
19-
name = "KeySubmissionClaimKeyURIRateLimit"
20-
metric_name = "KeySubmissionClaimKeyURIRateLimit"
21-
rate_key = "IP"
34+
rule {
35+
name = "AWSManagedRulesCommonRuleSet"
36+
priority = 2
37+
38+
override_action {
39+
none {}
40+
}
2241

23-
rate_limit = 100
42+
statement {
43+
managed_rule_group_statement {
44+
name = "AWSManagedRulesCommonRuleSet"
45+
vendor_name = "AWS"
46+
}
47+
}
2448

25-
predicate {
26-
type = "ByteMatch"
27-
data_id = aws_wafregional_byte_match_set.key_submission_claim_key_uri.id
28-
negated = false
49+
visibility_config {
50+
cloudwatch_metrics_enabled = true
51+
metric_name = "AWSManagedRulesCommonRuleSet"
52+
sampled_requests_enabled = true
53+
}
2954
}
30-
}
3155

32-
###
33-
# AWS WAF - Key Submission - /new-key-claim
34-
###
56+
rule {
57+
name = "AWSManagedRulesKnownBadInputsRuleSet"
58+
priority = 3
59+
60+
override_action {
61+
none {}
62+
}
3563

36-
resource "aws_wafregional_byte_match_set" "key_submission_new_key_claim_uri" {
37-
name = "KeySubmissionNewKeyClaimURI"
38-
byte_match_tuples {
39-
text_transformation = "NONE"
40-
target_string = "/new-key-claim"
41-
positional_constraint = "CONTAINS"
64+
statement {
65+
managed_rule_group_statement {
66+
name = "AWSManagedRulesKnownBadInputsRuleSet"
67+
vendor_name = "AWS"
68+
}
69+
}
4270

43-
field_to_match {
44-
type = "URI"
71+
visibility_config {
72+
cloudwatch_metrics_enabled = true
73+
metric_name = "AWSManagedRulesKnownBadInputsRuleSet"
74+
sampled_requests_enabled = true
4575
}
4676
}
47-
}
4877

49-
resource "aws_wafregional_byte_match_set" "key_submission_authorization_header" {
50-
name = "KeySubmissionAuthorizationHeader"
51-
byte_match_tuples {
52-
text_transformation = "NONE"
53-
target_string = "Bearer"
54-
positional_constraint = "CONTAINS"
78+
rule {
79+
name = "AWSManagedRulesLinuxRuleSet"
80+
priority = 4
81+
82+
override_action {
83+
none {}
84+
}
85+
86+
statement {
87+
managed_rule_group_statement {
88+
name = "AWSManagedRulesLinuxRuleSet"
89+
vendor_name = "AWS"
90+
}
91+
}
5592

56-
field_to_match {
57-
type = "HEADER"
58-
data = "authorization"
93+
visibility_config {
94+
cloudwatch_metrics_enabled = true
95+
metric_name = "AWSManagedRulesLinuxRuleSet"
96+
sampled_requests_enabled = true
5997
}
6098
}
61-
}
6299

63-
resource "aws_wafregional_rule" "key_submission_new_key_claim_authorization_header" {
64-
name = "KeySubmissionNewKeyClaimURIMissingAuthorizationHeader"
65-
metric_name = "KeySubmissionNewKeyClaimURIMissingAuthorizationHeader"
100+
rule {
101+
name = "AWSManagedRulesSQLiRuleSet"
102+
priority = 5
66103

67-
predicate {
68-
type = "ByteMatch"
69-
data_id = aws_wafregional_byte_match_set.key_submission_authorization_header.id
70-
negated = true
71-
}
72-
predicate {
73-
type = "ByteMatch"
74-
data_id = aws_wafregional_byte_match_set.key_submission_new_key_claim_uri.id
75-
negated = false
104+
override_action {
105+
none {}
106+
}
107+
108+
statement {
109+
managed_rule_group_statement {
110+
name = "AWSManagedRulesSQLiRuleSet"
111+
vendor_name = "AWS"
112+
}
113+
}
114+
115+
visibility_config {
116+
cloudwatch_metrics_enabled = true
117+
metric_name = "AWSManagedRulesSQLiRuleSet"
118+
sampled_requests_enabled = true
119+
}
76120
}
77-
}
78121

79-
###
80-
# AWS WAF ACL - Key Submission
81-
###
122+
rule {
123+
name = "KeySubmissionClaimKeyURIRateLimit"
124+
priority = 100
82125

83-
resource "aws_wafregional_web_acl" "key_submission" {
84-
name = "KeySubmission"
85-
metric_name = "KeySubmission"
126+
action {
127+
block {}
128+
}
86129

87-
default_action {
88-
type = "ALLOW"
130+
statement {
131+
rate_based_statement {
132+
limit = 100
133+
aggregate_key_type = "IP"
134+
scope_down_statement {
135+
byte_match_statement {
136+
positional_constraint = "EXACTLY"
137+
field_to_match {
138+
uri_path {}
139+
}
140+
search_string = "/claim-key"
141+
text_transformation {
142+
priority = 1
143+
type = "COMPRESS_WHITE_SPACE"
144+
}
145+
text_transformation {
146+
priority = 2
147+
type = "LOWERCASE"
148+
}
149+
}
150+
}
151+
}
152+
}
153+
154+
visibility_config {
155+
cloudwatch_metrics_enabled = true
156+
metric_name = "KeySubmissionClaimKeyURIRateLimit"
157+
sampled_requests_enabled = true
158+
}
89159
}
90160

91161
rule {
92-
type = "RATE_BASED"
93-
priority = 1
94-
rule_id = aws_wafregional_rate_based_rule.key_submission_claim_key_uri.id
162+
name = "KeySubmissionURIs"
163+
priority = 200
164+
95165
action {
96-
type = "BLOCK"
166+
allow {}
167+
}
168+
169+
statement {
170+
or_statement {
171+
statement {
172+
byte_match_statement {
173+
positional_constraint = "STARTS_WITH"
174+
field_to_match {
175+
uri_path {}
176+
}
177+
search_string = "/services/"
178+
text_transformation {
179+
priority = 1
180+
type = "COMPRESS_WHITE_SPACE"
181+
}
182+
text_transformation {
183+
priority = 2
184+
type = "LOWERCASE"
185+
}
186+
}
187+
}
188+
statement {
189+
byte_match_statement {
190+
positional_constraint = "STARTS_WITH"
191+
field_to_match {
192+
uri_path {}
193+
}
194+
search_string = "/exposure-configuration/"
195+
text_transformation {
196+
priority = 1
197+
type = "COMPRESS_WHITE_SPACE"
198+
}
199+
text_transformation {
200+
priority = 2
201+
type = "LOWERCASE"
202+
}
203+
}
204+
}
205+
statement {
206+
byte_match_statement {
207+
positional_constraint = "EXACTLY"
208+
field_to_match {
209+
uri_path {}
210+
}
211+
search_string = "/upload"
212+
text_transformation {
213+
priority = 1
214+
type = "COMPRESS_WHITE_SPACE"
215+
}
216+
text_transformation {
217+
priority = 2
218+
type = "LOWERCASE"
219+
}
220+
}
221+
}
222+
statement {
223+
byte_match_statement {
224+
positional_constraint = "EXACTLY"
225+
field_to_match {
226+
uri_path {}
227+
}
228+
search_string = "/claim-key"
229+
text_transformation {
230+
priority = 1
231+
type = "COMPRESS_WHITE_SPACE"
232+
}
233+
text_transformation {
234+
priority = 2
235+
type = "LOWERCASE"
236+
}
237+
}
238+
}
239+
}
240+
}
241+
242+
visibility_config {
243+
cloudwatch_metrics_enabled = true
244+
metric_name = "KeySubmissionURIs"
245+
sampled_requests_enabled = false
97246
}
98247
}
99248

100249
rule {
101-
type = "REGULAR"
102-
priority = 2
103-
rule_id = aws_wafregional_rule.key_submission_new_key_claim_authorization_header.id
250+
name = "NewKeyClaimURI"
251+
priority = 201
252+
104253
action {
105-
type = "BLOCK"
254+
allow {}
255+
}
256+
257+
statement {
258+
and_statement {
259+
statement {
260+
byte_match_statement {
261+
positional_constraint = "STARTS_WITH"
262+
field_to_match {
263+
uri_path {}
264+
}
265+
search_string = "/new-key-claim"
266+
text_transformation {
267+
priority = 1
268+
type = "COMPRESS_WHITE_SPACE"
269+
}
270+
text_transformation {
271+
priority = 2
272+
type = "LOWERCASE"
273+
}
274+
}
275+
}
276+
statement {
277+
byte_match_statement {
278+
positional_constraint = "STARTS_WITH"
279+
field_to_match {
280+
single_header {
281+
name = "authorization"
282+
}
283+
}
284+
search_string = "Bearer"
285+
text_transformation {
286+
priority = 1
287+
type = "NONE"
288+
}
289+
}
290+
}
291+
}
106292
}
293+
294+
visibility_config {
295+
cloudwatch_metrics_enabled = true
296+
metric_name = "NewKeyClaimURI"
297+
sampled_requests_enabled = false
298+
}
299+
}
300+
301+
tags = {
302+
(var.billing_tag_key) = var.billing_tag_value
303+
}
304+
305+
visibility_config {
306+
cloudwatch_metrics_enabled = true
307+
metric_name = "key_submission"
308+
sampled_requests_enabled = false
107309
}
108310
}
109311

110-
resource "aws_wafregional_web_acl_association" "key_submission" {
312+
###
313+
# AWS WAF - Resource Assocation
314+
###
315+
resource "aws_wafv2_web_acl_association" "key_submission_assocation" {
111316
resource_arn = aws_lb.covidshield_key_submission.arn
112-
web_acl_id = aws_wafregional_web_acl.key_submission.id
317+
web_acl_arn = aws_wafv2_web_acl.key_submission.arn
113318
}

0 commit comments

Comments
 (0)