iac-sei/sei_waf.tf

resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
  count = var.var.enable_waf == "true" ? 1 : 0
  compartment_id = var.ocid_compartment_networking
  display_name  = "sei-waf-policy-${var.environment}-v01"
  actions {
    code = 0
    name = "Pre-configured Check Action"
    type = "CHECK"
  }
  actions {
    code = 0
    name = "Pre-configured Allow Action"
    type = "ALLOW"
  }

  actions {
    code = 401
    name = "Pre-configured 401 Response Code Action"
    type = "RETURN_HTTP_RESPONSE"
    body {
      text = jsonencode({
        code    = "401"
        message = "Unauthorized"
      })
      type = "STATIC_TEXT"
    }
    headers {
      name  = "Content-Type"
      value = "application/json"
    }
  }

  actions {
    code = 403
    name = "Deny Country"
    type = "RETURN_HTTP_RESPONSE"
    body {
      text = jsonencode({
        code    = "403"
        message = "This is country is Forbidden request"
      })
      type = "STATIC_TEXT"
    }
    headers {
      name  = "Content-Type"
      value = "application/json"
    }
  }
  request_access_control {
    default_action_name = "Pre-configured Allow Action"
    rules {
      action_name        = "Deny Country"
      condition          = "!i_contains(['BR'], connection.source.geo.countryCode)"
      condition_language = "JMESPATH"
      name               = "Allow Countries"
      type               = "ACCESS_CONTROL"
    }
  }
  request_protection {
    body_inspection_size_limit_in_bytes             = 8192
    rules {
      action_name                = "Pre-configured Check Action"
      condition_language         = "JMESPATH"
      is_body_inspection_enabled = true
      name                       = "recommended-protection-rules"
      type                       = "PROTECTION"
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942270"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9420000"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "941140"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9410000"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9330000"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9320001"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9320000"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "930120"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9300000"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920390"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920380"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920370"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920320"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920300"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "920280"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "911100"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "200003"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "200002"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "200001"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "200000"
        version                        = 1
      }
    }
    rules {
      action_name                = "Pre-configured Check Action"
      condition_language         = "JMESPATH"
      is_body_inspection_enabled = true
      name                       = "mysql-protection-rules"
      type                       = "PROTECTION"
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942500"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942362"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942360"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942350"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942320"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942300"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "942270"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9420000"
        version                        = 2
      }
    }
    rules {
      action_name                = "Pre-configured Check Action"
      condition_language         = "JMESPATH"
      is_body_inspection_enabled = true
      name                       = "php-protection-rules"
      type                       = "PROTECTION"
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933210"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933200"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933190"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933180"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933170"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933161"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933160"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933151"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933150"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933140"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933131"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933130"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933120"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933111"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933110"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933100"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "9330000"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202157426"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202153567"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202153566"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "921200"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "20224794"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "20224230"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202221661"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202156905"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202156524"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202156523"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202155838"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202155836"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202155797"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202155778"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202154596"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202142670"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202142669"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202132305"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201950711"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201950709"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201950708"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201949647"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201949646"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201949645"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201947768"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201947767"
        version                        = 1
      }
    }
    rules {
      action_name                = "Pre-configured Check Action"
      condition_language         = "JMESPATH"
      is_body_inspection_enabled = true
      name                       = "apache-protection-rules"
      type                       = "PROTECTION"
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944260"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944152"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944151"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944150"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944130"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944110, 944120"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "944100"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933161"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "933160"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "932160"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "932131"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "932130"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "932105"
        version                        = 3
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202258447"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202224112"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202223944"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202157921"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202156990"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202156989"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202154649"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202144228"
        version                        = 2
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202142013"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "202129592"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "201947649"
        version                        = 1
      }
      protection_capabilities {
        collaborative_action_threshold = 0
        key                            = "2017100"
        version                        = 1
      }
    }
  }
  request_rate_limiting {
  }
  response_access_control {
  }
}

resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" {
    count = var.enable_waf ? 1 : 0
    backend_type = "LOAD_BALANCER"
    compartment_id = var.ocid_compartment_security
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    web_app_firewall_policy_id = oci_waf_web_app_firewall_policy.sei-waf-policy[count.index].id
    display_name = oci_load_balancer_load_balancer.sei_load_balancer_public.display_name
}

resource "oci_logging_log" "waf_log_lb_public" {
    count = var.enable_waf ? 1 : 0 
    display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log"
    log_group_id = oci_logging_log_group.sei_log_group.id
    log_type = "SERVICE"
    configuration {
        source {
            category = "all"
            resource = oci_waf_web_app_firewall.sei_public_load_balancer_waf[count.index].id
            service = "waf"
            source_type = "OCISERVICE"
        }
        compartment_id = var.ocid_compartment_security
    }
    is_enabled = "true"
    retention_duration = "30"
}