feat: Add optional Bot Control managed rule set. (#47)

* feat: Add optional Bot Control managed rule set.

* Set fixed priority for bot control rules

---------

Co-authored-by: Nick Edwards <nedwards@codeforamerica.org>

Author: nickedwards109

README.md

@@ -63,8 +63,18 @@ these rules are spaced out to allow for custom rules to be inserted between.
 | [AWSManagedRulesAmazonIpReputationList][rules-ip-rep] | 200      | Protects against IP addresses with a poor reputation. |
 | [AWSManagedRulesCommonRuleSet][rules-common]          | 300      | Protects against common threats.                      |
 | [AWSManagedRulesKnownBadInputsRuleSet][rules-inputs]  | 400      | Protects against known bad inputs.                    |
+| [AWSManagedRulesBotControlRuleSet][rules-bot-control] | 450      | (Optional, off by default) Protects against bots.     |
 | [AWSManagedRulesSQLiRuleSet][rules-sqli]              | 500      | Protects against SQL injection attacks.               |
 
+The bot control rule set can be enabled as follows, at either TARGETED or COMMON inspection level:
+
+```hcl
+bot_control = {
+  enable           = true
+  inspection_level = "TARGETED"
+}
+```
+
 ## SSL Certificates
 
 By default, this module will use [AWS Certificate Manager][acm] (ACM) to manage
@@ -428,6 +438,7 @@ will be allowed through.
 [rules-common]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs
 [rules-inputs]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-known-bad-inputs
 [rules-ip-rep]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html#aws-managed-rule-groups-ip-rep-amazon
+[rules-bot-control]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot-control.html
 [rules-sqli]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html#aws-managed-rule-groups-use-case-sql-db
 [upload_paths]: #upload_paths
 [wafv2_ip_set]: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_ip_set

variables.tf

@@ -86,6 +86,20 @@ variable "origin_domain" {
   default     = null
 }
 
+variable "bot_control" {
+  type = object({
+    enable           = optional(bool, false)
+    inspection_level = optional(string, "COMMON")
+  })
+  description = "Bot Control managed rule group configuration."
+  default     = {}
+
+  validation {
+    condition     = contains(["COMMON", "TARGETED"], var.bot_control.inspection_level)
+    error_message = "inspection_level must be either \"COMMON\" or \"TARGETED\"."
+  }
+}
+
 variable "passive" {
   type        = bool
   description = <<-EOT

waf.tf

@@ -267,6 +267,46 @@ resource "aws_wafv2_web_acl" "waf" {
     }
   }
 
+  dynamic "rule" {
+    for_each = var.bot_control.enable ? [true] : []
+
+    content {
+      name     = "AWS-AWSManagedRulesBotControlRuleSet"
+      priority = 450
+
+      override_action {
+        dynamic "none" {
+          for_each = var.passive ? [] : [true]
+          content {}
+        }
+
+        dynamic "count" {
+          for_each = var.passive ? [true] : []
+          content {}
+        }
+      }
+
+      statement {
+        managed_rule_group_statement {
+          name        = "AWSManagedRulesBotControlRuleSet"
+          vendor_name = "AWS"
+
+          managed_rule_group_configs {
+            aws_managed_rules_bot_control_rule_set {
+              inspection_level = var.bot_control.inspection_level
+            }
+          }
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = true
+        metric_name                = "${local.prefix}-waf-bot-control"
+        sampled_requests_enabled   = true
+      }
+    }
+  }
+
   rule {
     name     = "AWS-AWSManagedRulesSQLiRuleSet"
     priority = 500