Custom Block Response #56

rsmets · 2022-05-14T01:12:56Z

Description

I added the capability to define custom responses for block actions. More info on custom responses can be found here and here.

Note that this does not apply to managed rule group statements per AWS design.

Ohid25

Appreciate the contribution!

I have a request if you can make the changes to what you have done so far.

Also, if you can please run the make commands to validate, add to changelog and docs, i'd appreciate that too!

Ohid25 · 2022-05-16T13:28:11Z

main.tf

-      content {}
+      content {
+          custom_response {
+            response_code = var.custom_response_code


Suggested change

response_code = var.custom_response_code

response_code = lookup(rule.custom_response, 403)

Instead of using a variable, a lookup function should be used since these arguments are filled in via the rules variable. This would eliminate the need to create a standalone variable for this.

Also, from the docs you sent I can see that there are two other arguments that can be used here based on terraform docs:

"Block": { "CustomResponse": { "CustomResponseBodyKey": "CustomResponseBodyKey1", "ResponseCode": 404, "ResponseHeaders": [ { "Name": "BlockActionHeader1Name", "Value": "BlockActionHeader1Value" } ] }

Can you please add these too?

…nitions.

rsmets · 2022-05-16T19:45:01Z

Okay, added the ability to define the custom body and headers as well. Certainly more robust now. 👍🏼

However, I am unable to run the make commands. I also do not see any documentation on them?

Edit: ah I see... tucked under the Install dependencies section of the README.

rsmets · 2022-05-16T20:04:24Z

Make commands ran ✅

naseemkullah · 2022-05-16T21:15:10Z

variables.tf

+variable "enable_custom_response" {
+  type        = bool
+  description = "Set to `true` to define custom responses (status code, body, and/or headers) for non managed rule group statements block actions."
+  default     = false
+}
+
+variable "custom_response_body" {
+  type        = map(string)
+  description = "A custom response body to be referenced on a per rule basis."
+  default     = {}
+}


Just saw this PR! Looking to solve the same problem, WDYT about an array of custom response bodies so we are not limited to just one? Please see https://github.com/umotif-public/terraform-aws-waf-webaclv2/pull/57/files

@naseemkullah have you tested that? I was not able to get it to work with an array input for custom_response_body. I like your use of object.

Just updated my PR with the inclusion of your purposed custom_response_bodies. 👍🏼 Good call.

…tions. Dropped the enabled variable as not needed.

Ohid25

Really appreciate the examples!

I just have a few comments to make sure the examples will work.

Ohid25 · 2022-05-17T14:00:31Z

examples/wafv2-custom-response/outputs.tf

+output "custom_ip_set_arn" {
+  description = "The ARN of the Custom IP Set"
+  value       = aws_wafv2_ip_set.custom_ip_set.arn
+}
+
+output "block_ip_set_arn" {
+  description = "The ARN of the Block IP Set"
+  value       = aws_wafv2_ip_set.block_ip_set.arn
+}


Where are these resources that you're referencing here in the outputs?

This example with these outputs.

Similar comment to the other outputs in the other examples.

Oops! Good catch... got overzealous with my copy pasta.

Ohid25 · 2022-05-17T14:33:14Z

examples/wafv2-custom-response/main.tf

+    }
+  ]
+
+  rules = [


visibility_config will be required in both of the rules - see here: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#visibility_config

Thanks for the catch here as well... nuked the visibility_config from the copy of my personal block because had local variables I didn't want to bother with here. But just added the block ✔️ .

naseemkullah · 2022-05-17T03:43:31Z

examples/wafv2-custom-response/main.tf

+      custom_response      = true
+      custom_response_code = 412
+      custom_response_key  = "custom_response_body_1"
+      custom_response_headers = [
+        {
+          name  = "X-Custom-Header"
+          value = "You are not authorized to access this resource."
+        },
+        {
+          name  = "X-Custom-Header-2"
+          value = "You are still not authorized to access this resource."
+        }
+      ]


Suggested change

custom_response = true

custom_response_code = 412

custom_response_key = "custom_response_body_1"

custom_response_headers = [

{

name = "X-Custom-Header"

value = "You are not authorized to access this resource."

},

{

name = "X-Custom-Header-2"

value = "You are still not authorized to access this resource."

}

]

custom_response = {

enabled = true

code = 412

body_key = "custom_response_body_1"

headers = [

{

name = "X-Custom-Header"

value = "You are not authorized to access this resource."

},

{

name = "X-Custom-Header-2"

value = "You are still not authorized to access this resource."

}

]

}

nit: nested instead of flat

naseemkullah · 2022-05-17T03:44:02Z

examples/wafv2-custom-response/main.tf

+      }
+    }
+  ]
+}


Suggested change

}

}

Thanks for the suggestion. Was working on this very change. :)

rsmets · 2022-05-17T17:52:42Z

Thanks for all the feedback @Ohid25 and @naseemkullah. I think this is ready to go.

Took me a bit to grasp the super slick syntax for dynamic rules (i.e. from visibility_config) , which I used for the custom_response rule block:

  dynamic "custom_response" {
    for_each = length(lookup(rule.value, "custom_response", [])) == 0 ? [] : [lookup(rule.value, "custom_response", {})]

Very clever!

naseemkullah · 2022-05-17T17:59:38Z

examples/wafv2-custom-response/main.tf

+
+      custom_response = {
+        response_code = 412
+        response_key  = "default_1",


Suggested change

response_key = "default_1",

custom_response_body_key = "default_1",

Just a better exposure of the underlying api imho (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-customresponse.html)

naseemkullah · 2022-05-17T18:00:05Z

main.tf

+              dynamic "custom_response" {
+                for_each = length(lookup(rule.value, "custom_response", [])) == 0 ? [] : [lookup(rule.value, "custom_response", {})]
+                content {
+                  custom_response_body_key = lookup(custom_response.value, "response_key", null)


Suggested change

custom_response_body_key = lookup(custom_response.value, "response_key", null)

custom_response_body_key = lookup(custom_response.value, "custom_response_body_key", null)

Just better exposure of underlying api

naseemkullah · 2022-05-17T18:02:34Z

lgtm, as mentioned optional nit: would just change response_key for custom_response_body_key to expose the underlying api as is

…nderlying tf resource.

Ohid25

LGTM! 🎉

Ohid25 · 2022-05-18T12:19:30Z

Thanks for the contribution! 🎉 .

This is now released as a part of 3.8.0

rsmets added 4 commits May 13, 2022 17:57

[Block] custom_response http status code.

158c862

[README] updated with input info.

67b3ab1

[Variable] definition typo in type fix.

76ea15c

[Formatting]

f359974

Ohid25 added the enhancement New feature or request label May 16, 2022

Ohid25 suggested changes May 16, 2022

View reviewed changes

rsmets added 2 commits May 16, 2022 12:33

[Custom Response] handling on per rules basis with dynamic block defi…

70baae9

…nitions.

[Formatting] main.tf

3e22c64

rsmets changed the title ~~Block status code~~ Custom Block Response May 16, 2022

rsmets added 3 commits May 16, 2022 13:00

[make] validate.

d76604b

[make] changelog

e091118

[README] updated to list custom responses capabilities.

b4c561b

naseemkullah reviewed May 16, 2022

View reviewed changes

[Custom Response Bodies] supported for multiplexed custom body defini…

0766d35

…tions. Dropped the enabled variable as not needed.

Ohid25 suggested changes May 17, 2022

View reviewed changes

[Examples] fix.

1cc10e7

naseemkullah reviewed May 17, 2022

View reviewed changes

rsmets added 2 commits May 17, 2022 10:39

[Custom Response] block variable input.

a451063

[Examples] typo fix.

68d6460

naseemkullah reviewed May 17, 2022

View reviewed changes

naseemkullah mentioned this pull request May 17, 2022

feat: bubble up custom response body option #57

Closed

rsmets added 3 commits May 17, 2022 11:33

[refactor] response_key to custom_response_body_key to better match u…

8eae1b6

…nderlying tf resource.

[Variable] typo fix.

b4ff784

[Changelog]

128d9be

naseemkullah approved these changes May 17, 2022

View reviewed changes

Ohid25 approved these changes May 17, 2022

View reviewed changes

Ohid25 merged commit 1d3e1c2 into umotif-public:main May 17, 2022

rsmets mentioned this pull request May 17, 2022

add support for block custom_response #42

Closed

rsmets deleted the block_status_code branch May 17, 2022 19:48

rsmets restored the block_status_code branch May 17, 2022 19:48

naseemkullah mentioned this pull request May 17, 2022

feat: add label_match_statement & rule_labels #58

Merged

rsmets deleted the block_status_code branch May 19, 2022 00:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Custom Block Response #56

Custom Block Response #56

rsmets commented May 14, 2022 •

edited

Loading

Ohid25 left a comment

Ohid25 May 16, 2022 •

edited

Loading

rsmets commented May 16, 2022 •

edited

Loading

rsmets commented May 16, 2022

naseemkullah May 16, 2022 •

edited

Loading

rsmets May 16, 2022 •

edited

Loading

rsmets May 16, 2022

Ohid25 left a comment

Ohid25 May 17, 2022

rsmets May 17, 2022

Ohid25 May 17, 2022

rsmets May 17, 2022

naseemkullah May 17, 2022

naseemkullah May 17, 2022

rsmets May 17, 2022

rsmets commented May 17, 2022 •

edited

Loading

naseemkullah May 17, 2022

naseemkullah May 17, 2022

naseemkullah commented May 17, 2022

Ohid25 left a comment

Ohid25 commented May 18, 2022

	response_code = var.custom_response_code
	response_code = lookup(rule.custom_response, 403)

	response_key = "default_1",
	custom_response_body_key = "default_1",

	custom_response_body_key = lookup(custom_response.value, "response_key", null)
	custom_response_body_key = lookup(custom_response.value, "custom_response_body_key", null)

Custom Block Response #56

Custom Block Response #56

Conversation

rsmets commented May 14, 2022 • edited Loading

Description

Ohid25 left a comment

Choose a reason for hiding this comment

Ohid25 May 16, 2022 • edited Loading

Choose a reason for hiding this comment

rsmets commented May 16, 2022 • edited Loading

rsmets commented May 16, 2022

naseemkullah May 16, 2022 • edited Loading

Choose a reason for hiding this comment

rsmets May 16, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ohid25 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rsmets commented May 17, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

naseemkullah commented May 17, 2022

Ohid25 left a comment

Choose a reason for hiding this comment

Ohid25 commented May 18, 2022

rsmets commented May 14, 2022 •

edited

Loading

Ohid25 May 16, 2022 •

edited

Loading

rsmets commented May 16, 2022 •

edited

Loading

naseemkullah May 16, 2022 •

edited

Loading

rsmets May 16, 2022 •

edited

Loading

rsmets commented May 17, 2022 •

edited

Loading