feat(terraform): add the Azure waf module

[justin-tahara]

Stacked PR 6 of 7. Each PR targets the branch below it, so GitHub retargets the next one to main as each merges. Review and merge bottom-up.

1. feat(terraform): add the Azure vnet module #14099 — vnet, network, subnets, NAT gateway
2. feat(terraform): add the Azure storage module #14100 — storage, storage account + container
3. feat(terraform): add the Azure postgres module #14101 — postgres, flexible server + alerts
4. feat(terraform): add the Azure redis module #14102 — redis, cache + private endpoint
5. feat(terraform): add the Azure aks module #14103 — aks, cluster + workload identity
6. feat(terraform): add the Azure waf module #14104 — waf, regional WAF policy ← this PR
7. feat(terraform): add the Azure onyx composition and README #14105 — onyx, composition + README

Description

Mirrors deployment/terraform/modules/aws/waf. The policy is regional — the same scope the AWS web ACL uses — and attaches to an Application Gateway or a Front Door route.

The rule inventory collapses. Where AWS composes four managed rule groups, the OWASP Core Rule Set covers the common, known-bad-inputs and SQL injection groups on its own, and the Microsoft bot manager set stands in for the anonymous IP list. Two rate limits and the optional allowlist and geo block stay as custom rules, counting per client address over five minutes as before.

Three differences to know when reading this against the AWS module:

• Detection mode replaces overriding every managed rule to COUNT, and is the way to see what a new policy would do before it does it. Individual rules still have overrides, but Azure identifies them by group and numeric id rather than by name, so the flat list is regrouped in the module.
• Rate limit exemptions are a second, negated match condition rather than a scope-down statement. Conditions on a rule are combined with AND, so the effect is the same.
• There is no log group here. Azure emits WAF logs from the Application Gateway or Front Door the policy attaches to, so the diagnostic setting belongs on that resource rather than on the policy.

How Has This Been Tested?

cd deployment/terraform/modules/azure/waf
terraform init -backend=false && terraform test
# Success! 11 passed, 0 failed.

The suite covers rule priority ordering, the negated allowlist condition, the exemption landing on both rate limits, regrouping a flat override list into nested group overrides, and three input validations.

terraform validate and the repo's terraform hooks pass. Not applied against a live subscription.

Additional Options

• [Optional] Please cherry-pick this PR to the latest release version.
• [Optional] Override Linear Check

---

Changes from review (greptile, cubic)

• Overrides are validated against the rule sets actually on the policy. An override naming an unknown rule_set_type, or targeting the bot manager set while enable_bot_protection is false, was silently dropped — leaving the rule doing exactly what the operator meant to change. Both are now rejected at plan.
• Front Door references removed. This resource is an Application Gateway WAF policy; Front Door uses azurerm_cdn_frontdoor_firewall_policy and cannot take this one. The output description now says so rather than pointing people at an integration that does not exist.

Tests: 11 → 14.

Round 2

• Rule group names are now validated against the set that carries them. An OWASP group paired with the bot rule set, or a misspelled group, produced a group override Azure accepts and never applies. cubic offered documentation as an acceptable fallback; validating is better, and the group lists are in the variable description too.

Tests: 14 → 16.

[greptile-apps]

Greptile Summary

The PR adds a regional Azure Application Gateway WAF policy module mirroring the AWS WAF module.

• Configures OWASP and optional Microsoft bot-management rules.
• Adds allowlist, geographic blocking, and per-client rate limits.
• Validates managed-rule overrides and documents the policy’s Application Gateway-only compatibility.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
deployment/terraform/modules/azure/waf/main.tf	Defines the WAF policy, managed-rule override grouping, optional access restrictions, and two client-address rate limits without leaving either previously reported issue outstanding.
deployment/terraform/modules/azure/waf/variables.tf	Defines typed inputs and plan-time validation that rejects overrides targeting unsupported or disabled managed rule sets.
deployment/terraform/modules/azure/waf/outputs.tf	Exposes the Application Gateway WAF policy identity and now accurately excludes Front Door compatibility.
deployment/terraform/modules/azure/waf/tests/waf.tftest.hcl	Covers defaults, custom-rule behavior, override grouping, and rejection of the previously silent override configurations.
deployment/terraform/modules/azure/waf/versions.tf	Requires Terraform 1.12 or newer and AzureRM provider 4.x.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Input[Module inputs] --> Validation[Input validation]
  Validation --> Policy[Application Gateway WAF policy]
  Policy --> Managed[OWASP and optional Bot Manager rules]
  Policy --> Custom[Allowlist, geo block, and rate limits]
  Policy --> Output[Policy ID and mode outputs]
  Output --> Gateway[Application Gateway attachment]

Loading

_{Reviews (2): Last reviewed commit: "feat(terraform): add the Azure waf modul..." | Re-trigger Greptile}

[cubic-dev-ai]

2 issues found across 5 files

Confidence score: 3/5

• In deployment/terraform/modules/azure/waf/main.tf, overrides for unsupported or disabled rule sets are silently ignored, leaving the managed rule unchanged; validate every override target and fail when it cannot be applied.
• In deployment/terraform/modules/azure/waf/outputs.tf, the resource is an Application Gateway WAF policy but is described as a Front Door firewall policy, which can mislead users about what is provisioned; correct the description or add separate Front Door configuration.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="deployment/terraform/modules/azure/waf/main.tf">

<violation number="1" location="deployment/terraform/modules/azure/waf/main.tf:44">
P2: When an override targets an unsupported or disabled rule set, this `try` silently drops it and leaves the managed rule unchanged. Validate every override target and fail when an override cannot be applied.</violation>
</file>

<file name="deployment/terraform/modules/azure/waf/outputs.tf">

<violation number="1" location="deployment/terraform/modules/azure/waf/outputs.tf:2">
P2: This resource creates an Application Gateway WAF policy, not a Front Door firewall policy. Remove Front Door from this description or provide a separate Front Door firewall and security-policy configuration.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Preview Deployment

Status	Preview	Commit	Updated
✅	https://onyx-preview-aj3lnvdgj-danswer.vercel.app	ff4d726	2026-08-20 21:10:44 UTC