Taskfile.yml

version: '3'
#output: prefixed
env:
  SKIP_QUOTA_CHECK: true
  WAF_TEST: false
  CREATE_DIAGRAM: true
  CDK_DIFF: false
  LASTEST_FIREWALLFACTORY_VERSION:
    sh: curl --silent "https://api.github.com/repos/globaldatanet/aws-firewall-factory/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/'
vars:
  prerequisite:
  config: # without .json
  REGION:
    sh: echo $AWS_REGION
  CDK_DEFAULT_ACCOUNT:
    sh: aws sts get-caller-identity |jq -r .
tasks:
  deploy:
    desc: Deploy Stack
    cmds:
      - task: clean
      - task: cdkdiff
      - task: cdkdeploy
      - task: creatediagram
      - task: testwaf
  synth:
    desc: synth Stack
    cmds:
      - task: clean
      - cdk synth
    vars:
      ACCOUNT:
        sh: aws sts get-caller-identity |jq -r .Account
      TAGS:
        sh: cat tags/tags.json | jq -j '.[]|"--tags " + (.Key)+"="+(.Value)+" "'
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json  
  clean:
    desc: Clean CDK Out
    cmds:
      - rm -rf ./cdk.out
      - rm -rf ./node-modules
    silent: true
  cdkdiff:
    desc: CDK Diff
    cmds:
      - if [[ {{.CDK_DIFF}} = true ]];then cdk diff; echo -n "Continue  (y/n)?"; read CONT; if [ "$CONT" = "n" ]; then echo "NO" | exit 1; else echo "YES"; fi; else exit 0;fi;
    silent: true
    interactive: true
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json
      PREREQUISITE: "{{.prerequisite}}"
    preconditions:
      - sh: "test {{.config}}"
        msg: "config Variable was not set"
      - sh: "test -f values/{{.config}}.json"
        msg: "Values file not found: values/{{.config}}.json"
  cdkdeploy:
    desc: CDK Deploy
    cmds:
      - cdk deploy --require-approval never {{.TAGS}}
      - rm -f $(find ./cdk.out/*assets.json -type f) &> /dev/null
    vars:
      ACCOUNT:
        sh: aws sts get-caller-identity |jq -r .Account
      TAGS:
        sh: cat tags/tags.json | jq -j '.[]|"--tags " + (.Key)+"="+(.Value)+" "'
    preconditions:
      - sh: "test {{.config}}"
        msg: "config Variable was not set"
      - sh: "test -f values/{{.config}}.json"
        msg: "Values file not found: values/{{.config}}.json"
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json
      PREREQUISITE: "{{.prerequisite}}"
    silent: true
    interactive: true
  creatediagram:
    desc: Create Diagram
    cmds:
      - if [[ {{.CREATE_DIAGRAM}} = true ]] ; then echo 🤳🏻 $(cfn-dia draw.io -t cdk.out/"$(cat values/{{.config}}.json | jq -r '.General.Prefix')-WAF-$(cat values/{{.config}}.json | jq -r '.WebAcl.Name')-$(cat values/{{.config}}.json | jq -r '.General.Stage')-$(cat values/{{.config}}.json | jq -r '.General.DeployHash')".template.json --output-file $(sed "s/values/diagrams/g;s/.json/.drawio/g" <<< values/{{.config}}.json) --ci-mode --skip-synth); else echo ⏭   Skipping Diagram generation 🤳🏻 ; fi
    silent: true
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json
  testwaf:
    desc: Test of your waf using GoTestWAF
    cmds:
      - |
        if [[ {{.WAF_TEST}} == true ]]; then
          echo 🧪  Testing of your new 🔥 WAF using GoTestWAF

          items=$(cat values/{{.config}}.json | jq -r '.[] | .SecuredDomain[]?')
          for item in ${items[@]}; do
              echo "Using fqdn in 🖥 url : $item"
              ./gotestwaf/gotestwaf --url https://$item --workers 50 --blockConnReset  --wafName="$(cat values/{{.config}}.json | jq -r '.General.Prefix')-$(cat values/{{.config}}.json | jq -r '.WebAcl.Name')-$(cat values/{{.config}}.json | jq -r '.General.Stage')-$(cat values/{{.config}}.json | jq -r '.General.DeployHash')" --configPath=./gotestwaf/config.yaml --testCasesPath=./gotestwaf/testcases --skipWAFBlockCheck --reportPath "./waf-evaluation-report/$(date '+%Y-%m-%d')" --reportName "$(cat values/{{.config}}.json | jq -r '.General.Prefix')-$(cat values/{{.config}}.json | jq -r '.WebAcl.Name')-$(cat values/{{.config}}.json | jq -r '.General.Stage')-$(cat values/{{.config}}.json | jq -r '.General.DeployHash')"
          done
        else
          echo "⏭ Skipping WAF Testing 🧪"
        fi
    silent: true
  validateconfig:
    desc: Validates the current config
    cmds:
      - ts-node test/config-loader.ts
    silent: true
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json
    preconditions:
      - sh: "test {{.config}}"
        msg: "config Variable was not set"
      - sh: "test -f values/{{.config}}.json"
        msg: "Values file not found: values/{{.config}}.json"
  generateconfig:
    desc: Generate skeleton for a waf configuration file
    cmds:
      - if [[ "{{.config}}" ]] ; then ts-node lib/tools/generate-skeleton.ts >> values/{{.config}}.json ; else ts-node lib/tools/generate-skeleton.ts ; fi
    silent: true
  generateowasptoptenconfig:
    desc: Generate skeleton for a waf configuration file with owasp top 10
    cmds:
      - if [[ "{{.config}}" ]] ; then ts-node lib/tools/get-owasp-top10-waf.ts >> values/{{.config}}.json ; else ts-node lib/tools/get-owasp-top10-waf.ts ; fi
    silent: true
  generateprerequisitesconfig:
    desc: Generate skeleton for a prerequisites configuration
    cmds:
      - if [[ "{{.config}}" ]] ; then ts-node lib/tools/generate-prerequisites-skeleton.ts >> values/{{.config}}.json ; else ts-node lib/tools/generate-prerequisites-skeleton.ts ; fi
    silent: true