Repository: hashicorp/terraform-provider-azurerm

Issue #19347: Support for WAF Policy Rule Group Override
Created: 2022-11-17T09:01:55Z
Is there an existing issue for this?

 I have searched the existing issues

Community Note


Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment


Description
When configuring WAF policy, we need to change default action (AnomalyScoring) for default managed rules.
ARM support this in Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies API version 2022-05-01, but terraform doesn't.
New or Affected Resource(s)/Data Source(s)
azurerm_web_application_firewall_policy
Potential Terraform Configuration
resource "azurerm_web_application_firewall_policy" "example" {
  name                = "wafpolicy"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  managed_rules {
    managed_rule_set {
      type    = "OWASP"
      version = "3.2"

      rule_group_override {
        rule_group_name = "General"
        disabled_rules  = []
        rules = [
          rule {
            ruleId = "200004",
            state = "Enabled",
            action = "Log"
          }

          rule {
            ruleId = "200002",
            state = "Enabled",
            action = "Block"
          }
        ]
      }
    }
  }
}
References

https://learn.microsoft.com/en-us/azure/templates/microsoft.network/change-log/applicationgatewaywebapplicationfirewallpolicies
https://learn.microsoft.com/en-us/azure/templates/microsoft.network/2022-05-01/applicationgatewaywebapplicationfirewallpolicies?pivots=deployment-language-bicep#managedruleoverride

Duplicate issue #19212: [WAF] Terraform not support "Action" parameter on Managed rules
Created: 2022-11-09T09:27:27Z
Is there an existing issue for this?

 I have searched the existing issues

Community Note


Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment


Terraform Version
1.2.6
AzureRM Provider Version
3.30.0
Affected Resource(s)/Data Source(s)
azurerm_web_application_firewall_policy
Terraform Configuration Files
main.tf

resource "azurerm_web_application_firewall_policy" "this" {
  name                = "XXXX"
  resource_group_name = "XXXX"
  location            = "XXXX"

  policy_settings {
    enabled                     = true
    mode                        = "Detection"
    request_body_check          = true
    file_upload_limit_in_mb     = 100
    max_request_body_size_in_kb = 128
  }

  dynamic custom_rules {
    for_each = local.xxx_custom_rules
    content {
      name      = custom_rules.value.name
      priority  = custom_rules.value.priority
      rule_type = custom_rules.value.rule_type
      action    = custom_rules.value.action
      dynamic match_conditions {
        for_each = custom_rules.value.match_conditions
        content {
          match_values = match_conditions.value.match_values
          operator     = match_conditions.value.operator
          dynamic match_variables {
            for_each = match_conditions.value.match_variables
            content {
              variable_name = match_variables.value.variable_name
              selector      = match_variables.value.selector
            }
          }
        }
      }
    }
  }

  managed_rules {
    dynamic exclusion {
      for_each = local.xxx_waf_exclusions
      content {
        match_variable          = exclusion.value.match_variable
        selector                = exclusion.value.selector
        selector_match_operator = exclusion.value.selector_match_operator
        dynamic excluded_rule_set {
          for_each = exclusion.value.excluded_rule_set
          content {
            type = "OWASP"
            version = "3.2"
            dynamic rule_group {
              for_each = excluded_rule_set.value.rule_group
              content {
                rule_group_name = rule_group.value.rule_group_name
                excluded_rules  = rule_group.value.excluded_rules
              }
            }
          }
        }
      }
    }
    managed_rule_set {
      type    = "OWASP"
      version = "3.2"
      dynamic rule_group_override {
        for_each = local.xxx_disabled_rule_group
        content {
          rule_group_name = rule_group_override.value.rule_group_name
          disabled_rules = rule_group_override.value.rules
        }
      }
    }
    managed_rule_set {
      type    = "Microsoft_BotManagerRuleSet"
      version = "0.1"
    }
  }
}

locals.tf

xxx_disabled_rule_group = {
    General = {
        rule_group_name = "General"
        rules = [200003]
    }
    REQUEST-920-PROTOCOL-ENFORCEMENT = {
        rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
        rules = [920300, 920230, 920320]
    }
}
Debug Output/Panic Output
~ managed_rule_set {
                # (2 unchanged attributes hidden)
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-931-APPLICATION-ATTACK-RFI" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-911-METHOD-ENFORCEMENT" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-913-SCANNER-DETECTION" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-921-PROTOCOL-ATTACK" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-930-APPLICATION-ATTACK-LFI" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-932-APPLICATION-ATTACK-RCE" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-933-APPLICATION-ATTACK-PHP" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-941-APPLICATION-ATTACK-XSS" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "REQUEST-944-APPLICATION-ATTACK-JAVA" -> null
                }
              - rule_group_override {
                  - disabled_rules  = [] -> null
                  - rule_group_name = "Known-CVEs" -> null
                }
                # (2 unchanged blocks hidden)
            }
Expected Behaviour
No change
Actual Behaviour
TF seems to set by default rules action to "Anomaly Score". I want set it to "Block".
When I set manually on Azure rule action to Block, Terraform delete my change and set "Anomaly Score"
Steps to Reproduce
No response
Important Factoids
No response
References
No response

Closing comment (2022-12-12T09:57:09Z): Duplicate of #19347