Component: `aws-waf-acl`

This component is responsible for provisioning an AWS Web Application Firewall (WAF) with an associated managed rule group.

Usage

Stack Level: Regional

Here's an example snippet for how to use this component.

components:
  terraform:
    aws-waf-acl:
      vars:
        enabled: true
        acl_name: default
        default_action: allow
        description: Default web ACL
        managed_rule_group_statement_rules:
        - name: "OWASP-10"
          # Rules are processed in order based on the value of priority, lowest number first
          priority: 1

          statement:
            name:  AWSManagedRulesCommonRuleSet
            vendor_name: AWS

          visibility_config:
            # Defines and enables Amazon CloudWatch metrics and web request sample collection.
            cloudwatch_metrics_enabled: false
            metric_name: "OWASP-10"
            sampled_requests_enabled: false

Requirements

Name	Version
terraform	~> 0.14.9
aws	~> 3.36
external	~> 2.1
local	~> 2.1
template	>= 2.2
utils	~> 0.3

Providers

Name	Version
aws	~> 3.36

Modules

Name	Source	Version
aws_waf	cloudposse/waf/aws	0.0.1
iam_roles	../account-map/modules/iam-roles	n/a
this	cloudposse/label/null	0.24.1

Resources

Name	Type
aws_ssm_parameter.acl_arn	resource

Inputs

Name	Description	Type	Default	Required
acl_name	Friendly name of the ACL. The ACL ARN will be stored in SSM under {ssm_path_prefix}/{acl_name}/arn	`string`	n/a	yes
additional_tag_map	Additional tags for appending to tags_as_list_of_maps. Not added to `tags`.	`map(string)`	`{}`	no
association_resource_arns	A list of ARNs of the resources to associate with the web ACL. This must be an ARN of an Application Load Balancer or an Amazon API Gateway stage.	`list(string)`	`[]`	no
attributes	Additional attributes (e.g. `1`)	`list(string)`	`[]`	no
byte_match_statement_rules	A rule statement that defines a string match search for AWS WAF to apply to web requests. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: field_to_match: The part of a web request that you want AWS WAF to inspect. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#field-to-match text_transformation: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#text-transformation visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	`any`	`{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {} }`	no
default_action	Specifies that AWS WAF should allow requests by default. Possible values: `allow`, `block`.	`string`	`"block"`	no
delimiter	Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
description	A friendly description of the WebACL.	`string`	`"Managed by Terraform"`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
environment	Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
geo_match_statement_rules	A rule statement used to identify web requests based on country of origin. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: country_codes: A list of two-character country codes. forwarded_ip_config: fallback_behavior: The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Possible values: `MATCH`, `NO_MATCH` header_name: The name of the HTTP header to use for the IP address. visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
id_length_limit	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for default, which is `0`. Does not affect `id_full`.	`number`	`null`	no
import_profile_name	AWS Profile name to use when importing a resource	`string`	`null`	no
ip_set_reference_statement_rules	A rule statement used to detect web requests coming from particular IP addresses or address ranges. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: arn: The ARN of the IP Set that this statement references. ip_set_forwarded_ip_config: fallback_behavior: The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Possible values: `MATCH`, `NO_MATCH` header_name: The name of the HTTP header to use for the IP address. position: The position in the header to search for the IP address. Possible values include: `FIRST`, `LAST`, or `ANY`. visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
label_key_case	The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`. Possible values: `lower`, `title`, `upper`. Default value: `title`.	`string`	`null`	no
label_order	The naming order of the id output and Name tag. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 5 elements, but at least one must be present.	`list(string)`	`null`	no
label_value_case	The letter case of output label values (also used in `tags` and `id`). Possible values: `lower`, `title`, `upper` and `none` (no transformation). Default value: `lower`.	`string`	`null`	no
log_destination_configs	The Amazon Kinesis Data Firehose ARNs.	`list(string)`	`[]`	no
managed_rule_group_statement_rules	A rule statement used to run the rules that are defined in a managed rule group. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. override_action: The override action to apply to the rules in a rule group. Possible values: `count`, `none` statement: name: The name of the managed rule group. vendor_name: The name of the managed rule group vendor. excluded_rule: The list of names of the rules to exclude. visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
name	Solution name, e.g. 'app' or 'jenkins'	`string`	`null`	no
namespace	Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp'	`string`	`null`	no
rate_based_statement_rules	A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: aggregate_key_type: Setting that indicates how to aggregate the request counts. Possible values include: `FORWARDED_IP` or `IP` limit: The limit on requests per 5-minute period for a single originating IP address. forwarded_ip_config: fallback_behavior: The match status to assign to the web request if the request doesn't have a valid IP address in the specified position. Possible values: `MATCH`, `NO_MATCH` header_name: The name of the HTTP header to use for the IP address. visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
redacted_fields	The parts of the request that you want to keep out of the logs. method_enabled: Whether to enable redaction of the HTTP method. The method indicates the type of operation that the request is asking the origin to perform. uri_path_enabled: Whether to enable redaction of the URI path. This is the part of a web request that identifies a resource. query_string_enabled: Whether to enable redaction of the query string. This is the part of a URL that appears after a `?` character, if any. single_header: The list of names of the query headers to redact.	`object({ method_enabled = bool, uri_path_enabled = bool, query_string_enabled = bool, single_header = list(string) })`	`null`	no
regex_pattern_set_reference_statement_rules	A rule statement used to search web request components for matches with regular expressions. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: arn: The Amazon Resource Name (ARN) of the Regex Pattern Set that this statement references. field_to_match: The part of a web request that you want AWS WAF to inspect. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#field-to-match text_transformation: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#text-transformation visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
regex_replace_chars	Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
region	AWS Region	`string`	n/a	yes
rule_group_reference_statement_rules	A rule statement used to run the rules that are defined in an WAFv2 Rule Group. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. override_action: The override action to apply to the rules in a rule group. Possible values: `count`, `none` statement: arn: The ARN of the `aws_wafv2_rule_group` resource. excluded_rule: The list of names of the rules to exclude. visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
scope	Specifies whether this is for an AWS CloudFront distribution or for a regional application. Possible values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region us-east-1 (N. Virginia) on the AWS provider.	`string`	`"REGIONAL"`	no
size_constraint_statement_rules	A rule statement that uses a comparison operator to compare a number of bytes against the size of a request component. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: comparison_operator: The operator to use to compare the request part to the size setting. Possible values: `EQ`, `NE`, `LE`, `LT`, `GE`, or `GT`. size: The size, in bytes, to compare to the request part, after any transformations. Valid values are integers between `0` and `21474836480`, inclusive. field_to_match: The part of a web request that you want AWS WAF to inspect. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#field-to-match text_transformation: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#text-transformation visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
sqli_match_statement_rules	An SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. statement: field_to_match: The part of a web request that you want AWS WAF to inspect. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#field-to-match text_transformation: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#text-transformation visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no
ssm_path_prefix	SSM path prefix (with leading but not trailing slash) under which to store all WAF info	`string`	`"/waf"`	no
stage	Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
tags	Additional tags (e.g. `map('BusinessUnit','XYZ')`	`map(string)`	`{}`	no
visibility_config	Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`map(string)`	`{}`	no
xss_match_statement_rules	A rule statement that defines a cross-site scripting (XSS) match search for AWS WAF to apply to web requests. action: The action that AWS WAF should take on a web request when it matches the rule's statement. name: A friendly name of the rule. priority: If you define more than one Rule in a WebACL, AWS WAF evaluates each request against the rules in order based on the value of priority. AWS WAF processes rules with lower priority first. xss_match_statement: field_to_match: The part of a web request that you want AWS WAF to inspect. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#field-to-match text_transformation: Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#text-transformation visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection. cloudwatch_metrics_enabled: Whether the associated resource sends metrics to CloudWatch. metric_name: A friendly name of the CloudWatch metric. sampled_requests_enabled: Whether AWS WAF should store a sampling of the web requests that match the rules.	`list(any)`	`null`	no

Outputs

Name	Description
acl	Information about the created WAF ACL

References

cloudposse/terraform-aws-components - Cloud Posse's upstream component

Component: aws-waf-acl

Usage​

Requirements​

Providers​

Modules​

Resources​

Inputs​

Outputs​

References​