azurerm_web_application_firewall_policy - fix the value of rule_group_name does not exist for Application Gateway Firewall

[sinbai]

After testing, the following values of rule_group_name of DRS do not exist for Application Gateway Firewall.
"APPLICATION-ATTACK-LFI",
"APPLICATION-ATTACK-RFI",
"APPLICATION-ATTACK-RCE",
"APPLICATION-ATTACK-PHP",
"APPLICATION-ATTACK-NodeJS",
"APPLICATION-ATTACK-XSS",
"APPLICATION-ATTACK-SQLI",
"APPLICATION-ATTACK-SESSION-FIXATION",
"APPLICATION-ATTACK-SESSION-JAVA"

The facts should look like this:
"LFI",
"RFI",
"RCE",
"PHP",
"NODEJS",
"XSS",
"SQLI",
"FIX",
"JAVA"

Submit this PR to update rule_group_name in order to fix #24160.

Test result:
PASS: TestAccWebApplicationFirewallPolicy_ManagedRuleSetDRS (312.58s)

[stephybun]

@sinbai - I think this can be fixed in a more straight forward way depending on what the API accepts. Please take a look at the comments left in-line.

[stephybun]

If the API doesn't accept any of these values then we can probably just remove these from the validation function instead of adding a conversion function here?

[sinbai]

fixed.

[stephybun]

Then we can also remove this unnecessary conversion.

[sinbai]

fixed.

[alexdokka]

maybe it’s better to just add new values (needed for Microsoft_DefaultRuleSet 2.1 ) and don't touch the old ones (needed for OWASP 3.2) ?

[stephybun]

@alexdokka if the old ones are still valid for a different configuration then I agree, we should just add the new ones.

[sinbai]

maybe it’s better to just add new values (needed for Microsoft_DefaultRuleSet 2.1 ) and don't touch the old ones (needed for OWASP 3.2) ?

@alexdokka In fact, the old ones are not supported by the other versions either.

[sinbai]

@sinbai - I think this can be fixed in a more straight forward way depending on what the API accepts. Please take a look at the comments left in-line.

Hi @stephybun thanks for your feedback. The code has been updated. Could you please take another look?

[stephybun]

Thanks for updating the validation values and for checking the behaviour of the API @sinbai

There are actually two values that are missing from the validation and I think it'd be helpful to add a comment that will enable us to keep these values up to date.

Once those two additions are in this is good to go!

[stephybun]

Looking into this further there is a command which returns a list of supported rule set names and there are two that are still missing. Can you please add crs_49_inbound_blocking and KnownBadBots to the validation.

Can you also please add the following comment in this validation function - It will be helpful to ensure this list remains up to date:

// The following command will return a list of available Rule Group Names with information on whether the rules are GA, Deprecated, etc.:
// az rest --method get --url “https://management.azure.com/subscriptions/{subscription_id_here}/providers/Microsoft.Network/locations/{location}/applicationGatewayWafDynamicManifests/default?api-version=2023-05-01” --query “properties.availableRuleSets[].ruleGroups[].ruleGroupName” | sort | uniq

[sinbai]

Great suggestion about adding above comment, the code has been updated. Could you please take a look at it again?

[katbyte]

LGTM 🧯

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.