guilherme.silva/iac-sei
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pontual Fix

Browse Source
This commit is contained in:
Guilherme Silva
2026-09-02 08:38:27 -03:00
parent 9ed5e6ec51
commit c9ec31ca92
6 changed files with 61 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
sei_waf.tf
View File

@@ -1,6 +1,6 @@
resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
count = var.enable_waf == "true" ? 1 : 0
compartment_id = var.ocid_compartment_networking
count = var.enable_waf ? 1 : 0
compartment_id = var.ocid_compartment_security
display_name = "sei-waf-policy-${var.environment}-v01"
actions {
code = 0
@@ -32,12 +32,29 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
actions {
code = 403
name = "Deny Country"
name = "403 - Response Code Action for protection rules"
type = "RETURN_HTTP_RESPONSE"
body {
text = jsonencode({
code = "403"
message = "This is country is Forbidden request"
message = "Your request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
})
type = "STATIC_TEXT"
}
headers {
name = "Content-Type"
value = "application/json"
}
}
actions {
code = 403
name = "403 - Response Code Action for country"
type = "RETURN_HTTP_RESPONSE"
body {
text = jsonencode({
code = "403"
message = "Your country request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
})
type = "STATIC_TEXT"
}
@@ -49,7 +66,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
request_access_control {
default_action_name = "Pre-configured Allow Action"
rules {
action_name = "Deny Country"
action_name = "403 - Response Code Action for country"
condition = "!i_contains(['BR'], connection.source.geo.countryCode)"
condition_language = "JMESPATH"
name = "Allow Countries"
@@ -57,9 +74,9 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
request_protection {
body_inspection_size_limit_in_bytes = 8192
body_inspection_size_limit_in_bytes = 8192
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "recommended-protection-rules"
@@ -166,7 +183,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "mysql-protection-rules"
@@ -213,7 +230,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "php-protection-rules"
@@ -435,7 +452,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "apache-protection-rules"
@@ -585,7 +602,7 @@ resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" {
resource "oci_logging_log" "waf_log_lb_public" {
count = var.enable_waf ? 1 : 0
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log"
log_group_id = oci_logging_log_group.sei_log_group.id
log_group_id = oci_logging_log_group.sei_log_group_security.id
log_type = "SERVICE"
configuration {
source {
@@ -594,7 +611,7 @@ resource "oci_logging_log" "waf_log_lb_public" {
service = "waf"
source_type = "OCISERVICE"
}
compartment_id = var.ocid_compartment_security
compartment_id = var.ocid_compartment_security
}
is_enabled = "true"
retention_duration = "30"