Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wafv2/web_acl: Handle the removal of the ShieldMitigationRuleGroup on resource update #33216

Merged
merged 8 commits into from
Aug 31, 2023
Merged

wafv2/web_acl: Handle the removal of the ShieldMitigationRuleGroup on resource update #33216

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
67d1711
include AWS managed shieldmitigationrulegroup to set of rules to upda…
vini-mw Aug 29, 2023
3885df6
add changelog.txt file
vini-mw Aug 29, 2023
a1b9f85
Merge branch 'main' into HEAD
ewbankkit Aug 31, 2023
d405470
Tweak CHANGELOG entry.
ewbankkit Aug 31, 2023
527163c
wafv2: Use generated paginators.
ewbankkit Aug 31, 2023
b2cb7cb
r/aws_wafv2_web_acl: Avoid duplicate ShieldMitigationRuleGroup rules …
ewbankkit Aug 31, 2023
354254a
r/aws_wafv2_web_acl: Tidy up acceptance tests.
ewbankkit Aug 31, 2023
ec6b178
Fix golangci-lint 'gocritic'.
ewbankkit Aug 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions internal/service/wafv2/web_acl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,14 @@ func resourceWebACLRead(ctx context.Context, d *schema.ResourceData, meta interf
func resourceWebACLUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
conn := meta.(*conns.AWSClient).WAFV2Conn(ctx)

// Find the AWS managed ShieldMitigationRuleGroup group rule if existent and add it into the set of rules to update
// so that the provider will not remove the Shield rule when changes are applied to the WebACL
output, err := FindWebACLByThreePartKey(ctx, conn, d.Id(), d.Get("name").(string), d.Get("scope").(string))
if err != nil {
return diag.Errorf("reading WAFv2 WebACL (%s): %s", d.Id(), err)
}
rules := append(expandWebACLRules(d.Get("rule").(*schema.Set).List()), findShieldRule(output.WebACL.Rules)...)

if d.HasChangesExcept("tags", "tags_all") {
input := &wafv2.UpdateWebACLInput{
AssociationConfig: expandAssociationConfig(d.Get("association_config").([]interface{})),
Expand All @@ -271,7 +279,7 @@ func resourceWebACLUpdate(ctx context.Context, d *schema.ResourceData, meta inte
Id: aws.String(d.Id()),
LockToken: aws.String(d.Get("lock_token").(string)),
Name: aws.String(d.Get("name").(string)),
Rules: expandWebACLRules(d.Get("rule").(*schema.Set).List()),
Rules: rules,
Scope: aws.String(d.Get("scope").(string)),
VisibilityConfig: expandVisibilityConfig(d.Get("visibility_config").([]interface{})),
}
Expand Down Expand Up @@ -364,9 +372,14 @@ func FindWebACLByThreePartKey(ctx context.Context, conn *wafv2.WAFV2, id, name,
// See https://docs.aws.amazon.com/waf/latest/developerguide/ddos-automatic-app-layer-response-rg.html
func filterWebACLRules(rules, configRules []*wafv2.Rule) []*wafv2.Rule {
var fr []*wafv2.Rule
pattern := `^ShieldMitigationRuleGroup_\d{12}_[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}_.*`
sr := findShieldRule(rules)

if len(sr) == 0 {
return rules
}

for _, r := range rules {
if regexache.MustCompile(pattern).MatchString(aws.StringValue(r.Name)) {
if aws.StringValue(r.Name) == aws.StringValue(sr[0].Name) {
filter := true
for _, cr := range configRules {
if aws.StringValue(cr.Name) == aws.StringValue(r.Name) {
Expand All @@ -383,3 +396,14 @@ func filterWebACLRules(rules, configRules []*wafv2.Rule) []*wafv2.Rule {
}
return fr
}

func findShieldRule(rules []*wafv2.Rule) []*wafv2.Rule {
pattern := `^ShieldMitigationRuleGroup_\d{12}_[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}_.*`
var sr []*wafv2.Rule
for _, r := range rules {
if regexache.MustCompile(pattern).MatchString(aws.StringValue(r.Name)) {
sr = append(sr, r)
}
}
return sr
}