Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/cloudposse/terraform-cloudflare-waf-rulesets

Terraform module to manage CloudFlare WAF rulesetes.
https://github.com/cloudposse/terraform-cloudflare-waf-rulesets
cloudflare compliance security terraform terraform-module terraform-modules
Last synced: 3 months ago
JSON representation
Terraform module to manage CloudFlare WAF rulesetes.
Host: GitHub
URL: https://github.com/cloudposse/terraform-cloudflare-waf-rulesets
Owner: cloudposse
License: other
Created: 2021-03-15T16:07:33.000Z (almost 4 years ago)
Default Branch: main
Last Pushed: 2024-09-06T16:12:30.000Z (5 months ago)
Last Synced: 2024-09-06T19:24:04.221Z (5 months ago)
Topics: cloudflare, compliance, security, terraform, terraform-module, terraform-modules
Language: HCL
Homepage: https://cloudposse.com/accelerate
Size: 1.99 MB
Stars: 8
Watchers: 15
Forks: 5
Open Issues: 4
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project

README

        




    




Terraform module to manage CloudFlare WAF rulesets.

__NOTE:__ This module is a hard fork of [Innovation Norway's](https://github.com/innovationnorway/terraform-cloudflare-waf-rulesets) terraform module and adapted to Cloud Posse conventions.

> [!TIP]

> #### 👽 Use Atmos with Terraform

> Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform. 


> Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift).

>

> 

> Watch demo of using Atmos with Terraform

> 


> Example of running atmos to manage infrastructure from our Quick Start tutorial.

> 

## Usage

For a complete example, see [examples/complete](examples/complete).

For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)

(which tests and deploys the example on AWS), see [test](test).

```hcl

module "label" {

  source = "cloudposse/label/null"

  # Cloud Posse recommends pinning every module to a specific version

  # version = "x.x.x"

  namespace  = "eg"

  stage      = "prod"

  name       = "waf"

  attributes = ["cf"]

  delimiter  = "-"

}

module "waf_rulesets" {

  source = "cloudposse/waf-rulesets/cloudflare"

  # Cloud Posse recommends pinning every module to a specific version

  # version = "x.x.x"

  zone = "cloudposse.co"

  rulesets = [

    {

      name        = "OWASP ModSecurity Core Rule Set"

      mode        = "simulate"

      sensitivity = "off"

      rule_groups = [

        {

          name = "OWASP Bad Robots"

          mode = "on"

          rules = [

            {

              id   = "990012" # Rogue web site crawler

              mode = "off"

            },

          ]

        },

      ]

    },

  ]

  context = module.label.context

}

```

> [!IMPORTANT]

> In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation

> and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version

> you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic

> approach for updating versions to avoid unexpected changes.

## Examples

Here is an example of using this module:

- [`examples/complete`](examples/complete) - complete example of using this module

## Makefile Targets

```text

Available targets:

  help                                Help screen

  help/all                            Display help for all targets

  help/short                          This help short screen

  lint                                Lint terraform code

```

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 0.13 |

|  [cloudflare](#requirement\_cloudflare) | >= 2.19 |

## Providers

| Name | Version |

|------|---------|

|  [cloudflare](#provider\_cloudflare) | >= 2.19 |

## Modules

| Name | Source | Version |

|------|--------|---------|

|  [this](#module\_this) | cloudposse/label/null | 0.25.0 |

## Resources

| Name | Type |

|------|------|

| [cloudflare_waf_group.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_group) | resource |

| [cloudflare_waf_package.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_package) | resource |

| [cloudflare_waf_rule.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_rule) | resource |

| [cloudflare_waf_groups.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/waf_groups) | data source |

| [cloudflare_waf_packages.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/waf_packages) | data source |

| [cloudflare_zones.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/zones) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |

|  [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no |

|  [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
} | no |

|  [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |

|  [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
   format = string
   labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |

|  [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |

|  [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |

|  [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no |

|  [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no |

|  [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |

|  [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no |

|  [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
  The value of the `name` tag, if included, will be the `id`, not the `name`.
  Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
  changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | [
  "default"
] | no |

|  [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |

|  [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |

|  [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |

|  [rulesets](#input\_rulesets) | A list of `rulesets` objects.
name:
  The name of the firewall package.
sensitivity:
  The sensitivity of the firewall package.
mode:
   The default action that will be taken for rules under the firewall package. 
   Possible values: `simulate`, `block`, `challenge`.
rule\_groups:
  name:
    The name of the firewall rule group.
  mode:
    Whether or not the rules contained within this group are configurable/usable. 
    Possible values: `on`, `off`.
rules:
  id:
    The ID of the WAF rule.
  mode:
     The mode to use when the rule is triggered. Value is restricted based on the allowed\_modes of the rule. 
     Possible values: `default`, `disable`, `simulate`, `block`, `challenge`, `on`, `off`. | list(object({
    name        = string
    sensitivity = string
    mode        = string
    rule_groups = list(object({
      name = string
      mode = string
      rules = list(object({
        id   = string
        mode = string
      }))
    }))
  })) | n/a | yes |

|  [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |

|  [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |

|  [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |

|  [zone](#input\_zone) | The name of the DNS zone. | `string` | n/a | yes |

## Outputs

| Name | Description |

|------|-------------|

|  [rulesets](#output\_rulesets) | A list of `rulesets` objects. |

## Related Projects

Check out these related projects.

- [terraform-null-label](https://github.com/cloudposse/terraform-null-label) - Terraform Module to define a consistent naming convention by (namespace, stage, name, [attributes])

- [terraform-cloudflare-zone](https://github.com/cloudposse/terraform-cloudflare-zone) - Terraform module to provision a CloudFlare zone with DNS records, Argo, Firewall filters and rules

## References

For additional context, refer to some of these links.

- [terraform-provider-cloudflare](https://registry.terraform.io/providers/cloudflare/cloudflare/latest) - Cloudflare Terraform Provider

> [!TIP]

> #### Use Terraform Reference Architectures for AWS

>

> Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly.

>

> ✅ We build it together with your team.


> ✅ Your team owns everything.


> ✅ 100% Open Source and backed by fanatical support.


>

> 

> 📚 Learn More

>

> 


>

> Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-cloudflare-waf-rulesets&utm_content=commercial_support) for funded startups and enterprises.

>

> *Your team can operate like a pro today.*

>

> Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed.

> #### Day-0:  Your Foundation for Success

> - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code.

> - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases.

> - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance.

> - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations.

> - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions.

>

> 

>

> #### Day-2: Your Operational Mastery

> - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency.

> - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it.

> - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity.

> - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration.

> - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly.

> - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value.

> - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate.

>

> 

> 

## ✨ Contributing

This project is under active development, and we encourage contributions from our community.

Many thanks to our outstanding contributors:



  



For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-cloudflare-waf-rulesets/issues).

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-cloudflare-waf-rulesets/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md).

 2. **Fork** the repo on GitHub

 3. **Clone** the project to your own machine

 4. **Commit** changes to your own branch

 5. **Push** your work back up to your fork

 6. Submit a **Pull Request** so that we can review your changes

**NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request!

### 🌎 Slack Community

Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-cloudflare-waf-rulesets&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure.

### 📰 Newsletter

Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-cloudflare-waf-rulesets&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know.

Dropped straight into your Inbox every week — and usually a 5-minute read.

### 📆 Office Hours 

[Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-cloudflare-waf-rulesets&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else.

It's **FREE** for everyone!

## Trademarks

All other trademarks referenced herein are the property of their respective owners.

## Copyrights

Copyright © 2021-2024 [Cloud Posse, LLC](https://cloudposse.com)