-
Notifications
You must be signed in to change notification settings - Fork 0
/
waf.tf
115 lines (91 loc) · 2.18 KB
/
waf.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# Default WAF ACL rule
resource "aws_wafv2_web_acl" "acl_default" {
name = "${var.prefix}-WAF-DEFAULT"
description = "Default WAF ACL rule"
scope = "REGIONAL"
default_action {
allow {}
}
rule {
name = "default"
priority = 1
override_action {
count {}
}
statement {
managed_rule_group_statement {
name = "AWSManagedRulesCommonRuleSet"
vendor_name = "AWS"
excluded_rule {
name = "SizeRestrictions_QUERYSTRING"
}
excluded_rule {
name = "NoUserAgent_HEADER"
}
scope_down_statement {
geo_match_statement {
country_codes = ["US"]
}
}
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "default-metrics"
sampled_requests_enabled = false
}
}
tags = {
Name = "Default WAF ACL"
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "default-metrics"
sampled_requests_enabled = false
}
}
# Rate-limited WAF ACL rule
resource "aws_wafv2_web_acl" "acl_limited" {
name = "${var.prefix}-WAF-LIMITED"
description = "Rate-limited WAF ACL rule"
scope = "CLOUDFRONT"
default_action {
allow {}
}
rule {
name = "limited"
priority = 2
action {
block {}
}
statement {
rate_based_statement {
limit = 10000
aggregate_key_type = "IP"
scope_down_statement {
geo_match_statement {
country_codes = ["RU"]
}
}
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "default-metrics"
sampled_requests_enabled = false
}
}
tags = {
Name = "Rate-Limited WAF ACL"
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "default-metrics"
sampled_requests_enabled = false
}
}
# WAF ALB Association
resource "aws_wafv2_web_acl_association" "alb_association" {
resource_arn = aws_lb.ingress.arn
web_acl_arn = aws_wafv2_web_acl.acl_default.arn
}