如何从 AWS WAF Terraform 资源中动态排除可变规则列表 aws_wafv2_web_acl

Question

我正在尝试使用具有多个规则的 Terraform 创建 AWS WEB-ACL，还想从 AWS Managed 规则集中排除多个规则。但我无法动态排除来自变量的多个规则。这是我的代码。

variable.tfvars

# Region
region="us-east-1"

# Environment
environment="nonprod"


# ACLs Definations
acls = {
  web: {
    AWSManagedRuleSets: [
      {
        name: "AWSManagedRulesCommonRuleSet",
        vendor_name: "AWS",
        excluded_rule: [
          "SizeRestrictions_QUERYSTRING",
          "NoUserAgent_HEADER"
        ]
      }
    ]
  },

  api: {
    AWSManagedRuleSets: [
      {
        name: "AWSManagedRulesCommonRuleSet",
        vendor_name: "AWS",
        excluded_rule: [
          "SizeRestrictions_QUERYSTRING",
          "NoUserAgent_HEADER"
        ]
      },
      {
        name: "AWSManagedRulesLinuxRuleSet",
        vendor_name: "AWS",
        excluded_rule: []
      }
    ]
  },
}

main.tf

resource "aws_wafv2_web_acl" "web_acl" {
  for_each = var.acls
  name        = "waf-web-acl-${lower(var.environment)}-${each.key}"
  description = "WAF ACL ap-${each.key} for env ${lower(var.environment)}"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }


  dynamic "rule" {
    for_each = var.acls[each.key]["AWSManagedRuleSets"]
    content {
      name = rule.value.name
      priority = 0
      override_action {
        count {}
      }
      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = rule.value.vendor_name
//    HERE I WANNA EXCLUDE ALL THE RULE LISTED IN VARIABLE
//          excluded_rule = rule.value.excluded_rule
//          excluded_rule {
//            name = "SizeRestrictions_QUERYSTRING"
//          }
//          excluded_rule {
//            name = "NoUserAgent_HEADER"
//          }
        }
      }
      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = "waf-rule-${lower(var.environment)}-${each.key}-${rule.value.name}"
        sampled_requests_enabled   = true
      }
    }
}

  tags = {
    ManagedBy = "Terraform"
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "waf-web-acl-${lower(var.environment)}-${each.key}"
    sampled_requests_enabled   = true
  }
}

Answer 1

我无法访问 AWS，但我认为可以使用如下所示的嵌套 block..

dynamic "rule" {
    for_each = var.acls[each.key]["AWSManagedRuleSets"]
    content {
      name = rule.value.name
      priority = 0
      override_action {
        count {}
      }
      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = rule.value.vendor_name
        }
        // another for_each loop to iterate over excluded_rule list
        dynamic "excluded_rule" {
          for_each = rule.value.excluded_rule
          content {
            name = excluded_rule.value
          }
        }
      }
      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = "waf-rule-${lower(var.environment)}-${each.key}-${rule.value.name}"
        sampled_requests_enabled   = true
      }
    }
}

如何从 AWS WAF Terraform 资源中动态排除可变规则列表 aws_wafv2_web_acl

How to Exclude list of variablized rules dynamically from AWS WAF Terraform resource aws_wafv2_web_acl

terraform

amazon-waf

terraform-provider-aws