Add REGEX match type to host_uri_rate_limit_rules

Lets a rate-limit rule target URI paths with variable segments (e.g.
/api/v1/users/<id>/validation) via WAF regex_match_statement. Regex
patterns are URL-decoded but not lowercased, so character classes and
anchors are preserved; EXACTLY/STARTS_WITH byte matching is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: OlamideOl1

aws/waf/main.tf

@@ -424,22 +424,40 @@ resource "aws_wafv2_web_acl" "main" {
                 dynamic "statement" {
                   for_each = length(rule.value["uri_paths"]) == 1 ? [1] : []
                   content {
-                    byte_match_statement {
-                      field_to_match {
-                        uri_path {}
-                      }
+                    dynamic "byte_match_statement" {
+                      for_each = rule.value["uri_match_type"] == "REGEX" ? [] : [1]
+                      content {
+                        field_to_match {
+                          uri_path {}
+                        }
 
-                      positional_constraint = rule.value["uri_match_type"]
+                        positional_constraint = rule.value["uri_match_type"]
 
-                      search_string = lower(rule.value["uri_paths"][0])
+                        search_string = lower(rule.value["uri_paths"][0])
 
-                      text_transformation {
-                        priority = 0
-                        type     = "URL_DECODE"
+                        text_transformation {
+                          priority = 0
+                          type     = "URL_DECODE"
+                        }
+                        text_transformation {
+                          priority = 1
+                          type     = "LOWERCASE"
+                        }
                       }
-                      text_transformation {
-                        priority = 1
-                        type     = "LOWERCASE"
+                    }
+                    dynamic "regex_match_statement" {
+                      for_each = rule.value["uri_match_type"] == "REGEX" ? [1] : []
+                      content {
+                        field_to_match {
+                          uri_path {}
+                        }
+
+                        regex_string = rule.value["uri_paths"][0]
+
+                        text_transformation {
+                          priority = 0
+                          type     = "URL_DECODE"
+                        }
                       }
                     }
                   }
@@ -452,22 +470,40 @@ resource "aws_wafv2_web_acl" "main" {
                       dynamic "statement" {
                         for_each = rule.value["uri_paths"]
                         content {
-                          byte_match_statement {
-                            field_to_match {
-                              uri_path {}
-                            }
-
-                            positional_constraint = rule.value["uri_match_type"]
-
-                            search_string = lower(statement.value)
-
-                            text_transformation {
-                              priority = 0
-                              type     = "URL_DECODE"
+                          dynamic "byte_match_statement" {
+                            for_each = rule.value["uri_match_type"] == "REGEX" ? [] : [1]
+                            content {
+                              field_to_match {
+                                uri_path {}
+                              }
+
+                              positional_constraint = rule.value["uri_match_type"]
+
+                              search_string = lower(statement.value)
+
+                              text_transformation {
+                                priority = 0
+                                type     = "URL_DECODE"
+                              }
+                              text_transformation {
+                                priority = 1
+                                type     = "LOWERCASE"
+                              }
                             }
-                            text_transformation {
-                              priority = 1
-                              type     = "LOWERCASE"
+                          }
+                          dynamic "regex_match_statement" {
+                            for_each = rule.value["uri_match_type"] == "REGEX" ? [1] : []
+                            content {
+                              field_to_match {
+                                uri_path {}
+                              }
+
+                              regex_string = statement.value
+
+                              text_transformation {
+                                priority = 0
+                                type     = "URL_DECODE"
+                              }
                             }
                           }
                         }

aws/waf/variables.tf

@@ -92,15 +92,15 @@ variable "host_uri_rate_limit_rules" {
     limit                 = optional(number, 2000)          # Max matching requests per IP per evaluation window (AWS minimum is 10).
     evaluation_window_sec = optional(number, 300)           # Rate-limit window in seconds. One of 60, 120, 300, 600.
     host                  = string                          # Exact Host header to scope the rate limit to, e.g. "example.com".
-    uri_paths             = optional(list(string), [])      # URI path(s) to scope the rate limit to. Empty (default) rate-limits the whole host.
-    uri_match_type        = optional(string, "STARTS_WITH") # How to match uri_paths: EXACTLY (pin one endpoint) or STARTS_WITH (prefix).
+    uri_paths             = optional(list(string), [])      # URI path(s) to scope the rate limit to. With REGEX these are regex patterns. Empty (default) rate-limits the whole host.
+    uri_match_type        = optional(string, "STARTS_WITH") # How to match uri_paths: EXACTLY (pin one endpoint), STARTS_WITH (prefix), or REGEX (for variable segments, e.g. "^/api/v1/users/[^/]+/validation$"). REGEX is case-sensitive (URL-decoded, not lowercased); use an inline (?i) flag for case-insensitivity.
     count_override        = optional(bool, false)           # If true, override the action to `count` (dry run). If false (default), the action is `block` when the limit is exceeded.
   }))
   default = {}
 
   validation {
-    condition     = alltrue([for r in values(var.host_uri_rate_limit_rules) : contains(["EXACTLY", "STARTS_WITH"], r.uri_match_type)])
-    error_message = "uri_match_type must be EXACTLY or STARTS_WITH."
+    condition     = alltrue([for r in values(var.host_uri_rate_limit_rules) : contains(["EXACTLY", "STARTS_WITH", "REGEX"], r.uri_match_type)])
+    error_message = "uri_match_type must be EXACTLY, STARTS_WITH, or REGEX."
   }
   validation {
     condition     = alltrue([for r in values(var.host_uri_rate_limit_rules) : contains([60, 120, 300, 600], r.evaluation_window_sec)])