Merge pull request #28 from citizensadvice/add-waf-rule-templates

Add WAFv2 rule templates and builder class

Author: MatthewCane

README.md

@@ -56,128 +56,9 @@ CrossAccountDomainDelegation(
 ### Edge services
 
 <details>
-    <summary>Web Application Firewall</summary>
+    <summary>WAF Rule Templates</summary>
 
-Deploys AWS WAF using a vendored
-[AWS WAF Security Automations v3.2.0](https://github.com/awslabs/aws-waf-security-automations/tree/v3.2.0)
-template, with the addition of the AWS Managed `KnownBadInputs` Rule (to protect specifically
-against the `log4j` vulnerability). It also allows for the addition of any additional user-defined
-custom rules, by supplying a list of one or more `CfnWebACL.RuleProperty`. TO NOTE: these may
-incur additional costs, if they take the total number of `WCUs` for the WAF above `1500`.
-
-In able to accommodate custom rules, and because of the limitations on working with imported
-nested templates with the CDK, the WAF provides a fixed set of standard rules - which is NOT
-parameterised in the `ProtectedCloudfront` construct. In order to vary the rules (e.g. add
-more of the standard rules, override any rules to COUNT, etc) you will need to copy the
-construct code to your config repo and make the amendments directly in the construct and
-template(s):
-
-`SQL injection rule` - `BLOCK`
-
-`Cross-site scripting rule` - `BLOCK`
-
-`Flood protection rule` - `BLOCK`. A simple rate based rule, which blocks an individual IP
-address if average requests over a 5-minute period from that IP address exceed a user-supplied
-`RequestThreshold` and unblocks once they fall below this threshold again. CARE!! Given
-that many LCAs work from a fixed single IP address, this should not be set to too low a value.
-
-`Reputation lists rule` - `BLOCK`
-
-For the original WAF configuration options see the "Parameters" section in the
-[original template](ca_cdk_constructs/edge_services/assets/aws-waf-security-automations.json).
-
-Usage:
-
-```python
-from ca_cdk_constructs.edge_services.waf_stack import WafStack
-
-WafStack(app,
-        "Waf",
-        # The waf **MUST** be instantiated with the rule combination here. Only the
-        # flood_protection_threshold and custom_rules can be varied.
-        params={
-            "ActivateAWSManagedRulesParam": "yes",
-            "ActivateSqlInjectionProtectionParam": "yes",
-            "ActivateCrossSiteScriptingProtectionParam": "yes",
-            "ActivateHttpFloodProtectionParam": "yes - AWS WAF rate based rule",
-            "ActivateScannersProbesProtectionParam": "no",
-            "ActivateReputationListsProtectionParam": "yes",
-            "ActivateBadBotProtectionParam": "no",
-            # threshold requests in 5-minute period from any single IP before that
-            # IP is blocked.
-            "RequestThreshold": flood_protection_threshold, # default = 100
-        },
-        custom_rules: <list of aws_cdk.aws_wafv2.CfnWebACL.RuleProperty]> default = [],
-})
-
-```
-
-</details>
-
-<details>
-  <summary>ProtectedCloudfront</summary>
-
-[protected_cloudfront](ca_cdk_constructs/edge_services/protected_cloudfront.py)
-
-Creates a Cloudfront distribution protected by the AWS WAF. The distribution forwards a
-custom header that can be requested by downstream load balancers in order to prevent traffic
-from hitting them directly.
-
-When using this library construct, the only properties of the WAF that can be specified
-are any custom rules to be added on top of the WAF (list of aws_cdk.aws_wafv2.CfnWebACL.RuleProperty)
-
-Usage:
-
-```python
-from aws_cdk import App, Stack
-from aws_cdk.aws_eks import HelmChart
-from ca_cdk_constructs.edge_services.protected_cloudfront import ProtectedCloudfrontStack
-import json
-
-app = App()
-
-hosted_zone =  # create or import a hosted zone
-
-custom_rules = # optionally specify a list of aws_cdk.aws_wafv2.CfnWebACL.RuleProperty
-
-# creates Cloudfront protected by WAF at myapp.<hosted_zone_domain>
-cdn = ProtectedCloudfrontStack(app, "ca-referrals",
-                                    hosted_zone=hosted_zone,
-                                    sub_domain="myapp",
-                                    origin_domain="my-loadbalancer-url"
-                                    custom_rules=custom_rules,
-                                    flood_protection_threshold="2500" # any value >= 100
-                               )
-
-# retrieve the secret header which must be added to the load balancer in order
-# to prevent users bypassing the CDN ( and the WAF )
-cdn.secret_header
-# or
-cdn.SECRET_HEADER_NAME
-# and
-cdn.secret_header_value
-
-# To add the header to e.g. Kubernetes ALB ingress use:
-
-k8s_deployment_stack = Stack(app, "K8sDeployment")
-# add the header to the ALB ingress
-chart_overrides = {
-    "web": {
-        "ingress": {
-            "annotations": {
-                "alb.ingress.kubernetes.io/conditions.main": json.dumps(
-                    [
-                        # other config can go here
-                        cdn.alb_ingress_header_config_annotation
-                    ]
-                )
-            }
-        }
-    }
-}
-
-HelmChart(k8s_deployment_stack, "myapp", cluster=cluster, namespace="myapp-namespace", values=chart_overrides)
-```
+TODO TODO TODO
 
 </details>