Skip to content

Commit fffbcd0

Browse files
jamesiarmesjamesiarmes
authored
feat: Add WAF data protection configuration. (#44)
1 parent 014a22b commit fffbcd0

4 files changed

Lines changed: 427 additions & 374 deletions

File tree

‎README.md‎

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -142,31 +142,32 @@ webhooks_priority = 100
142142

143143
## Inputs
144144

145-
| Name | Description | Type | Default | Required |
146-
|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-----------------|-------------|
147-
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
148-
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
149-
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
150-
| project | Project that these resources are supporting. | `string` | n/a | yes |
151-
| origin_alb_arn | ARN of the Application Load Balancer this deployment will point to. Required unless `use_custom_origin` is set to `true`. | `string` | n/a | conditional |
152-
| certificate_domain | Domain for the imported certificate, if different from the endpoint. Used in conjunction with `certificate_imported`. | `string` | `null` | no |
153-
| certificate_imported | Whether the certificate is imported or managed by ACM. | `bool` | `false` | no |
154-
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
155-
| environment | The environment for the deployment. | `string` | `"development"` | no |
156-
| hosted_zone_id | ID of the hosted zone for the domain, leave empty to have this module look it up. | `string` | `null` | no |
157-
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
158-
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
159-
| origin_domain | Optional custom origin domain to point to. Defaults to `origin.subdomain.domain`. Only used if `use_custom_origin` is set to `true`. | `string` | n/a | no |
160-
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
161-
| request_policy | Managed request policy to associate with the distribution. See the [managed policies][managed-policies] for valid values. | `string` | `"AllViewer"` | no |
162-
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
163-
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
164-
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
165-
| upload_rules_capacity | Capacity for the upload rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
166-
| use_custom_origin | Use a custom origin configuration instead of an ALB origin. When set to `true`, a custom origin is used and `origin_alb_arn` is not required; when set to `false`, an ALB is used and `origin_alb_arn` must be set. | `bool` | `false` | no |
167-
| [webhooks] | Optional map of webhooks that should be allowed through the WAF. | `map(object)` | `{}` | no |
168-
| webhooks_priority | Priority for the webhooks rule group. By default, an attempt is made to place it before other rules that block traffic. | `number` | `null` | no |
169-
| webhook_rules_capacity | Capacity for the webhook rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
145+
| Name | Description | Type | Default | Required |
146+
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ----------------- | ----------- |
147+
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
148+
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
149+
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
150+
| project | Project that these resources are supporting. | `string` | n/a | yes |
151+
| origin_alb_arn | ARN of the Application Load Balancer this deployment will point to. Required unless `use_custom_origin` is set to `true`. | `string` | n/a | conditional |
152+
| certificate_domain | Domain for the imported certificate, if different from the endpoint. Used in conjunction with `certificate_imported`. | `string` | `null` | no |
153+
| certificate_imported | Whether the certificate is imported or managed by ACM. | `bool` | `false` | no |
154+
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
155+
| environment | The environment for the deployment. | `string` | `"development"` | no |
156+
| hosted_zone_id | ID of the hosted zone for the domain, leave empty to have this module look it up. | `string` | `null` | no |
157+
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
158+
| redacted_headers | Headers to redact from logs. Keys are the header names, and values are the action to take. Valid actions are `"HASH"` and `"SUBSTITUTION"`. | `map(string)` | `{sane defaults}` | no |
159+
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
160+
| origin_domain | Optional custom origin domain to point to. Defaults to `origin.subdomain.domain`. Only used if `use_custom_origin` is set to `true`. | `string` | n/a | no |
161+
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
162+
| request_policy | Managed request policy to associate with the distribution. See the [managed policies][managed-policies] for valid values. | `string` | `"AllViewer"` | no |
163+
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
164+
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
165+
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
166+
| upload_rules_capacity | Capacity for the upload rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
167+
| use_custom_origin | Use a custom origin configuration instead of an ALB origin. When set to `true`, a custom origin is used and `origin_alb_arn` is not required; when set to `false`, an ALB is used and `origin_alb_arn` must be set. | `bool` | `false` | no |
168+
| [webhooks] | Optional map of webhooks that should be allowed through the WAF. | `map(object)` | `{}` | no |
169+
| webhooks_priority | Priority for the webhooks rule group. By default, an attempt is made to place it before other rules that block traffic. | `number` | `null` | no |
170+
| webhook_rules_capacity | Capacity for the webhook rules group. Attempts to determine the capacity if left empty. | `number` | `null` | no |
170171

171172
### custom_headers
172173

@@ -235,12 +236,12 @@ module "cloudfront_waf" {
235236
}
236237
```
237238

238-
| Name | Description | Type | Default | Required |
239-
| -------- | ----------------------------------------------------------------------------- | -------- | --------- | -------- |
240-
| action | The action to perform. | `string` | `"allow"` | no |
241-
| arn | ARN of the IP set to match on. | `string` | n/a | yes |
239+
| Name | Description | Type | Default | Required |
240+
| -------- | --------------------------------------------------------------------------- | -------- | --------- | -------- |
241+
| action | The action to perform. | `string` | `"allow"` | no |
242+
| arn | ARN of the IP set to match on. | `string` | n/a | yes |
242243
| name | Name for this rule. Defaults to `${project}-${environment}-ip-${rule.key}`. | `string` | `null` | no |
243-
| priority | Rule priority. Defaults to the rule's position in the map. | `number` | `null` | no |
244+
| priority | Rule priority. Defaults to the rule's position in the map. | `number` | `null` | no |
244245

245246
### rate_limit_rules
246247

0 commit comments

Comments
 (0)