diff --git a/README.md b/README.md index aaa564e..794b23f 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,7 @@ Available targets: | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` |
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
}
| no | | [custom\_response\_body](#input\_custom\_response\_body) | Defines custom response bodies that can be referenced by custom\_response actions.
The map keys are used as the `key` attribute which is a unique key identifying the custom response body.
content:
Payload of the custom response.
The response body can be plain text, HTML or JSON and cannot exceed 4KB in size.
content\_type:
Content Type of Response Body.
Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`. |
map(object({
content = string
content_type = string
}))
| `{}` | no | | [default\_action](#input\_default\_action) | Specifies that AWS WAF should allow requests by default. Possible values: `allow`, `block`. | `string` | `"block"` | no | +| [default\_block\_custom\_response\_body\_key](#input\_default\_block\_custom\_response\_body\_key) | References the default response body that you want AWS WAF to return to the web request client.
This must reference a key defined in a custom\_response\_body block of this resource.
Only takes effect if default\_action is set to `block`. | `string` | `null` | no | | [default\_block\_response](#input\_default\_block\_response) | A HTTP response code that is sent when default block action is used. Only takes effect if default\_action is set to `block`. | `string` | `null` | no | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | [description](#input\_description) | A friendly description of the WebACL. | `string` | `"Managed by Terraform"` | no | diff --git a/docs/terraform.md b/docs/terraform.md index f82f700..c0a79bd 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -39,6 +39,7 @@ | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` |
{
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
}
| no | | [custom\_response\_body](#input\_custom\_response\_body) | Defines custom response bodies that can be referenced by custom\_response actions.
The map keys are used as the `key` attribute which is a unique key identifying the custom response body.
content:
Payload of the custom response.
The response body can be plain text, HTML or JSON and cannot exceed 4KB in size.
content\_type:
Content Type of Response Body.
Valid values are `TEXT_PLAIN`, `TEXT_HTML`, or `APPLICATION_JSON`. |
map(object({
content = string
content_type = string
}))
| `{}` | no | | [default\_action](#input\_default\_action) | Specifies that AWS WAF should allow requests by default. Possible values: `allow`, `block`. | `string` | `"block"` | no | +| [default\_block\_custom\_response\_body\_key](#input\_default\_block\_custom\_response\_body\_key) | References the default response body that you want AWS WAF to return to the web request client.
This must reference a key defined in a custom\_response\_body block of this resource.
Only takes effect if default\_action is set to `block`. | `string` | `null` | no | | [default\_block\_response](#input\_default\_block\_response) | A HTTP response code that is sent when default block action is used. Only takes effect if default\_action is set to `block`. | `string` | `null` | no | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | | [description](#input\_description) | A friendly description of the WebACL. | `string` | `"Managed by Terraform"` | no | diff --git a/rules.tf b/rules.tf index 74522c8..459f147 100644 --- a/rules.tf +++ b/rules.tf @@ -88,6 +88,8 @@ locals { rule.action, ) => rule } : {} + + default_custom_response_body_key = var.default_block_custom_response_body_key != null ? contains(keys(var.custom_response_body), var.default_block_custom_response_body_key) ? var.default_block_custom_response_body_key : null : null } resource "aws_wafv2_web_acl" "default" { @@ -111,7 +113,8 @@ resource "aws_wafv2_web_acl" "default" { dynamic "custom_response" { for_each = var.default_block_response != null ? [true] : [] content { - response_code = var.default_block_response + response_code = var.default_block_response + custom_response_body_key = local.default_custom_response_body_key } } } diff --git a/variables.tf b/variables.tf index d5384be..3d5e991 100644 --- a/variables.tf +++ b/variables.tf @@ -1047,3 +1047,14 @@ variable "default_block_response" { DOC nullable = true } + +variable "default_block_custom_response_body_key" { + type = string + default = null + description = <<-DOC + References the default response body that you want AWS WAF to return to the web request client. + This must reference a key defined in a custom_response_body block of this resource. + Only takes effect if default_action is set to `block`. + DOC + nullable = true +}