feat(tf): Add support for custom WAF rule groups in CloudFront module (#3)

Author: hibare

deployments/terraform/modules/aws/cloudfront/validation.tf

@@ -131,12 +131,16 @@ resource "terraform_data" "route53_domain_alias_validation" {
 # =============================================================================
 
 resource "terraform_data" "waf_rule_priority_validation" {
-  count = var.waf_enabled && length(var.waf_managed_rules) > 0 ? 1 : 0
+  count = var.waf_enabled && length(var.waf_managed_rules) + length(var.waf_custom_rule_groups) > 0 ? 1 : 0
 
   lifecycle {
     precondition {
-      condition     = length(var.waf_managed_rules) == length(distinct([for r in var.waf_managed_rules : r.priority]))
-      error_message = "All WAF managed rules must have unique priorities."
+      condition = length(
+        concat([for r in var.waf_managed_rules : r.priority], [for r in var.waf_custom_rule_groups : r.priority])
+        ) == length(distinct(
+          concat([for r in var.waf_managed_rules : r.priority], [for r in var.waf_custom_rule_groups : r.priority])
+      ))
+      error_message = "All WAF rule priorities must be unique across managed rules and custom rule groups."
     }
   }
 }

deployments/terraform/modules/aws/cloudfront/variables.tf

@@ -700,6 +700,39 @@ variable "waf_sampled_requests_enabled" {
   default     = true
 }
 
+variable "waf_custom_rule_groups" {
+  description = <<-EOT
+    Custom WAF rule group ARNs to include in the Web ACL.
+
+    Each entry references a pre-existing aws_wafv2_rule_group. The rule group's
+    rules are evaluated inline within the Web ACL at the specified priority.
+
+    name: stable identifier used in the WAF rule name and CloudWatch metric name.
+    override_action: "none" to use rule actions as-is, "count" to only count matches.
+  EOT
+  type = list(object({
+    name            = string
+    arn             = string
+    priority        = number
+    override_action = optional(string, "none")
+  }))
+  default = []
+
+  validation {
+    condition = alltrue([
+      for rg in var.waf_custom_rule_groups : rg.priority >= 0 && rg.priority <= 2147483647
+    ])
+    error_message = "All custom rule group priorities must be between 0 and 2147483647."
+  }
+
+  validation {
+    condition = alltrue([
+      for rg in var.waf_custom_rule_groups : contains(["none", "count"], coalesce(rg.override_action, "none"))
+    ])
+    error_message = "Custom rule group override_action must be 'none' or 'count'."
+  }
+}
+
 # ========================================
 # Route53 DNS
 # ========================================

deployments/terraform/modules/aws/cloudfront/waf.tf

@@ -193,6 +193,37 @@ resource "aws_wafv2_web_acl" "main" {
     }
   }
 
+  dynamic "rule" {
+    for_each = var.waf_custom_rule_groups
+    content {
+      name     = "custom-${rule.value.name}"
+      priority = rule.value.priority
+
+      override_action {
+        dynamic "none" {
+          for_each = coalesce(rule.value.override_action, "none") == "none" ? [1] : []
+          content {}
+        }
+        dynamic "count" {
+          for_each = coalesce(rule.value.override_action, "none") == "count" ? [1] : []
+          content {}
+        }
+      }
+
+      statement {
+        rule_group_reference_statement {
+          arn = rule.value.arn
+        }
+      }
+
+      visibility_config {
+        cloudwatch_metrics_enabled = var.waf_cloudwatch_metrics_enabled
+        metric_name                = "${local.resource_prefix}-custom-${rule.value.name}"
+        sampled_requests_enabled   = var.waf_sampled_requests_enabled
+      }
+    }
+  }
+
   visibility_config {
     cloudwatch_metrics_enabled = var.waf_cloudwatch_metrics_enabled
     metric_name                = "${local.resource_prefix}-waf"