WAF

resource "aws_wafv2_web_acl" "cf" {
  provider = aws.us-east-1

  name  = "wsi-waf"
  scope = "CLOUDFRONT"

  default_action {
    block {
      custom_response {
        response_code = 403
        custom_response_body_key = "access-denied-text"
      }
    }
  }

  custom_response_body {
    key          = "access-denied-text"
    content      = "Access Denied"
    content_type = "TEXT_PLAIN"
  }

  rule {
    name     = "AllowSafeClientUserAgent"
    priority = 1

    statement {
      byte_match_statement {
        search_string = "safe-client"

        field_to_match {
          single_header {
            name = "user-agent"
          }
        }

        text_transformation {
          priority = 0
          type     = "NONE"
        }

        positional_constraint = "CONTAINS"
      }
    }

    action {
      allow {}
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "AllowSafeClientUserAgent"
    }
  }

  rule {
    name     = "VerifyCustomHeader"
    priority = 2

    statement {
      byte_match_statement {
        search_string = "Skills2024"

        field_to_match {
          single_header {
            name = "x-wsi-header"
          }
        }

        text_transformation {
          priority = 0
          type     = "NONE"
        }

        positional_constraint = "EXACTLY"
      }
    }

    action {
      allow {}
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "VerifyCustomHeader"
    }
  }

  visibility_config {
    sampled_requests_enabled   = true
    cloudwatch_metrics_enabled = true
    metric_name                = "wsi-waf"
  }
}

resource "aws_wafv2_web_acl" "alb" {

  name  = "wsi-wafv2"
  scope = "REGIONAL"

  default_action {
    block {
      custom_response {
        response_code = 403
        custom_response_body_key = "access-denied-text"
      }
    }
  }

  custom_response_body {
    key          = "access-denied-text"
    content      = "Access Denied"
    content_type = "TEXT_PLAIN"
  }

  rule {
    name     = "AllowSafeClientUserAgent"
    priority = 1

    statement {
      byte_match_statement {
        search_string = "safe-client"

        field_to_match {
          single_header {
            name = "user-agent"
          }
        }

        text_transformation {
          priority = 0
          type     = "NONE"
        }

        positional_constraint = "CONTAINS"
      }
    }

    action {
      allow {}
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "AllowSafeClientUserAgent"
    }
  }

  rule {
    name     = "VerifyCustomHeader"
    priority = 2

    statement {
      byte_match_statement {
        search_string = "Skills2024"

        field_to_match {
          single_header {
            name = "x-wsi-header"
          }
        }

        text_transformation {
          priority = 0
          type     = "NONE"
        }

        positional_constraint = "EXACTLY"
      }
    }

    action {
      allow {}
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "VerifyCustomHeader"
    }
  }

  visibility_config {
    sampled_requests_enabled   = true
    cloudwatch_metrics_enabled = true
    metric_name                = "wsi-waf"
  }
}
JSON
복사