Skip to content

Commit

Permalink
Merge pull request #14685 from terraform-providers/f-wafv2-forwarded-…
Browse files Browse the repository at this point in the history 
…ip-config

resources/wafv2_web_acl and wafv2_rule_group: add support for ForwardedIPConfig
  • Loading branch information
@anGie44
anGie44 authored Aug 20, 2020
2 parents 27f41f1 + da678e4 commit bd7df15
Show file tree
Hide file tree
Showing 6 changed files with 581 additions and 21 deletions.
121 changes: 110 additions & 11 deletions aws/resource_aws_wafv2_rule_group_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -689,11 +689,12 @@ func TestAccAwsWafv2RuleGroup_GeoMatchStatement(t *testing.T) {
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "2",
"statement.0.geo_match_statement.0.country_codes.0": "US",
"statement.0.geo_match_statement.0.country_codes.1": "NL",
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "2",
"statement.0.geo_match_statement.0.country_codes.0": "US",
"statement.0.geo_match_statement.0.country_codes.1": "NL",
"statement.0.geo_match_statement.0.forwarded_ip_config.#": "0",
}),
),
},
Expand All @@ -704,12 +705,69 @@ func TestAccAwsWafv2RuleGroup_GeoMatchStatement(t *testing.T) {
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "3",
"statement.0.geo_match_statement.0.country_codes.0": "ZM",
"statement.0.geo_match_statement.0.country_codes.1": "EE",
"statement.0.geo_match_statement.0.country_codes.2": "MM",
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "3",
"statement.0.geo_match_statement.0.country_codes.0": "ZM",
"statement.0.geo_match_statement.0.country_codes.1": "EE",
"statement.0.geo_match_statement.0.country_codes.2": "MM",
"statement.0.geo_match_statement.0.forwarded_ip_config.#": "0",
}),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateIdFunc: testAccAwsWafv2RuleGroupImportStateIdFunc(resourceName),
},
},
})
}

func TestAccAwsWafv2RuleGroup_GeoMatchStatement_ForwardedIPConfig(t *testing.T) {
var v wafv2.RuleGroup
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
resourceName := "aws_wafv2_rule_group.test"

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckAwsWafv2RuleGroupDestroy,
Steps: []resource.TestStep{
{
Config: testAccAwsWafv2RuleGroupConfig_GeoMatchStatement_ForwardedIPConfig(ruleGroupName, "MATCH", "X-Forwarded-For"),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "2",
"statement.0.geo_match_statement.0.country_codes.0": "US",
"statement.0.geo_match_statement.0.country_codes.1": "NL",
"statement.0.geo_match_statement.0.forwarded_ip_config.#": "1",
"statement.0.geo_match_statement.0.forwarded_ip_config.0.fallback_behavior": "MATCH",
"statement.0.geo_match_statement.0.forwarded_ip_config.0.header_name": "X-Forwarded-For",
}),
),
},
{
Config: testAccAwsWafv2RuleGroupConfig_GeoMatchStatement_ForwardedIPConfig(ruleGroupName, "NO_MATCH", "Updated"),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
tfawsresource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"statement.#": "1",
"statement.0.geo_match_statement.#": "1",
"statement.0.geo_match_statement.0.country_codes.#": "2",
"statement.0.geo_match_statement.0.country_codes.0": "US",
"statement.0.geo_match_statement.0.country_codes.1": "NL",
"statement.0.geo_match_statement.0.forwarded_ip_config.#": "1",
"statement.0.geo_match_statement.0.forwarded_ip_config.0.fallback_behavior": "NO_MATCH",
"statement.0.geo_match_statement.0.forwarded_ip_config.0.header_name": "Updated",
}),
),
},
Expand Down Expand Up @@ -2077,6 +2135,47 @@ resource "aws_wafv2_rule_group" "test" {
`, name)
}

func testAccAwsWafv2RuleGroupConfig_GeoMatchStatement_ForwardedIPConfig(name, fallbackBehavior, headerName string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
capacity = 2
name = "%s"
scope = "REGIONAL"
rule {
name = "rule-1"
priority = 1
action {
allow {}
}
statement {
geo_match_statement {
country_codes = ["US", "NL"]
forwarded_ip_config {
fallback_behavior = "%s"
header_name = "%s"
}
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-rule-metric-name"
sampled_requests_enabled = false
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-metric-name"
sampled_requests_enabled = false
}
}
`, name, fallbackBehavior, headerName)
}

func testAccAwsWafv2RuleGroupConfig_GeoMatchStatement_Update(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
Expand Down
18 changes: 11 additions & 7 deletions aws/resource_aws_wafv2_web_acl.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -401,15 +401,14 @@ func wafv2RateBasedStatementSchema(level int) *schema.Schema {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
// Required field but currently only supports "IP"
// Required field
"aggregate_key_type": {
Type: schema.TypeString,
Optional: true,
Default: wafv2.RateBasedStatementAggregateKeyTypeIp,
ValidateFunc: validation.StringInSlice([]string{
wafv2.RateBasedStatementAggregateKeyTypeIp,
}, false),
Type: schema.TypeString,
Optional: true,
Default: wafv2.RateBasedStatementAggregateKeyTypeIp,
ValidateFunc: validation.StringInSlice(wafv2.RateBasedStatementAggregateKeyType_Values(), false),
},
"forwarded_ip_config": wafv2ForwardedIPConfig(),
"limit": {
Type: schema.TypeInt,
Required: true,
Expand Down Expand Up @@ -627,6 +626,10 @@ func expandWafv2RateBasedStatement(l []interface{}) *wafv2.RateBasedStatement {
Limit: aws.Int64(int64(m["limit"].(int))),
}

if v, ok := m["forwarded_ip_config"]; ok {
r.ForwardedIPConfig = expandWafv2ForwardedIPConfig(v.([]interface{}))
}

s := m["scope_down_statement"].([]interface{})
if len(s) > 0 && s[0] != nil {
r.ScopeDownStatement = expandWafv2Statement(s[0].(map[string]interface{}))
Expand Down Expand Up @@ -819,6 +822,7 @@ func flattenWafv2RateBasedStatement(r *wafv2.RateBasedStatement) interface{} {
m := map[string]interface{}{
"limit": int(aws.Int64Value(r.Limit)),
"aggregate_key_type": aws.StringValue(r.AggregateKeyType),
"forwarded_ip_config": flattenWafv2ForwardedIPConfig(r.ForwardedIPConfig),
"scope_down_statement": nil,
}

Expand Down
Loading

0 comments on commit bd7df15

Please sign in to comment.