Skip to content

Commit 397d420

Browse files
uyggnodoowuyggnodoow
committed
feat: Changed the managed_service_data field to make it easier to import
 + Update example code
1 parent 2a525a3 commit 397d420

File tree

2 files changed

+128
-161
lines changed

2 files changed

+128
-161
lines changed

‎examples/wafv2/main.tf‎

Lines changed: 114 additions & 139 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
provider "aws" {
2-
region = "ap-northeast-2"
3-
}
4-
51
module "fms01" {
62
source = "../..//"
73

@@ -12,148 +8,127 @@ module "fms01" {
128
"account" : ["111111111111", "222222222222"]
139
}
1410
managed_service_data = {
15-
preProcessRuleGroups = [
11+
"preProcessRuleGroups" : [
1612
{
17-
"ruleGroupArn" : null,
13+
"ruleGroupType" : "RuleGroup",
1814
"overrideAction" : {
1915
"type" : "NONE"
2016
},
21-
"managedRuleGroupIdentifier" : {
22-
"versionEnabled" : null,
23-
"version" : null,
24-
"vendorName" : "AWS",
25-
"managedRuleGroupName" : "AWSManagedRulesKnownBadInputsRuleSet"
26-
},
27-
"ruleGroupType" : "ManagedRuleGroup",
17+
"sampledRequestsEnabled" : true,
2818
"excludeRules" : [],
29-
"sampledRequestsEnabled" : true
19+
"ruleGroupArn" : "",
20+
"ruleGroupName" : "BLOCK_IP_ADDRESS"
3021
}
3122
]
32-
default_action = "allow"
33-
sampledRequestsEnabledForDefaultActions = true
23+
"defaultAction" : { "type" : "ALLOW" },
24+
"type" : "WAFV2",
25+
"overrideCustomerWebACLAssociation" : false,
26+
"sampledRequestsEnabledForDefaultActions" : true,
27+
"optimizeUnassociatedWebACL" : false,
28+
# 'DEFAULT' or 'RETROFIT_EXISTING'
29+
"webACLSource" : "DEFAULT"
3430
}
3531
}
3632

37-
module "fms02" {
38-
source = "../..//"
39-
40-
name = "fms02"
41-
type = "WAFV2"
42-
resource_type_list = ["AWS::ElasticLoadBalancingV2::LoadBalancer", "AWS::ApiGateway::Stage"]
43-
include_map = {
44-
"account" : ["111111111111"]
45-
}
46-
managed_service_data = {
47-
preProcessRuleGroups = [
48-
{
49-
"ruleGroupArn": null,
50-
"overrideAction": {
51-
"type": "NONE"
52-
},
53-
"managedRuleGroupIdentifier": {
54-
"versionEnabled": true,
55-
"version": null,
56-
"vendorName": "AWS",
57-
"managedRuleGroupName": "AWSManagedRulesATPRuleSet",
58-
"managedRuleGroupConfigs": [
59-
{
60-
"awsmanagedRulesATPRuleSet": {
61-
"loginPath": "/web/login",
62-
"requestInspection": {
63-
"payloadType": "JSON",
64-
"usernameField": {
65-
"identifier": "/form/username"
66-
},
67-
"passwordField": {
68-
"identifier": "/form/password"
69-
}
70-
}
71-
}
72-
}
73-
]
74-
},
75-
"ruleGroupType": "ManagedRuleGroup",
76-
"excludeRules": [],
77-
"sampledRequestsEnabled": true,
78-
"ruleActionOverrides": [
79-
{
80-
"name": "AttributeCompromisedCredentials",
81-
"actionToUse": {
82-
"challenge": {}
83-
}
84-
},
85-
{
86-
"name": "AttributeLongSession",
87-
"actionToUse": {
88-
"challenge": {}
89-
}
90-
},
91-
{
92-
"name": "AttributePasswordTraversal",
93-
"actionToUse": {
94-
"challenge": {}
95-
}
96-
},
97-
{
98-
"name": "AttributeUsernameTraversal",
99-
"actionToUse": {
100-
"challenge": {}
101-
}
102-
},
103-
{
104-
"name": "SignalMissingCredential",
105-
"actionToUse": {
106-
"challenge": {}
107-
}
108-
},
109-
{
110-
"name": "TokenRejected",
111-
"actionToUse": {
112-
"challenge": {}
113-
}
114-
},
115-
{
116-
"name": "UnsupportedCognitoIDP",
117-
"actionToUse": {
118-
"challenge": {}
119-
}
120-
},
121-
{
122-
"name": "VolumetricIpHigh",
123-
"actionToUse": {
124-
"challenge": {}
125-
}
126-
},
127-
{
128-
"name": "VolumetricSession",
129-
"actionToUse": {
130-
"challenge": {}
131-
}
132-
}
133-
]
134-
}
135-
]
136-
default_action = "block"
137-
customResponse = {
138-
"enableCustomResponse": true,
139-
"customResponseBodyKey": "fms",
140-
"responseCode": 403,
141-
"responseHeaders": [
142-
{
143-
"headerName": "x-custom-response",
144-
"headerValue": "fms"
145-
}
146-
],
147-
"customResponseBodies": {
148-
"fms": {
149-
"responseBodyType": "APPLICATION_JSON",
150-
"responseBody": "{\"error\": \"accessDenied\"}"
151-
}
152-
}
153-
}
154-
sampledRequestsEnabledForDefaultActions = true
155-
captchaConfig = 500
156-
challengeConfig = 500
157-
tokenDomains = ["test.com"]
158-
}
159-
}
33+
#module "fms02" {
34+
# source = "../..//"
35+
#
36+
# name = "fms02"
37+
# type = "WAFV2"
38+
# resource_type_list = ["AWS::ElasticLoadBalancingV2::LoadBalancer", "AWS::ApiGateway::Stage"]
39+
# include_map = {
40+
# "account" : ["111111111111"]
41+
# }
42+
# managed_service_data = {
43+
# "preProcessRuleGroups" : [
44+
# {
45+
# "ruleGroupType" : "ManagedRuleGroup",
46+
# "overrideAction" : { "type" : "NONE" },
47+
# "sampledRequestsEnabled" : true,
48+
# "ruleActionOverrides" : [
49+
# {
50+
# "name" : "AttributeCompromisedCredentials",
51+
# "actionToUse" : { "challenge" : {} }
52+
# },
53+
# {
54+
# "name" : "AttributeLongSession",
55+
# "actionToUse" : { "challenge" : {} }
56+
# },
57+
# {
58+
# "name" : "AttributePasswordTraversal",
59+
# "actionToUse" : { "challenge" : {} }
60+
# },
61+
# {
62+
# "name" : "AttributeUsernameTraversal",
63+
# "actionToUse" : { "challenge" : {} }
64+
# },
65+
# {
66+
# "name" : "SignalMissingCredential",
67+
# "actionToUse" : { "challenge" : {} }
68+
# },
69+
# {
70+
# "name" : "TokenRejected",
71+
# "actionToUse" : { "challenge" : {} }
72+
# },
73+
# {
74+
# "name" : "UnsupportedCognitoIDP",
75+
# "actionToUse" : { "challenge" : {} }
76+
# },
77+
# {
78+
# "name" : "VolumetricIpHigh",
79+
# "actionToUse" : { "challenge" : {} }
80+
# },
81+
# {
82+
# "name" : "VolumetricSession",
83+
# "actionToUse" : { "challenge" : {} }
84+
# }
85+
# ],
86+
# "managedRuleGroupIdentifier" : {
87+
# "managedRuleGroupName" : "AWSManagedRulesATPRuleSet",
88+
# "vendorName" : "AWS",
89+
# "versionEnabled" : true,
90+
# "version" : null,
91+
# "managedRuleGroupConfigs" : [
92+
# {
93+
# "awsmanagedRulesATPRuleSet" : {
94+
# "loginPath" : "/web/login",
95+
# "requestInspection" : {
96+
# "payloadType" : "JSON",
97+
# "usernameField" : { "identifier" : "/form/username" },
98+
# "passwordField" : { "identifier" : "/form/password" }
99+
# }
100+
# }
101+
# }
102+
# ]
103+
# }
104+
# }
105+
# ],
106+
# "postProcessRuleGroups" : [],
107+
# "defaultAction" : { "type" : "BLOCK" },
108+
# "customRequestHandling" : null,
109+
# "associationConfig" : null,
110+
# "tokenDomains" : ["test.com"],
111+
# "customResponse" : {
112+
# "enableCustomResponse" : true,
113+
# "customResponseBodyKey" : "fms",
114+
# "responseCode" : 403,
115+
# "responseHeaders" : [
116+
# {
117+
# "headerName" : "x-custom-response",
118+
# "headerValue" : "fms"
119+
# }
120+
# ],
121+
# "customResponseBodies" : {
122+
# "fms" : {
123+
# "responseBodyType" : "APPLICATION_JSON",
124+
# "responseBody" : "{\\'error\\': \\'accessDenied\\'}"
125+
# }
126+
# }
127+
# },
128+
# "type" : "WAFV2",
129+
# "overrideCustomerWebACLAssociation" : false,
130+
# "sampledRequestsEnabledForDefaultActions" : true,
131+
# "optimizeUnassociatedWebACL" : false,
132+
# "webACLSource" : "DEFAULT"
133+
# }
134+
#}

‎main.tf‎

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ locals {
4141

4242
managed_service_data = var.type == "WAFV2" ? merge(local.default,
4343
{
44-
type = var.type
44+
type = lookup(var.managed_service_data, "type")
4545
preProcessRuleGroups = lookup(var.managed_service_data, "preProcessRuleGroups", [])
4646
postProcessRuleGroups = lookup(var.managed_service_data, "postProcessRuleGroups", [])
4747
defaultAction = {
@@ -52,33 +52,25 @@ locals {
5252
overrideCustomerWebACLAssociation = lookup(var.managed_service_data, "overrideCustomerWebACLAssociation", false)
5353
loggingConfiguration = lookup(var.managed_service_data, "loggingConfiguration", null)
5454
sampledRequestsEnabledForDefaultActions = lookup(var.managed_service_data, "sampledRequestsEnabledForDefaultActions", false)
55-
captchaConfig = {
56-
immunityTimeProperty = {
57-
immunityTime = lookup(var.managed_service_data, "captchaConfig", 300)
58-
}
59-
}
60-
challengeConfig = {
61-
immunityTimeProperty = {
62-
immunityTime = lookup(var.managed_service_data, "challengeConfig", 300)
63-
}
64-
}
65-
tokenDomains = lookup(var.managed_service_data, "tokenDomains", null)
66-
optimizeUnassociatedWebACL = lookup(var.managed_service_data, "optimizeUnassociatedWebACL", false)
67-
webACLSource = lookup(var.managed_service_data, "webACLSource", "DEFAULT")
55+
captchaConfig = lookup(var.managed_service_data, "captchaConfig", null)
56+
challengeConfig = lookup(var.managed_service_data, "challengeConfig", null)
57+
tokenDomains = lookup(var.managed_service_data, "tokenDomains", null)
58+
optimizeUnassociatedWebACL = lookup(var.managed_service_data, "optimizeUnassociatedWebACL", false)
59+
webACLSource = lookup(var.managed_service_data, "webACLSource", "DEFAULT")
6860
}
6961
) : var.type == "SHIELD_ADVANCED" ? merge(local.default,
7062
{
71-
type = var.type
63+
type = lookup(var.managed_service_data, "type")
7264
automaticResponseConfiguration = {
7365
automaticResponseStatus = lookup(var.managed_service_data, "automaticResponseStatus", "DISABLED")
7466
automaticResponseAction = lookup(var.managed_service_data, "automaticResponseAction", null)
7567
}
76-
optimizeUnassociatedWebACL = lookup(var.managed_service_data, "optimizeUnassociatedWebACL", false)
77-
overrideCustomerWebaclClassic = lookup(var.managed_service_data, "overrideCustomerWebaclClassic", false)
68+
optimizeUnassociatedWebACL = lookup(var.managed_service_data, "optimizeUnassociatedWebACL", false)
69+
overrideCustomerWebaclClassic = lookup(var.managed_service_data, "overrideCustomerWebaclClassic", false)
7870
}
7971
) : var.type == "SECURITY_GROUPS_COMMON" ? merge(local.default,
8072
{
81-
type = var.type
73+
type = lookup(var.managed_service_data, "type")
8274
securityGroups = lookup(var.managed_service_data, "securityGroups", [])
8375
securityGroupAction = lookup(var.managed_service_data, "securityGroupAction", null)
8476
revertManualSecurityGroupChanges = lookup(var.managed_service_data, "revertManualSecurityGroupChanges", false)
@@ -90,7 +82,7 @@ locals {
9082
}
9183
) : var.type == "SECURITY_GROUPS_CONTENT_AUDIT" ? merge(local.default,
9284
{
93-
type = var.type
85+
type = lookup(var.managed_service_data, "type")
9486
preManagedOptions = lookup(var.managed_service_data, "preManagedOptions", null)
9587
securityGroups = lookup(var.managed_service_data, "securityGroups")
9688
securityGroupAction = {
@@ -99,15 +91,15 @@ locals {
9991
}
10092
) : var.type == "SECURITY_GROUPS_USAGE_AUDIT" ? merge(local.default,
10193
{
102-
type = var.type
94+
type = lookup(var.managed_service_data, "type")
10395
deleteUnusedSecurityGroups = lookup(var.managed_service_data, "deleteUnusedSecurityGroups", false)
10496
coalesceRedundantSecurityGroups = lookup(var.managed_service_data, "coalesceRedundantSecurityGroups", false)
10597
# 'optionalDelayForUnusedInMinutes' field only applies if deleteUnusedSecurityGroups is set to true.
10698
optionalDelayForUnusedInMinutes = lookup(var.managed_service_data, "optionalDelayForUnusedInMinutes", 0)
10799
}
108100
) : var.type == "NETWORK_FIREWALL" ? merge(local.default,
109101
{
110-
type = var.type
102+
type = lookup(var.managed_service_data, "type")
111103
# Centralized deployment model
112104
awsNetworkFirewallConfig = lookup(var.managed_service_data, "awsNetworkFirewallConfig", null)
113105
firewallDeploymentModel = lookup(var.managed_service_data, "firewallDeploymentModel", null)
@@ -122,7 +114,7 @@ locals {
122114
}
123115
) : var.type == "DNS_FIREWALL" ? merge(local.default,
124116
{
125-
type = var.type
117+
type = lookup(var.managed_service_data, "type")
126118
preProcessRuleGroups = lookup(var.managed_service_data, "preProcessRuleGroups", [])
127119
postProcessRuleGroups = lookup(var.managed_service_data, "postProcessRuleGroups", [])
128120
}

0 commit comments

Comments
 (0)