Migrate Shield count rules to block

[dms1981]

User Story

As a Modernisation Platform Engineer
I want to help customers implement AWS Shield in production environments
So that they are actively protected against DDOS attacks

Value / Purpose

AWS Shield Advanced is enabled by default across the Modernisation Platform.
As part of #7185 we helped customers to move any click-ops code across to infrastructure-as-code. Some customers have production accounts with count rules which will need to be changed to block for AWS Shield Advanced to actively protect in situations where traffic exceeds a predefined threshold.

A significant number of customers will be managing their AWS Shield WAFv2 ACL rules themselves and so will not fall directly into this ticket, but if time allows we can check *-production accounts to see if any customers are currently using count instead of block after a suitable evaluation period

Useful Contacts

No response

Additional Information

The following accounts still appear to have count set for their AWS WAFv2 ACL rules as part of AWS Shield:

• cdpt-chaps
• cdpt-ifs
• equip
• ppud

Definition of Done

• Owners informed of count being present
• Rules changed to block after discussion with owners
• If time allows, other production accounts checked for presence of count.

[Khatraf]

Modified WAF rule action from count to block for 2 accounts:
PR for cdpt-chaps
PR for cdpt-ifs

For equip and ppud, I have increased the threshold and kept the action as count for continued monitoring.

[Khatraf]

Accounts that have a count action for their AWS WAFv2 ACL rules are:
Pra-register, tipstaff, wardship, ncas and dacp production accounts. Emailed DTS team to inform them and suggested changing it to block if they are satisfied that the current thresholds have been appropriately configured and have not been breached.

[Khatraf]

Changed the WAF rule actions to block for equip and ppud production accounts:
PR for equip
PR for ppud

[markgov]

I have checked everything and it all looks good closing issue