Skip to content

Commit 2cb3174

Browse files
jamesiarmesjamesiarmes
committed
fix: PR issues discovered by copilot.
1 parent 6eec350 commit 2cb3174

3 files changed

Lines changed: 49 additions & 43 deletions

File tree

‎README.md‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,24 @@ module "cloudfront_waf" {
1616
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
1717
1818
project = "my-project"
19-
environment = "dev"
19+
environment = "development"
2020
domain = "my-project.org"
2121
log_bucket = module.logging.bucket
2222
origin_alb_arn = module.web.load_balancer_arn
2323
}
2424
```
2525

26-
If you want to point the distrubution at a custom origin, you can set
26+
If you want to point the distribution at a custom origin, you can set
2727
`use_custom_origin` to `true`. For example, to use the origin
28-
`origin.development.my-project.org`, you can use the folllowing:
28+
`origin.development.my-project.org`, you can use the following:
2929

3030

3131
```hcl
3232
module "cloudfront_waf" {
3333
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
3434
3535
project = "my-project"
36-
environment = "dev"
36+
environment = "development"
3737
domain = "my-project.org"
3838
log_bucket = module.logging.bucket
3939
use_custom_origin = true
@@ -90,14 +90,14 @@ distribution at `www.my-project.org`, you could use the following:
9090
> [!NOTE]
9191
> In this case, when the certificate was imported, the `project` tag would have
9292
> been set to `my-project` and the `environment` tag would have been set to
93-
> `dev`.
93+
> `development`.
9494
9595
```hcl
9696
module "cloudfront_waf" {
97-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
97+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
9898
9999
project = "my-project"
100-
environment = "dev"
100+
environment = "development"
101101
domain = "my-project.org"
102102
subdomain = "www"
103103
log_bucket = module.logging.bucket
@@ -142,30 +142,30 @@ webhooks_priority = 100
142142

143143
## Inputs
144144

145-
| Name | Description | Type | Default | Required |
146-
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------- | ------------- | ----------- |
147-
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
148-
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
149-
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
150-
| project | Project that these resources are supporting. | `string` | n/a | yes |
151-
| origin_alb_arn | ARN of the Application Load Balancer this deployment will point to. Required unless `use_custom_origin` is set to `true`. | `string` | n/a | conditional |
152-
| certificate_domain | Domain for the imported certificate, if different from the endpoint. Used in conjunction with `certificate_imported`. | `string` | `null` | no |
153-
| certificate_imported | Whether the certificate is imported or managed by ACM. | `bool` | `false` | no |
154-
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
155-
| environment | The environment for the deployment. | `string` | `"dev"` | no |
156-
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
157-
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
158-
| origin_domain | Optional custom origin domain to point to. Defaults to `origin.subdomain.domain`. Only used if `use_custom_origin` is set to `true`. | `string` | n/a | no |
159-
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
160-
| request_policy | Managed request policy to associate with the distribution. See the [managed policies][managed-policies] for valid values. | `string` | `"AllViewer"` | no |
161-
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
162-
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
163-
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
164-
| upload_rules_capacity | Capacity for the upload rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
165-
| use_custom_origin | Use a custom origin configuration instead of an ALB. If set to `true`, `origin_alb_arn` must also be set. | `bool` | `false` | no |
166-
| [webhooks] | Optional map of webhooks that should be allowed through the WAF. | `map(object)` | `{}` | no |
167-
| webhooks_priority | Priority for the webhooks rule group. By default, an attempt is made to place it before other rules that block traffic. | `number` | `null` | no |
168-
| webhook_rules_capacity | Capacity for the webhook rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
145+
| Name | Description | Type | Default | Required |
146+
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | --------------- | ----------- |
147+
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
148+
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
149+
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
150+
| project | Project that these resources are supporting. | `string` | n/a | yes |
151+
| origin_alb_arn | ARN of the Application Load Balancer this deployment will point to. Required unless `use_custom_origin` is set to `true`. | `string` | n/a | conditional |
152+
| certificate_domain | Domain for the imported certificate, if different from the endpoint. Used in conjunction with `certificate_imported`. | `string` | `null` | no |
153+
| certificate_imported | Whether the certificate is imported or managed by ACM. | `bool` | `false` | no |
154+
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
155+
| environment | The environment for the deployment. | `string` | `"development"` | no |
156+
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
157+
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
158+
| origin_domain | Optional custom origin domain to point to. Defaults to `origin.subdomain.domain`. Only used if `use_custom_origin` is set to `true`. | `string` | n/a | no |
159+
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
160+
| request_policy | Managed request policy to associate with the distribution. See the [managed policies][managed-policies] for valid values. | `string` | `"AllViewer"` | no |
161+
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
162+
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
163+
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
164+
| upload_rules_capacity | Capacity for the upload rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
165+
| use_custom_origin | Use a custom origin configuration instead of an ALB origin. When set to `true`, a custom origin is used and `origin_alb_arn` is not required; when set to `false`, an ALB is used and `origin_alb_arn` must be set. | `bool` | `false` | no |
166+
| [webhooks] | Optional map of webhooks that should be allowed through the WAF. | `map(object)` | `{}` | no |
167+
| webhooks_priority | Priority for the webhooks rule group. By default, an attempt is made to place it before other rules that block traffic. | `number` | `null` | no |
168+
| webhook_rules_capacity | Capacity for the webhook rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
169169

170170
### custom_headers
171171

@@ -180,10 +180,10 @@ Simply specify the headers you want to add in a map. For example:
180180

181181
```hcl
182182
module "cloudfront_waf" {
183-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
183+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
184184
185185
project = "my-project"
186-
environment = "dev"
186+
environment = "development"
187187
domain = "my-project.org"
188188
log_bucket = module.logging.bucket
189189
@@ -216,7 +216,7 @@ resource "aws_wafv2_ip_set" "security_scanners" {
216216
}
217217
218218
module "cloudfront_waf" {
219-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
219+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
220220
221221
project = "my-project"
222222
environment = "staging"
@@ -238,7 +238,7 @@ module "cloudfront_waf" {
238238
| -------- | ----------------------------------------------------------------------------- | -------- | --------- | -------- |
239239
| action | The action to perform. | `string` | `"allow"` | no |
240240
| arn | ARN of the IP set to match on. | `string` | n/a | yes |
241-
| name | Name for this rule. Defaults to `${project}-${environment}-rate-${rule.key}`. | `string` | `null` | no |
241+
| name | Name for this rule. Defaults to `${project}-${environment}-ip-${rule.key}`. | `string` | `null` | no |
242242
| priority | Rule priority. Defaults to the rule's position in the map. | `number` | `null` | no |
243243

244244
### rate_limit_rules
@@ -255,7 +255,7 @@ For example, to rate limit requests to 300 over a 5-minute period:
255255

256256
```hcl
257257
module "cloudfront_waf" {
258-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
258+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
259259
260260
project = "my-project"
261261
environment = "staging"
@@ -301,7 +301,7 @@ ensure it comes after the common and SQLi rule sets.
301301
302302
```hcl
303303
module "cloudfront_waf" {
304-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
304+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
305305
306306
project = "my-project"
307307
environment = "staging"
@@ -343,7 +343,7 @@ conditions that must be met for the request to be allowed through.
343343
344344
```hcl
345345
module "cloudfront_waf" {
346-
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=1.10.0"
346+
source = "github.com/codeforamerica/tofu-modules-aws-cloudfront-waf?ref=2.0.0"
347347
348348
project = "my-project"
349349
environment = "staging"

‎main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ resource "aws_wafv2_web_acl" "waf" {
132132
dynamic "rule" {
133133
for_each = var.ip_set_rules
134134
content {
135-
name = coalesce(rule.value.name, join("-", [local.prefix, rule.key]))
135+
name = coalesce(rule.value.name, join("-", [local.prefix, "ip", rule.key]))
136136
priority = rule.value.priority != null ? rule.value.priority : index(var.ip_set_rules, rule.key)
137137

138138
action {

‎variables.tf‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ variable "custom_headers" {
2929
variable "environment" {
3030
type = string
3131
description = "Environment for the deployment."
32-
default = "dev"
32+
default = "development"
3333
}
3434

3535
variable "ip_set_rules" {
@@ -55,11 +55,16 @@ variable "log_group" {
5555

5656
variable "origin_alb_arn" {
5757
type = string
58-
description = <<EOF
58+
description = <<-EOF
5959
ARN of the Application Load Balancer this deployment will point to. Required
6060
unless `use_custom_origin` is set to `true`.
6161
EOF
6262
default = null
63+
64+
validation {
65+
condition = var.use_custom_origin || (var.origin_alb_arn != null && var.origin_alb_arn != "")
66+
error_message = "origin_alb_arn must be set to a non-empty value unless use_custom_origin is true."
67+
}
6368
}
6469

6570
variable "origin_domain" {
@@ -152,8 +157,9 @@ variable "upload_rules_capacity" {
152157
variable "use_custom_origin" {
153158
type = bool
154159
description = <<EOF
155-
Use a custom origin configuration instead of an ALB. If set to `true`,
156-
`origin_alb_arn` must also be set.
160+
Use a custom origin configuration instead of an ALB origin. When set to
161+
`true`, a custom origin is used and `origin_alb_arn` is not required; when
162+
set to `false`, an ALB is used and `origin_alb_arn` must be set.
157163
EOF
158164
default = false
159165
}

0 commit comments

Comments
 (0)