SPIKE: Revisit programmatic application of AWS Shield Advanced

[dms1981]

User Story

As a modernisation platform engineer
I want to programatically apply AWS Shield Advanced
So that I remove manual steps, reducing workload and enforcing consistency

User Type(s)

Modernisation Platform Customer

Value

Given that aws_shield_protection exists as a terraform resource, we should evaluate if we can make use of it to provide protection to resources in production accounts. We have steps to do so manually, but given our GitOps and Infrastructure-As-Code approach, we should assess if we can carry out these manually steps with automation

Questions / Assumptions / Hypothesis

• aws_shield_protection and related resources cover our use case
• Any outstanding use-cases such as SRT access are addressed by the Terraform team (AWS Shield Advanced Enablement - DRT Role  hashicorp/terraform-provider-aws#22848)

Proposal

Definition of done

• suitable timebox established
• mapping of manual actions to automated actions created
• any missing actions identified
• assessment on if we can automate this through terraform made

Reference

How to write good user stories
Enabling AWS Shield Advanced

[dms1981]

hashicorp/terraform-provider-aws#22869 - discussion on the issues inherent with getting the WAFv2 ACL for auto remediation

[dms1981]

Having looked at this we can do some things, but not all things:

• Cloudwatch alarm & SNS notification
• [] Enable SRT access
• Enable AWS Shield for LB / EIP
• [] Associate AWS Shield WAFv2 ACL
• [] Set up rate limiting thresholds and set to count or block

SRT access / associating the DRT role doesn't look to be particularly difficult, but would need to be done through something like a local-exec and that would need considering in the context of github actions.

Associating the relevant WAFv2 ACL looks more challenging, however, as the format for the rule group - ShieldMitigationRuleGroup_account-id_web-acl-id_unique-identifier - does not appear suitable for the available queries I looked at via the AWS CLI tools for wafv2. I expect that even though data calls are available in Terraform they will be subject to the same requirement.

What's also unclear is the ability to add an action - eg, COUNT - a managed rule group through terraform.

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/shield/associate-drt-role.html

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/wafv2/list-rule-groups.html