waf
DNXLabs/waf/aws
This terraform module creates a Global Web Application Firewall(WAF) Web Acl to be used with Cloudfront.
terraform-aws-waf   This terraform module creates two type of WAFv2 Web ACL rules: - CLOUDFRONT is a Global rule used in CloudFront Distribution only - REGIONAL rules can be used in ALB, API Gateway or AppSync GraphQL API Follow a commum list of Web ACL rules that can be used by this module and how to setup it, also a link of the documentation with a full list of AWS WAF Rules, you need to use the "Name" of the Rule Groups and take care with WCUs, it's why Web ACL rules can't exceed 1500 WCUs. - byte_match_statement - geo_match_statement - ip_set_reference_statement - managed_rule_group_statement - AWSManagedRulesCommonRuleSet - AWSManagedRulesAmaz
| Name | Type | Description | Default |
|---|---|---|---|
| scope | string | The scope of this Web ACL. Valid options: CLOUDFRONT, REGIONAL(ALB). | |
| regex_pattern_set_reference_statement_rules | list(object({ name = | | |
| logging_filter | list(object({ default_beh | | |
| geo_match_statement_rules | list(object({ name | | |
| rate_based_statement_rules | list(object({ name = | | |
| size_constraint_statement_rules | list(object({ name | | |
| sqli_match_statement_rules | list(object({ name = | | |
| xss_match_statement_rules | list(object({ name = | | |
| managed_rule_group_statement_rules | list(object({ name = | | |
| ip_set_reference_statement_rules | list(object({ name = | | |
| logging_redacted_fields | list(object({ all_query_a | | |
| byte_match_statement_rules | list(object({ name = | | |
| default_action | string | "block" | |
| waf_cloudfront_enable | bool | Enable WAF for Cloudfront distribution | false |
| global_rule | string | Cloudfront WAF Rule Name | "" |
| regional_rule | string | Regional WAF Rules for ALB and API Gateway | "" |
| logs_enable | bool | Enable logs | false |
| web_acl_id | string | Specify a web ACL ARN to be associated in CloudFront Distribution / # Optional W | null |
| logs_retension | number | Specifies the number of days you want to retain log events in the specified log | 90 |
| resource_arn | list(string) | ARN of the ALB to be associated with the WAFv2 ACL. | [] |
| waf_regional_enable | bool | Enable WAFv2 to ALB, API Gateway or AppSync GraphQL API | false |
| associate_waf | bool | Whether to associate an ALB with the WAFv2 ACL. | false |
web_acl_visibility_config_name_regional — The web ACL visibility config nameweb_acl_visibility_config_name_cloudfront — The web ACL visibility config nameweb_acl_id — The ID of the WAFv2 WebACL.web_acl_name_cloudfront — The name of the WAFv2 WebACL.web_acl_name_regional — The name of the WAFv2 WebACL.web_acl_arn — The ARN of the WAFv2 WebACL.web_acl_capacity_cloudfront — The web ACL capacity units (WCUs) currently being used by this web ACL.web_acl_capacity_regional — The web ACL capacity units (WCUs) currently being used by this web ACL.