feat(terraform): add the Azure waf module

Mirrors deployment/terraform/modules/aws/waf. The policy is regional, the same
scope the AWS web ACL uses, and attaches to an Application Gateway or a Front
Door route.

The rule inventory collapses. Where AWS composes four managed rule groups, the
OWASP Core Rule Set covers the common, known-bad-inputs and SQL injection
groups on its own, and the Microsoft bot manager set stands in for the
anonymous IP list. Two rate limits and the optional allowlist and geo block
stay as custom rules, counting per client address over five minutes as before.

Three differences to know when reading this against the AWS module:

- Detection mode replaces overriding every managed rule to COUNT, and is the
  way to see what a new policy would do before it does it. Individual rules
  still have overrides, but Azure identifies them by group and numeric id
  rather than by name.
- Rate limit exemptions are a second, negated match condition rather than a
  scope-down statement. Conditions on a rule are combined with AND, so the
  effect is the same.
- There is no log group here. Azure emits WAF logs from the Application Gateway
  or Front Door the policy attaches to, so the diagnostic setting belongs on
  that resource rather than on the policy.

Author: justin-tahara

deployment/terraform/modules/azure/waf/main.tf

@@ -0,0 +1,161 @@
+locals {
+  ip_allowlist_enabled      = length(var.allowed_ip_cidrs) > 0
+  rate_limit_exempt_enabled = length(var.rate_limit_exempt_ip_cidrs) > 0
+  geo_restriction_enabled   = length(var.geo_restriction_countries) > 0
+
+  managed_rule_sets = concat(
+    [{ type = "OWASP", version = var.owasp_rule_set_version }],
+    var.enable_bot_protection ? [{ type = "Microsoft_BotManagerRuleSet", version = var.bot_manager_rule_set_version }] : [],
+  )
+
+  # The overrides arrive as a flat list but the provider nests them by rule set
+  # and then by rule group, so regroup them once here.
+  overrides_by_set = {
+    for set_type in distinct([for o in var.managed_rule_overrides : o.rule_set_type]) :
+    set_type => {
+      for group_name in distinct([for o in var.managed_rule_overrides : o.rule_group_name if o.rule_set_type == set_type]) :
+      group_name => [for o in var.managed_rule_overrides : o if o.rule_set_type == set_type && o.rule_group_name == group_name]
+    }
+  }
+}
+
+resource "azurerm_web_application_firewall_policy" "this" {
+  name                = "${var.name}-waf"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  tags                = var.tags
+
+  policy_settings {
+    enabled                     = true
+    mode                        = var.mode
+    request_body_check          = true
+    max_request_body_size_in_kb = var.max_request_body_size_in_kb
+    file_upload_limit_in_mb     = var.file_upload_limit_in_mb
+  }
+
+  managed_rules {
+    dynamic "managed_rule_set" {
+      for_each = local.managed_rule_sets
+      content {
+        type    = managed_rule_set.value.type
+        version = managed_rule_set.value.version
+
+        dynamic "rule_group_override" {
+          for_each = try(local.overrides_by_set[managed_rule_set.value.type], {})
+          content {
+            rule_group_name = rule_group_override.key
+
+            dynamic "rule" {
+              for_each = rule_group_override.value
+              content {
+                id      = rule.value.rule_id
+                action  = rule.value.action
+                enabled = rule.value.enabled
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  # Anything not on the allowlist is refused before the managed rules run.
+  dynamic "custom_rules" {
+    for_each = local.ip_allowlist_enabled ? [1] : []
+    content {
+      name      = "BlockRequestsOutsideAllowedIPs"
+      priority  = 1
+      rule_type = "MatchRule"
+      action    = "Block"
+
+      match_conditions {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.allowed_ip_cidrs
+      }
+    }
+  }
+
+  dynamic "custom_rules" {
+    for_each = local.geo_restriction_enabled ? [1] : []
+    content {
+      name      = "BlockRestrictedCountries"
+      priority  = 10
+      rule_type = "MatchRule"
+      action    = "Block"
+
+      match_conditions {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator     = "GeoMatch"
+        match_values = var.geo_restriction_countries
+      }
+    }
+  }
+
+  # Match conditions on a rule are combined with AND, so the negated exempt
+  # list is what keeps the limit from applying to those addresses.
+  custom_rules {
+    name                 = "ApiRateLimit"
+    priority             = 20
+    rule_type            = "RateLimitRule"
+    action               = "Block"
+    rate_limit_duration  = "FiveMins"
+    rate_limit_threshold = var.api_rate_limit_requests_per_5_minutes
+    group_rate_limit_by  = "ClientAddr"
+
+    match_conditions {
+      match_variables {
+        variable_name = "RequestUri"
+      }
+      operator     = "BeginsWith"
+      match_values = [var.api_path_prefix]
+    }
+
+    dynamic "match_conditions" {
+      for_each = local.rate_limit_exempt_enabled ? [1] : []
+      content {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.rate_limit_exempt_ip_cidrs
+      }
+    }
+  }
+
+  custom_rules {
+    name                 = "GlobalRateLimit"
+    priority             = 30
+    rule_type            = "RateLimitRule"
+    action               = "Block"
+    rate_limit_duration  = "FiveMins"
+    rate_limit_threshold = var.rate_limit_requests_per_5_minutes
+    group_rate_limit_by  = "ClientAddr"
+
+    match_conditions {
+      match_variables {
+        variable_name = "RemoteAddr"
+      }
+      operator     = "IPMatch"
+      match_values = ["0.0.0.0/0", "::/0"]
+    }
+
+    dynamic "match_conditions" {
+      for_each = local.rate_limit_exempt_enabled ? [1] : []
+      content {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.rate_limit_exempt_ip_cidrs
+      }
+    }
+  }
+}

deployment/terraform/modules/azure/waf/outputs.tf

@@ -0,0 +1,17 @@
+output "policy_id" {
+  description = "Resource ID of the WAF policy. Attach it to an Application Gateway. Front Door uses a different resource, azurerm_cdn_frontdoor_firewall_policy, and cannot take this one."
+  value       = azurerm_web_application_firewall_policy.this.id
+}
+
+output "policy_name" {
+  description = "Name of the WAF policy"
+  value       = azurerm_web_application_firewall_policy.this.name
+}
+
+# Unlike the AWS module there is no log group here. Azure emits WAF logs from
+# the Application Gateway the policy is attached to, so the diagnostic setting
+# belongs on that resource.
+output "mode" {
+  description = "Whether the policy blocks matches or only logs them"
+  value       = var.mode
+}