Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ipset in multiple not statements #44

Merged
merged 12 commits into from
Jan 12, 2022
Merged

ipset in multiple not statements #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
e4b03bb
output alb_list conflicts with main, fixed with && length(var.alb_arn…
Jul 5, 2021
2b15655
revert README
Jul 13, 2021
cc48aa6
README modified
Jul 13, 2021
1b60c94
added ip_set to not statement
Aug 18, 2021
c1243a8
fix not statement
Aug 18, 2021
55f9a8d
testing scope down in managed rules
Aug 19, 2021
1f2ddbf
test with fix in block
Aug 19, 2021
fb36c73
test with fix in block
Aug 19, 2021
53ccbfd
upgrade
Dec 1, 2021
fc93406
upgrade 3.4.0
jayolmos Dec 20, 2021
9dccbb4
not statement and_not_statement ipset
jayolmos Dec 20, 2021
ec93c9c
and statement not statement mess
jayolmos Dec 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ If referring directly to the code instead of a pinned version, take note that fr
```hcl
module "waf" {
source = "umotif-public/waf-webaclv2/aws"
version = "~> 3.1.0"
version = "~> 3.0.0"

name_prefix = "test-waf-setup"
alb_arn = module.alb.arn
Expand Down Expand Up @@ -265,7 +265,7 @@ module "waf" {
}

source = "umotif-public/waf-webaclv2/aws"
version = "~> 3.1.0"
version = "~> 3.0.0"

name_prefix = "test-waf-setup-cloudfront"
scope = "CLOUDFRONT"
Expand Down
109 changes: 109 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,13 @@ resource "aws_wafv2_web_acl" "main" {
for_each = length(lookup(scope_down_statement.value, "not_statement", {})) == 0 ? [] : [lookup(scope_down_statement.value, "not_statement", {})]
content {
statement {
# Scope down AND ip_set_statement
dynamic "ip_set_reference_statement" {
for_each = length(lookup(not_statement.value, "ip_set_reference_statement", {})) == 0 ? [] : [lookup(not_statement.value, "ip_set_reference_statement", {})]
content {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}
# scope down NOT byte_match_statement
dynamic "byte_match_statement" {
for_each = length(lookup(not_statement.value, "byte_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "byte_match_statement", {})]
Expand Down Expand Up @@ -261,6 +268,83 @@ resource "aws_wafv2_web_acl" "main" {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}

dynamic "not_statement" {
for_each = length(lookup(statement.value, "not_statement", {})) == 0 ? [] : [lookup(statement.value, "not_statement", {})]
content {
statement {
# Scope down NOT ip_set_statement
dynamic "ip_set_reference_statement" {
for_each = length(lookup(not_statement.value, "ip_set_reference_statement", {})) == 0 ? [] : [lookup(not_statement.value, "ip_set_reference_statement", {})]
content {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}
# scope down NOT byte_match_statement
dynamic "byte_match_statement" {
for_each = length(lookup(not_statement.value, "byte_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "byte_match_statement", {})]
content {
dynamic "field_to_match" {
for_each = length(lookup(byte_match_statement.value, "field_to_match", {})) == 0 ? [] : [lookup(byte_match_statement.value, "field_to_match", {})]
content {
dynamic "uri_path" {
for_each = length(lookup(field_to_match.value, "uri_path", {})) == 0 ? [] : [lookup(field_to_match.value, "uri_path")]
content {}
}
dynamic "all_query_arguments" {
for_each = length(lookup(field_to_match.value, "all_query_arguments", {})) == 0 ? [] : [lookup(field_to_match.value, "all_query_arguments")]
content {}
}
dynamic "body" {
for_each = length(lookup(field_to_match.value, "body", {})) == 0 ? [] : [lookup(field_to_match.value, "body")]
content {}
}
dynamic "method" {
for_each = length(lookup(field_to_match.value, "method", {})) == 0 ? [] : [lookup(field_to_match.value, "method")]
content {}
}
dynamic "query_string" {
for_each = length(lookup(field_to_match.value, "query_string", {})) == 0 ? [] : [lookup(field_to_match.value, "query_string")]
content {}
}
dynamic "single_header" {
for_each = length(lookup(field_to_match.value, "single_header", {})) == 0 ? [] : [lookup(field_to_match.value, "single_header")]
content {
name = lower(lookup(single_header.value, "name"))
}
}
}
}
positional_constraint = lookup(byte_match_statement.value, "positional_constraint")
search_string = lookup(byte_match_statement.value, "search_string")
text_transformation {
priority = lookup(byte_match_statement.value, "priority")
type = lookup(byte_match_statement.value, "type")
}
}
}

# scope down NOT geo_match_statement
dynamic "geo_match_statement" {
for_each = length(lookup(not_statement.value, "geo_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "geo_match_statement", {})]
content {
country_codes = lookup(geo_match_statement.value, "country_codes")
}
}

# Scope down NOT label_match_statement
dynamic "label_match_statement" {
for_each = length(lookup(not_statement.value, "label_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "label_match_statement", {})]
content {
key = lookup(label_match_statement.value, "key")
scope = lookup(label_match_statement.value, "scope")
}
}
}
}
}


}
}
}
Expand Down Expand Up @@ -526,6 +610,13 @@ resource "aws_wafv2_web_acl" "main" {
for_each = length(lookup(scope_down_statement.value, "not_statement", {})) == 0 ? [] : [lookup(scope_down_statement.value, "not_statement", {})]
content {
statement {
# Scope down NOT ip_set_statement
dynamic "ip_set_reference_statement" {
for_each = length(lookup(not_statement.value, "ip_set_reference_statement", {})) == 0 ? [] : [lookup(not_statement.value, "ip_set_reference_statement", {})]
content {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}
# scope down NOT byte_match_statement
dynamic "byte_match_statement" {
for_each = length(lookup(not_statement.value, "byte_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "byte_match_statement", {})]
Expand Down Expand Up @@ -668,10 +759,21 @@ resource "aws_wafv2_web_acl" "main" {
}

# Scope down AND not_statement

#scope_down -> and_Statement -> statement -> not_statement -> statement -> ip_set


dynamic "not_statement" {
for_each = length(lookup(statement.value, "not_statement", {})) == 0 ? [] : [lookup(statement.value, "not_statement", {})]
content {
statement {
# Scope down NOT ip_set_statement
dynamic "ip_set_reference_statement" {
for_each = length(lookup(not_statement.value, "ip_set_reference_statement", {})) == 0 ? [] : [lookup(not_statement.value, "ip_set_reference_statement", {})]
content {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}
# scope down NOT byte_match_statement
dynamic "byte_match_statement" {
for_each = length(lookup(not_statement.value, "byte_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "byte_match_statement", {})]
Expand Down Expand Up @@ -900,6 +1002,13 @@ resource "aws_wafv2_web_acl" "main" {
content {
statement {

# Scope down NOT ip_set_statement
dynamic "ip_set_reference_statement" {
for_each = length(lookup(not_statement.value, "ip_set_reference_statement", {})) == 0 ? [] : [lookup(not_statement.value, "ip_set_reference_statement", {})]
content {
arn = lookup(ip_set_reference_statement.value, "arn")
}
}
# NOT byte_match_statement
dynamic "byte_match_statement" {
for_each = length(lookup(not_statement.value, "byte_match_statement", {})) == 0 ? [] : [lookup(not_statement.value, "byte_match_statement", {})]
Expand Down