deprem-yardim-cloud-infra/aws_waf.tf at main · acikyazilimagi/deprem-yardim-cloud-infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
locals {
  aws_managed_waf_rules = [
    # "AWSManagedRulesAmazonIpReputationList",
    # "AWSManagedRulesAnonymousIpList",
    # "AWSManagedRulesCommonRuleSet",
    # "AWSManagedRulesKnownBadInputsRuleSet",
    # "AWSManagedRulesLinuxRuleSet",
    # "AWSManagedRulesPHPRuleSet",
    # "AWSManagedRulesAdminProtectionRuleSet"
  ]
}

resource "aws_wafv2_ip_set" "trusted_ip" {
  name               = "trusted-ip"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  addresses          = ["188.119.10.85/32"]
}

resource "aws_wafv2_web_acl" "generic" {
  name        = "waf-generic"
  description = "waf for all resources"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "rate-limit"
    priority = 0

    statement {
      rate_based_statement {
        limit              = 300
        aggregate_key_type = "FORWARDED_IP"
        scope_down_statement {
          not_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.trusted_ip.arn
                ip_set_forwarded_ip_config {
                  header_name       = "CF-Connecting-IP"
                  fallback_behavior = "MATCH"
                  position          = "ANY"
                }
              }
            }
          }
        }

        forwarded_ip_config {
          header_name       = "CF-Connecting-IP"
          fallback_behavior = "MATCH"
        }
      }
    }

    action {
      #captcha {}
      count {}
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "rate-limit"
      sampled_requests_enabled   = true
    }
  }

  dynamic "rule" {
    for_each = local.aws_managed_waf_rules

    content {
      name     = "AWS-${rule.value}"
      priority = rule.key + 1

      override_action {
        none {}
      }

      statement {
        managed_rule_group_statement {
          name        = rule.value
          vendor_name = "AWS"
        }
      }

      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = "AWS-${rule.value}"
        sampled_requests_enabled   = true
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "waf-generic"
    sampled_requests_enabled   = true
  }
}