Add host_uri_rate_limit_rules to WAF module

Per-IP rate limiting scoped to a Host and optional URI path(s), with a
per-rule EXACTLY/STARTS_WITH match type and configurable limit and
evaluation window. Defaults to {}, so existing consumers are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: OlamideOl1

aws/waf/main.tf

@@ -351,6 +351,144 @@ resource "aws_wafv2_web_acl" "main" {
     }
   }
 
+  dynamic "rule" {
+    for_each = var.host_uri_rate_limit_rules
+    content {
+      name     = "${rule.value["name"]}-host-uri-ratelimit"
+      priority = rule.value["priority"]
+
+      dynamic "action" {
+        for_each = rule.value["count_override"] == true ? [1] : []
+        content {
+          count {}
+        }
+      }
+      dynamic "action" {
+        for_each = rule.value["count_override"] == false ? [1] : []
+        content {
+          block {}
+        }
+      }
+
+      statement {
+        rate_based_statement {
+          limit                 = rule.value["limit"]
+          aggregate_key_type    = "IP"
+          evaluation_window_sec = rule.value["evaluation_window_sec"]
+
+          scope_down_statement {
+            # Whole host (no uri_paths): scope down to the Host header only.
+            dynamic "byte_match_statement" {
+              for_each = length(rule.value["uri_paths"]) == 0 ? [1] : []
+              content {
+                field_to_match {
+                  single_header {
+                    name = "host"
+                  }
+                }
+
+                positional_constraint = "EXACTLY"
+
+                search_string = lower(rule.value["host"])
+
+                text_transformation {
+                  priority = 0
+                  type     = "LOWERCASE"
+                }
+              }
+            }
+
+            # Host + URI: scope down to Host AND one of the given paths.
+            dynamic "and_statement" {
+              for_each = length(rule.value["uri_paths"]) > 0 ? [1] : []
+              content {
+                statement {
+                  byte_match_statement {
+                    field_to_match {
+                      single_header {
+                        name = "host"
+                      }
+                    }
+
+                    positional_constraint = "EXACTLY"
+
+                    search_string = lower(rule.value["host"])
+
+                    text_transformation {
+                      priority = 0
+                      type     = "LOWERCASE"
+                    }
+                  }
+                }
+
+                dynamic "statement" {
+                  for_each = length(rule.value["uri_paths"]) == 1 ? [1] : []
+                  content {
+                    byte_match_statement {
+                      field_to_match {
+                        uri_path {}
+                      }
+
+                      positional_constraint = rule.value["uri_match_type"]
+
+                      search_string = lower(rule.value["uri_paths"][0])
+
+                      text_transformation {
+                        priority = 0
+                        type     = "URL_DECODE"
+                      }
+                      text_transformation {
+                        priority = 1
+                        type     = "LOWERCASE"
+                      }
+                    }
+                  }
+                }
+
+                dynamic "statement" {
+                  for_each = length(rule.value["uri_paths"]) > 1 ? [1] : []
+                  content {
+                    or_statement {
+                      dynamic "statement" {
+                        for_each = rule.value["uri_paths"]
+                        content {
+                          byte_match_statement {
+                            field_to_match {
+                              uri_path {}
+                            }
+
+                            positional_constraint = rule.value["uri_match_type"]
+
+                            search_string = lower(statement.value)
+
+                            text_transformation {
+                              priority = 0
+                              type     = "URL_DECODE"
+                            }
+                            text_transformation {
+                              priority = 1
+                              type     = "LOWERCASE"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        sampled_requests_enabled   = true
+        metric_name                = "${rule.value["name"]}-host-uri-ratelimit"
+      }
+    }
+  }
+
   dynamic "rule" {
     for_each = var.aws_managed_rule_groups
     content {

aws/waf/variables.tf

@@ -83,3 +83,27 @@ variable "host_ip_restriction_rules" {
   }))
   default = {}
 }
+
+variable "host_uri_rate_limit_rules" {
+  description = "Per-IP rate limits scoped to a specific Host and optional URI path(s). Only requests matching the host (and URI, if given) count toward the limit; when an IP exceeds it within the evaluation window the rule action applies."
+  type = map(object({
+    name                  = string                          # Friendly name -> rule name + CloudWatch metric.
+    priority              = number                          # Unique WAF rule priority within the ACL.
+    limit                 = optional(number, 2000)          # Max matching requests per IP per evaluation window (AWS minimum is 10).
+    evaluation_window_sec = optional(number, 300)           # Rate-limit window in seconds. One of 60, 120, 300, 600.
+    host                  = string                          # Exact Host header to scope the rate limit to, e.g. "example.com".
+    uri_paths             = optional(list(string), [])      # URI path(s) to scope the rate limit to. Empty (default) rate-limits the whole host.
+    uri_match_type        = optional(string, "STARTS_WITH") # How to match uri_paths: EXACTLY (pin one endpoint) or STARTS_WITH (prefix).
+    count_override        = optional(bool, false)           # If true, override the action to `count` (dry run). If false (default), the action is `block` when the limit is exceeded.
+  }))
+  default = {}
+
+  validation {
+    condition     = alltrue([for r in values(var.host_uri_rate_limit_rules) : contains(["EXACTLY", "STARTS_WITH"], r.uri_match_type)])
+    error_message = "uri_match_type must be EXACTLY or STARTS_WITH."
+  }
+  validation {
+    condition     = alltrue([for r in values(var.host_uri_rate_limit_rules) : contains([60, 120, 300, 600], r.evaluation_window_sec)])
+    error_message = "evaluation_window_sec must be one of 60, 120, 300, 600."
+  }
+}