feat: Allow WAF to be put into passive mode. (#4)

codeforamerica · Oct 18, 2024 · d8650ac · d8650ac
1 parent 2fb8635
commit d8650ac
Show file tree

Hide file tree

Showing 4 changed files with 47 additions and 5 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@v4
+        with:
+          fetch-tags: true
       - name: Bump version and create changelog
         id: bump
         uses: commitizen-tools/commitizen-action@master

diff --git a/README.md b/README.md
@@ -58,6 +58,7 @@ these rules are spaced out to allow for custom rules to be inserted between.
 | [ip_set_rules] | The environment for the project.                                                                    | `map(object)`  | `"dev"` | no       |
 | log_group      | CloudWatch log group to send WAF logs to.                                                           | `list(string)` | `[]`    | no       |
 | origin_domain  | Fully qualified domain name for the origin. Defaults to `origin.${subdomain}.${domain}`.            | `string`       | n/a     | no       |
+| passive        | Enable passive mode for the WAF, counting all requests rather than blocking.                        | `bool`         | `false` | no       |
 | subdomain      | Subdomain for the distribution. Defaults to the environment.                                        | `string`       | n/a     | no       |
 | tags           | Optional tags to be applied to all resources.                                                       | `list`         | `[]`    | no       |
 

diff --git a/main.tf b/main.tf
@@ -113,7 +113,7 @@ resource "aws_wafv2_web_acl" "waf" {
           content {}
         }
 
-        dynamic "block" {
+        dynamic "count" {
           for_each = rule.value.action == "count" ? [true] : []
           content {}
         }
@@ -133,6 +133,7 @@ resource "aws_wafv2_web_acl" "waf" {
     }
   }
 
+  # TODO: Make rate-limiting configurable.
   rule {
     name     = "AWS-RateBasedRule-IP-300"
     priority = 100
@@ -161,7 +162,15 @@ resource "aws_wafv2_web_acl" "waf" {
     priority = 200
 
     override_action {
-      none {}
+      dynamic "none" {
+        for_each = var.passive ? [] : [true]
+        content { }
+      }
+
+      dynamic "count" {
+        for_each = var.passive ? [true] : []
+        content { }
+      }
     }
 
     statement {
@@ -183,7 +192,15 @@ resource "aws_wafv2_web_acl" "waf" {
     priority = 300
 
     override_action {
-      none {}
+      dynamic "none" {
+        for_each = var.passive ? [] : [true]
+        content { }
+      }
+
+      dynamic "count" {
+        for_each = var.passive ? [true] : []
+        content { }
+      }
     }
 
     statement {
@@ -205,7 +222,15 @@ resource "aws_wafv2_web_acl" "waf" {
     priority = 400
 
     override_action {
-      none {}
+      dynamic "none" {
+        for_each = var.passive ? [] : [true]
+        content { }
+      }
+
+      dynamic "count" {
+        for_each = var.passive ? [true] : []
+        content { }
+      }
     }
 
     statement {
@@ -227,7 +252,15 @@ resource "aws_wafv2_web_acl" "waf" {
     priority = 500
 
     override_action {
-      none {}
+      dynamic "none" {
+        for_each = var.passive ? [] : [true]
+        content { }
+      }
+
+      dynamic "count" {
+        for_each = var.passive ? [true] : []
+        content { }
+      }
     }
 
     statement {

diff --git a/variables.tf b/variables.tf
@@ -25,6 +25,12 @@ variable "origin_domain" {
   default     = ""
 }
 
+variable "passive" {
+  type        = bool
+  description = "Enable passive mode for the WAF, counting all requests rather than blocking."
+  default     = false
+}
+
 variable "project" {
   type        = string
   description = "Project that these resources are supporting."