Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_web_application_firewall_policy - support managed_rules #6126

Merged
merged 16 commits into from
Apr 26, 2020
Merged

azurerm_web_application_firewall_policy - support managed_rules #6126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
2e37a00
Add "managed_rules" to azurerm_web_application_firewall_policy
sirlatrom Mar 16, 2020
e34b12c
Add website docs for "managed_rules" in azurerm_web_application_firew…
sirlatrom Mar 16, 2020
f662913
Add nil check for "rule_group_overrides"
sirlatrom Mar 16, 2020
9abcde0
Fix lint errors
sirlatrom Mar 17, 2020
85c6f0e
Shorten "rule_set_*" properties and list some possible values in docs
sirlatrom Mar 21, 2020
882ffd7
Revert plurality normalization
sirlatrom Mar 21, 2020
992e989
Fix reading "rule_group_override" property
sirlatrom Mar 23, 2020
733ea5e
Set new properties in test
sirlatrom Mar 25, 2020
ec8202a
Align test with required properties
sirlatrom Mar 30, 2020
bdc3eea
Ensure managed_rules is considered a list, and add to update test
sirlatrom Apr 2, 2020
1c3f166
Streamline validation of rule type, rule version and disabled rule gr…
sirlatrom Apr 2, 2020
14177bd
Added version 1.0 to rule set versions
sirlatrom Apr 5, 2020
c98ebdd
Add "managed_rules" to azurerm_web_application_firewall_policy
sirlatrom Mar 16, 2020
a2bb6c2
Add website docs for "managed_rules" in azurerm_web_application_firew…
sirlatrom Mar 16, 2020
e838ca2
Revert plurality normalization
sirlatrom Mar 21, 2020
94b5e9d
Fix indentation
sirlatrom Apr 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions azurerm/helpers/validate/web_application_firewall_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
package validate

import "github.com/hashicorp/terraform-plugin-sdk/helper/validation"

var ValidateWebApplicationFirewallPolicyRuleGroupName = validation.StringInSlice([]string{
"crs_20_protocol_violations",
"crs_21_protocol_anomalies",
"crs_23_request_limits",
"crs_30_http_policy",
"crs_35_bad_robots",
"crs_40_generic_attacks",
"crs_41_sql_injection_attacks",
"crs_41_xss_attacks",
"crs_42_tight_security",
"crs_45_trojans",
"General",
"REQUEST-911-METHOD-ENFORCEMENT",
"REQUEST-913-SCANNER-DETECTION",
"REQUEST-920-PROTOCOL-ENFORCEMENT",
"REQUEST-921-PROTOCOL-ATTACK",
"REQUEST-930-APPLICATION-ATTACK-LFI",
"REQUEST-931-APPLICATION-ATTACK-RFI",
"REQUEST-932-APPLICATION-ATTACK-RCE",
"REQUEST-933-APPLICATION-ATTACK-PHP",
"REQUEST-941-APPLICATION-ATTACK-XSS",
"REQUEST-942-APPLICATION-ATTACK-SQLI",
"REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION",
}, false)

var ValidateWebApplicationFirewallPolicyRuleSetVersion = validation.StringInSlice([]string{
"1.0",
"2.2.9",
"3.0",
"3.1",
}, false)

var ValidateWebApplicationFirewallPolicyRuleSetType = validation.StringInSlice([]string{
"OWASP",
"Microsoft_BotManagerRuleSet",
}, false)
61 changes: 18 additions & 43 deletions azurerm/internal/services/network/resource_arm_application_gateway.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1170,19 +1170,16 @@ func resourceArmApplicationGateway() *schema.Resource {
},

"rule_set_type": {
Type: schema.TypeString,
Optional: true,
Default: "OWASP",
Type: schema.TypeString,
Optional: true,
Default: "OWASP",
ValidateFunc: validate.ValidateWebApplicationFirewallPolicyRuleSetType,
},

"rule_set_version": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice([]string{
"2.2.9",
"3.0",
"3.1",
}, false),
Type: schema.TypeString,
Required: true,
ValidateFunc: validate.ValidateWebApplicationFirewallPolicyRuleSetVersion,
},
"file_upload_limit_mb": {
Type: schema.TypeInt,
Expand All @@ -1207,32 +1204,9 @@ func resourceArmApplicationGateway() *schema.Resource {
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"rule_group_name": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice([]string{
"crs_20_protocol_violations",
"crs_21_protocol_anomalies",
"crs_23_request_limits",
"crs_30_http_policy",
"crs_35_bad_robots",
"crs_40_generic_attacks",
"crs_41_sql_injection_attacks",
"crs_41_xss_attacks",
"crs_42_tight_security",
"crs_45_trojans",
"General",
"REQUEST-911-METHOD-ENFORCEMENT",
"REQUEST-913-SCANNER-DETECTION",
"REQUEST-920-PROTOCOL-ENFORCEMENT",
"REQUEST-921-PROTOCOL-ATTACK",
"REQUEST-930-APPLICATION-ATTACK-LFI",
"REQUEST-931-APPLICATION-ATTACK-RFI",
"REQUEST-932-APPLICATION-ATTACK-RCE",
"REQUEST-933-APPLICATION-ATTACK-PHP",
"REQUEST-941-APPLICATION-ATTACK-XSS",
"REQUEST-942-APPLICATION-ATTACK-SQLI",
"REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION",
}, false),
Type: schema.TypeString,
Required: true,
ValidateFunc: validate.ValidateWebApplicationFirewallPolicyRuleGroupName,
},

"rules": {
Expand All @@ -1255,19 +1229,20 @@ func resourceArmApplicationGateway() *schema.Resource {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice([]string{
"RequestHeaderNames",
"RequestArgNames",
"RequestCookieNames",
string(network.RequestArgNames),
string(network.RequestCookieNames),
string(network.RequestHeaderNames),
}, false),
},

"selector_match_operator": {
Type: schema.TypeString,
ValidateFunc: validation.StringInSlice([]string{
"Equals",
"StartsWith",
"EndsWith",
"Contains",
string(network.OwaspCrsExclusionEntrySelectorMatchOperatorContains),
string(network.OwaspCrsExclusionEntrySelectorMatchOperatorEndsWith),
string(network.OwaspCrsExclusionEntrySelectorMatchOperatorEquals),
string(network.OwaspCrsExclusionEntrySelectorMatchOperatorEqualsAny),
string(network.OwaspCrsExclusionEntrySelectorMatchOperatorStartsWith),
}, false),
Optional: true,
},
Expand Down
Loading