feat(terraform): add the Azure waf module

Mirrors deployment/terraform/modules/aws/waf. The policy is regional, the same
scope the AWS web ACL uses, and attaches to an Application Gateway or a Front
Door route.

The rule inventory collapses. Where AWS composes four managed rule groups, the
OWASP Core Rule Set covers the common, known-bad-inputs and SQL injection
groups on its own, and the Microsoft bot manager set stands in for the
anonymous IP list. Two rate limits and the optional allowlist and geo block
stay as custom rules, counting per client address over five minutes as before.

Three differences to know when reading this against the AWS module:

- Detection mode replaces overriding every managed rule to COUNT, and is the
  way to see what a new policy would do before it does it. Individual rules
  still have overrides, but Azure identifies them by group and numeric id
  rather than by name.
- Rate limit exemptions are a second, negated match condition rather than a
  scope-down statement. Conditions on a rule are combined with AND, so the
  effect is the same.
- There is no log group here. Azure emits WAF logs from the Application Gateway
  or Front Door the policy attaches to, so the diagnostic setting belongs on
  that resource rather than on the policy.

Author: justin-tahara

deployment/terraform/modules/azure/waf/main.tf

@@ -0,0 +1,161 @@
+locals {
+  ip_allowlist_enabled      = length(var.allowed_ip_cidrs) > 0
+  rate_limit_exempt_enabled = length(var.rate_limit_exempt_ip_cidrs) > 0
+  geo_restriction_enabled   = length(var.geo_restriction_countries) > 0
+
+  managed_rule_sets = concat(
+    [{ type = "OWASP", version = var.owasp_rule_set_version }],
+    var.enable_bot_protection ? [{ type = "Microsoft_BotManagerRuleSet", version = var.bot_manager_rule_set_version }] : [],
+  )
+
+  # The overrides arrive as a flat list but the provider nests them by rule set
+  # and then by rule group, so regroup them once here.
+  overrides_by_set = {
+    for set_type in distinct([for o in var.managed_rule_overrides : o.rule_set_type]) :
+    set_type => {
+      for group_name in distinct([for o in var.managed_rule_overrides : o.rule_group_name if o.rule_set_type == set_type]) :
+      group_name => [for o in var.managed_rule_overrides : o if o.rule_set_type == set_type && o.rule_group_name == group_name]
+    }
+  }
+}
+
+resource "azurerm_web_application_firewall_policy" "this" {
+  name                = "${var.name}-waf"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  tags                = var.tags
+
+  policy_settings {
+    enabled                     = true
+    mode                        = var.mode
+    request_body_check          = true
+    max_request_body_size_in_kb = var.max_request_body_size_in_kb
+    file_upload_limit_in_mb     = var.file_upload_limit_in_mb
+  }
+
+  managed_rules {
+    dynamic "managed_rule_set" {
+      for_each = local.managed_rule_sets
+      content {
+        type    = managed_rule_set.value.type
+        version = managed_rule_set.value.version
+
+        dynamic "rule_group_override" {
+          for_each = try(local.overrides_by_set[managed_rule_set.value.type], {})
+          content {
+            rule_group_name = rule_group_override.key
+
+            dynamic "rule" {
+              for_each = rule_group_override.value
+              content {
+                id      = rule.value.rule_id
+                action  = rule.value.action
+                enabled = rule.value.enabled
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  # Anything not on the allowlist is refused before the managed rules run.
+  dynamic "custom_rules" {
+    for_each = local.ip_allowlist_enabled ? [1] : []
+    content {
+      name      = "BlockRequestsOutsideAllowedIPs"
+      priority  = 1
+      rule_type = "MatchRule"
+      action    = "Block"
+
+      match_conditions {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.allowed_ip_cidrs
+      }
+    }
+  }
+
+  dynamic "custom_rules" {
+    for_each = local.geo_restriction_enabled ? [1] : []
+    content {
+      name      = "BlockRestrictedCountries"
+      priority  = 10
+      rule_type = "MatchRule"
+      action    = "Block"
+
+      match_conditions {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator     = "GeoMatch"
+        match_values = var.geo_restriction_countries
+      }
+    }
+  }
+
+  # Match conditions on a rule are combined with AND, so the negated exempt
+  # list is what keeps the limit from applying to those addresses.
+  custom_rules {
+    name                 = "ApiRateLimit"
+    priority             = 20
+    rule_type            = "RateLimitRule"
+    action               = "Block"
+    rate_limit_duration  = "FiveMins"
+    rate_limit_threshold = var.api_rate_limit_requests_per_5_minutes
+    group_rate_limit_by  = "ClientAddr"
+
+    match_conditions {
+      match_variables {
+        variable_name = "RequestUri"
+      }
+      operator     = "BeginsWith"
+      match_values = [var.api_path_prefix]
+    }
+
+    dynamic "match_conditions" {
+      for_each = local.rate_limit_exempt_enabled ? [1] : []
+      content {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.rate_limit_exempt_ip_cidrs
+      }
+    }
+  }
+
+  custom_rules {
+    name                 = "GlobalRateLimit"
+    priority             = 30
+    rule_type            = "RateLimitRule"
+    action               = "Block"
+    rate_limit_duration  = "FiveMins"
+    rate_limit_threshold = var.rate_limit_requests_per_5_minutes
+    group_rate_limit_by  = "ClientAddr"
+
+    match_conditions {
+      match_variables {
+        variable_name = "RemoteAddr"
+      }
+      operator     = "IPMatch"
+      match_values = ["0.0.0.0/0", "::/0"]
+    }
+
+    dynamic "match_conditions" {
+      for_each = local.rate_limit_exempt_enabled ? [1] : []
+      content {
+        match_variables {
+          variable_name = "RemoteAddr"
+        }
+        operator           = "IPMatch"
+        negation_condition = true
+        match_values       = var.rate_limit_exempt_ip_cidrs
+      }
+    }
+  }
+}

deployment/terraform/modules/azure/waf/outputs.tf

@@ -0,0 +1,17 @@
+output "policy_id" {
+  description = "Resource ID of the WAF policy. Attach it to an Application Gateway, or to a Front Door route."
+  value       = azurerm_web_application_firewall_policy.this.id
+}
+
+output "policy_name" {
+  description = "Name of the WAF policy"
+  value       = azurerm_web_application_firewall_policy.this.name
+}
+
+# Unlike the AWS module there is no log group here. Azure emits WAF logs from
+# the Application Gateway or Front Door the policy is attached to, so the
+# diagnostic setting belongs on that resource.
+output "mode" {
+  description = "Whether the policy blocks matches or only logs them"
+  value       = var.mode
+}

deployment/terraform/modules/azure/waf/tests/waf.tftest.hcl

@@ -0,0 +1,198 @@
+# Plans the module against a mocked provider, so these run without an Azure
+# subscription or credentials. Run with `terraform test` from the module directory.
+
+mock_provider "azurerm" {}
+
+variables {
+  name                = "onyx"
+  resource_group_name = "onyx-rg"
+  location            = "eastus"
+}
+
+run "defaults_block_and_carry_both_rule_sets" {
+  command = plan
+
+  assert {
+    condition     = one(azurerm_web_application_firewall_policy.this.policy_settings).mode == "Prevention"
+    error_message = "The policy should block what it matches by default."
+  }
+
+  assert {
+    condition     = length(one(azurerm_web_application_firewall_policy.this.managed_rules).managed_rule_set) == 2
+    error_message = "OWASP plus the bot manager set should both be present by default."
+  }
+
+  assert {
+    condition     = one(azurerm_web_application_firewall_policy.this.managed_rules).managed_rule_set[0].type == "OWASP"
+    error_message = "The OWASP set covers what the AWS module gets from its common, known-bad-inputs and SQLi groups."
+  }
+}
+
+run "only_the_two_rate_limits_exist_by_default" {
+  command = plan
+
+  assert {
+    condition     = length(azurerm_web_application_firewall_policy.this.custom_rules) == 2
+    error_message = "With no allowlist and no geo blocking, only the two rate limits should exist."
+  }
+
+  assert {
+    condition = alltrue([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      r.rate_limit_duration == "FiveMins"
+    ])
+    error_message = "The AWS module counts requests per five minutes, so these should too."
+  }
+
+  assert {
+    condition = alltrue([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      r.group_rate_limit_by == "ClientAddr"
+    ])
+    error_message = "Rate limits should count per client address, matching the AWS aggregate key of IP."
+  }
+}
+
+run "an_allowlist_blocks_everything_outside_it_first" {
+  command = plan
+
+  variables {
+    allowed_ip_cidrs = ["203.0.113.0/24"]
+  }
+
+  assert {
+    condition     = length(azurerm_web_application_firewall_policy.this.custom_rules) == 3
+    error_message = "The allowlist rule should be added to the two rate limits."
+  }
+
+  assert {
+    condition = one([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      r.priority if r.name == "BlockRequestsOutsideAllowedIPs"
+    ]) == 1
+    error_message = "The allowlist must be evaluated before anything else."
+  }
+
+  assert {
+    condition = one([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      r.match_conditions[0].negation_condition if r.name == "BlockRequestsOutsideAllowedIPs"
+    ]) == true
+    error_message = "The rule blocks addresses that are NOT on the list, so the condition has to be negated."
+  }
+}
+
+run "exempt_ranges_add_a_negated_condition_to_each_limit" {
+  command = plan
+
+  variables {
+    rate_limit_exempt_ip_cidrs = ["203.0.113.0/24"]
+  }
+
+  assert {
+    condition = alltrue([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      length(r.match_conditions) == 2 if r.rule_type == "RateLimitRule"
+    ])
+    error_message = "Conditions are combined with AND, so the exemption is a second, negated condition on each limit."
+  }
+}
+
+run "geo_blocking_adds_a_rule" {
+  command = plan
+
+  variables {
+    geo_restriction_countries = ["KP"]
+  }
+
+  assert {
+    condition = one([
+      for r in azurerm_web_application_firewall_policy.this.custom_rules :
+      r.match_conditions[0].operator if r.name == "BlockRestrictedCountries"
+    ]) == "GeoMatch"
+    error_message = "Country blocking uses the GeoMatch operator."
+  }
+}
+
+run "detection_mode_stops_blocking" {
+  command = plan
+
+  variables {
+    mode = "Detection"
+  }
+
+  assert {
+    condition     = one(azurerm_web_application_firewall_policy.this.policy_settings).mode == "Detection"
+    error_message = "Detection is the whole-policy equivalent of overriding every AWS managed rule to COUNT."
+  }
+}
+
+run "bot_protection_can_be_dropped" {
+  command = plan
+
+  variables {
+    enable_bot_protection = false
+  }
+
+  assert {
+    condition     = length(one(azurerm_web_application_firewall_policy.this.managed_rules).managed_rule_set) == 1
+    error_message = "Turning off bot protection should leave only the OWASP set."
+  }
+}
+
+run "overrides_are_regrouped_under_their_rule_set" {
+  command = plan
+
+  variables {
+    managed_rule_overrides = [
+      { rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI", rule_id = "942100", action = "Log" },
+      { rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI", rule_id = "942200", action = "Log" },
+      { rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT", rule_id = "920300", enabled = false },
+    ]
+  }
+
+  assert {
+    condition     = length(one(azurerm_web_application_firewall_policy.this.managed_rules).managed_rule_set[0].rule_group_override) == 2
+    error_message = "Three overrides across two groups should nest into two group overrides."
+  }
+
+  assert {
+    condition = length(one([
+      for g in one(azurerm_web_application_firewall_policy.this.managed_rules).managed_rule_set[0].rule_group_override :
+      g.rule if g.rule_group_name == "REQUEST-942-APPLICATION-ATTACK-SQLI"
+    ])) == 2
+    error_message = "Both SQLi overrides should land in the same group."
+  }
+}
+
+run "rejects_an_action_azure_does_not_have" {
+  command = plan
+
+  variables {
+    managed_rule_overrides = [
+      { rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI", rule_id = "942100", action = "Count" },
+    ]
+  }
+
+  expect_failures = [var.managed_rule_overrides]
+}
+
+run "rejects_a_country_code_that_is_not_one" {
+  command = plan
+
+  variables {
+    geo_restriction_countries = ["Korea"]
+  }
+
+  expect_failures = [var.geo_restriction_countries]
+}
+
+run "rejects_an_upload_limit_azure_would_reject" {
+  command = plan
+
+  variables {
+    file_upload_limit_in_mb = 5000
+  }
+
+  expect_failures = [var.file_upload_limit_in_mb]
+}