diff --git a/README.md b/README.md
index aaa564e..794b23f 100644
--- a/README.md
+++ b/README.md
@@ -181,6 +181,7 @@ Available targets:
| [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` |
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
}
| no |
| [custom\_response\_body](#input\_custom\_response\_body) | Defines custom response bodies that can be referenced by custom\_response actions.
The map keys are used as the `key` attribute which is a unique key identifying the custom response body.
content:
Payload of the custom response.
The response body can be plain text, HTML or JSON and cannot exceed 4KB in size.
content\_type:
Content Type of Response Body.
Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`. | map(object({
content = string
content_type = string
}))
| `{}` | no |
| [default\_action](#input\_default\_action) | Specifies that AWS WAF should allow requests by default. Possible values: `allow`, `block`. | `string` | `"block"` | no |
+| [default\_block\_custom\_response\_body\_key](#input\_default\_block\_custom\_response\_body\_key) | References the default response body that you want AWS WAF to return to the web request client.
This must reference a key defined in a custom\_response\_body block of this resource.
Only takes effect if default\_action is set to `block`. | `string` | `null` | no |
| [default\_block\_response](#input\_default\_block\_response) | A HTTP response code that is sent when default block action is used. Only takes effect if default\_action is set to `block`. | `string` | `null` | no |
| [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
| [description](#input\_description) | A friendly description of the WebACL. | `string` | `"Managed by Terraform"` | no |
diff --git a/docs/terraform.md b/docs/terraform.md
index f82f700..c0a79bd 100644
--- a/docs/terraform.md
+++ b/docs/terraform.md
@@ -39,6 +39,7 @@
| [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | {
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
}
| no |
| [custom\_response\_body](#input\_custom\_response\_body) | Defines custom response bodies that can be referenced by custom\_response actions.
The map keys are used as the `key` attribute which is a unique key identifying the custom response body.
content:
Payload of the custom response.
The response body can be plain text, HTML or JSON and cannot exceed 4KB in size.
content\_type:
Content Type of Response Body.
Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`. | map(object({
content = string
content_type = string
}))
| `{}` | no |
| [default\_action](#input\_default\_action) | Specifies that AWS WAF should allow requests by default. Possible values: `allow`, `block`. | `string` | `"block"` | no |
+| [default\_block\_custom\_response\_body\_key](#input\_default\_block\_custom\_response\_body\_key) | References the default response body that you want AWS WAF to return to the web request client.
This must reference a key defined in a custom\_response\_body block of this resource.
Only takes effect if default\_action is set to `block`. | `string` | `null` | no |
| [default\_block\_response](#input\_default\_block\_response) | A HTTP response code that is sent when default block action is used. Only takes effect if default\_action is set to `block`. | `string` | `null` | no |
| [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
| [description](#input\_description) | A friendly description of the WebACL. | `string` | `"Managed by Terraform"` | no |
diff --git a/rules.tf b/rules.tf
index 74522c8..459f147 100644
--- a/rules.tf
+++ b/rules.tf
@@ -88,6 +88,8 @@ locals {
rule.action,
) => rule
} : {}
+
+ default_custom_response_body_key = var.default_block_custom_response_body_key != null ? contains(keys(var.custom_response_body), var.default_block_custom_response_body_key) ? var.default_block_custom_response_body_key : null : null
}
resource "aws_wafv2_web_acl" "default" {
@@ -111,7 +113,8 @@ resource "aws_wafv2_web_acl" "default" {
dynamic "custom_response" {
for_each = var.default_block_response != null ? [true] : []
content {
- response_code = var.default_block_response
+ response_code = var.default_block_response
+ custom_response_body_key = local.default_custom_response_body_key
}
}
}
diff --git a/variables.tf b/variables.tf
index d5384be..3d5e991 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1047,3 +1047,14 @@ variable "default_block_response" {
DOC
nullable = true
}
+
+variable "default_block_custom_response_body_key" {
+ type = string
+ default = null
+ description = <<-DOC
+ References the default response body that you want AWS WAF to return to the web request client.
+ This must reference a key defined in a custom_response_body block of this resource.
+ Only takes effect if default_action is set to `block`.
+ DOC
+ nullable = true
+}