Add host_ip_restriction_rules to WAF module

Blocks requests to a specific Host unless the source IP is in a
per-host allowed set (globally allowed IPs still pass). Additive and
defaults to {}, so existing consumers are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: OlamideOl1

aws/waf/main.tf

@@ -234,6 +234,65 @@ resource "aws_wafv2_web_acl" "main" {
     }
   }
 
+  dynamic "rule" {
+    for_each = var.host_ip_restriction_rules
+    content {
+      name     = "${rule.value["name"]}-host-ip-restriction"
+      priority = rule.value["priority"]
+
+      dynamic "action" {
+        for_each = rule.value["count_override"] == true ? [1] : []
+        content {
+          count {}
+        }
+      }
+      dynamic "action" {
+        for_each = rule.value["count_override"] == false ? [1] : []
+        content {
+          block {}
+        }
+      }
+
+      statement {
+        and_statement {
+          statement {
+            byte_match_statement {
+              field_to_match {
+                single_header {
+                  name = "host"
+                }
+              }
+
+              positional_constraint = "EXACTLY"
+
+              search_string = lower(rule.value["host"])
+
+              text_transformation {
+                priority = 0
+                type     = "LOWERCASE"
+              }
+            }
+          }
+          statement {
+            not_statement {
+              statement {
+                ip_set_reference_statement {
+                  arn = aws_wafv2_ip_set.host_restriction[rule.key].arn
+                }
+              }
+            }
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        sampled_requests_enabled   = true
+        metric_name                = "${rule.value["name"]}-host-ip-restriction"
+      }
+    }
+  }
+
   dynamic "rule" {
     for_each = var.aws_managed_rule_groups
     content {
@@ -330,6 +389,15 @@ resource "aws_wafv2_ip_set" "block_ip_list" {
   addresses          = var.block_ip_list
 }
 
+resource "aws_wafv2_ip_set" "host_restriction" {
+  for_each = var.host_ip_restriction_rules
+
+  name               = "${var.name}-${each.key}-allowed-ip-set"
+  scope              = var.waf_scope
+  ip_address_version = "IPV4"
+  addresses          = each.value.allowed_ip_list
+}
+
 module "cloudwatch_log_extract" {
   source = "../cloudwatch-log-extract"
 

aws/waf/variables.tf

@@ -70,3 +70,15 @@ variable "block_ip_list" {
   type        = list(string)
   default     = []
 }
+
+variable "host_ip_restriction_rules" {
+  description = "Restrict specific Hosts to an allowed IP set. For each entry, blocks requests where the Host header matches exactly AND the source IP is not in that entry's allowed set. Globally allowed IPs (allowed_ip_list) still pass via the priority-0 allow rule."
+  type = map(object({
+    name            = string                # Friendly name, used in the rule name and CloudWatch metric.
+    priority        = number                # Unique WAF rule priority within the ACL. All rules are processed from lowest to highest priority.
+    host            = string                # Exact Host header to restrict, e.g. "core-data.albaikcloud.com".
+    allowed_ip_list = list(string)          # IPv4 CIDRs permitted to reach the host. All other (non globally-allowed) IPs are blocked for this host.
+    count_override  = optional(bool, false) # If true, override the action to `count` (dry run). If false (default), the action is `block`.
+  }))
+  default = {}
+}