Add optional uri_paths scoping to WAF host IP restriction

Lets a host restriction apply to specific URL path prefixes instead of
the whole host, e.g. lock /admin to an allowed IP while the rest of the
host stays public. Paths are matched with STARTS_WITH after URL_DECODE
and LOWERCASE; multiple paths are OR'd together.

Defaults to an empty list, which renders no URI condition and leaves the
whole host restricted, so existing consumers are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: OlamideOl1

aws/waf/main.tf

@@ -273,6 +273,64 @@ resource "aws_wafv2_web_acl" "main" {
               }
             }
           }
+
+          # Optional: scope the restriction to one or more URL path prefixes.
+          # Renders nothing when uri_paths is empty, leaving the whole host restricted.
+          dynamic "statement" {
+            for_each = length(rule.value["uri_paths"]) > 0 ? [1] : []
+            content {
+              dynamic "byte_match_statement" {
+                for_each = length(rule.value["uri_paths"]) == 1 ? [1] : []
+                content {
+                  field_to_match {
+                    uri_path {}
+                  }
+
+                  positional_constraint = "STARTS_WITH"
+
+                  search_string = lower(rule.value["uri_paths"][0])
+
+                  text_transformation {
+                    priority = 0
+                    type     = "URL_DECODE"
+                  }
+                  text_transformation {
+                    priority = 1
+                    type     = "LOWERCASE"
+                  }
+                }
+              }
+              dynamic "or_statement" {
+                for_each = length(rule.value["uri_paths"]) > 1 ? [1] : []
+                content {
+                  dynamic "statement" {
+                    for_each = rule.value["uri_paths"]
+                    content {
+                      byte_match_statement {
+                        field_to_match {
+                          uri_path {}
+                        }
+
+                        positional_constraint = "STARTS_WITH"
+
+                        search_string = lower(statement.value)
+
+                        text_transformation {
+                          priority = 0
+                          type     = "URL_DECODE"
+                        }
+                        text_transformation {
+                          priority = 1
+                          type     = "LOWERCASE"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+
           statement {
             not_statement {
               statement {

aws/waf/variables.tf

@@ -72,13 +72,14 @@ variable "block_ip_list" {
 }
 
 variable "host_ip_restriction_rules" {
-  description = "Restrict specific Hosts to an allowed IP set. For each entry, blocks requests where the Host header matches exactly AND the source IP is not in that entry's allowed set. Globally allowed IPs (allowed_ip_list) still pass via the priority-0 allow rule."
+  description = "Restrict specific Hosts (optionally scoped to URL path prefixes) to an allowed IP set. For each entry, blocks requests where the Host header matches exactly, the URI matches one of the given path prefixes (if any), AND the source IP is not in that entry's allowed set. Globally allowed IPs (allowed_ip_list) still pass via the priority-0 allow rule."
   type = map(object({
-    name            = string                # Friendly name, used in the rule name and CloudWatch metric.
-    priority        = number                # Unique WAF rule priority within the ACL. All rules are processed from lowest to highest priority.
-    host            = string                # Exact Host header to restrict, e.g. "core-data.albaikcloud.com".
-    allowed_ip_list = list(string)          # IPv4 CIDRs permitted to reach the host. All other (non globally-allowed) IPs are blocked for this host.
-    count_override  = optional(bool, false) # If true, override the action to `count` (dry run). If false (default), the action is `block`.
+    name            = string                     # Friendly name, used in the rule name and CloudWatch metric.
+    priority        = number                     # Unique WAF rule priority within the ACL. All rules are processed from lowest to highest priority.
+    host            = string                     # Exact Host header to restrict, e.g. "core-data.albaikcloud.com".
+    allowed_ip_list = list(string)               # IPv4 CIDRs permitted to reach the host. All other (non globally-allowed) IPs are blocked for this host.
+    uri_paths       = optional(list(string), []) # Path prefixes to scope the restriction to, e.g. ["/admin"]. Matched with STARTS_WITH, so "/admin" also covers "/admin/x". Empty (default) restricts the whole host.
+    count_override  = optional(bool, false)      # If true, override the action to `count` (dry run). If false (default), the action is `block`.
   }))
   default = {}
 }