Update exclude_rule for Deprecations, Add Custom Response Body, Allow oversize_handling Option

.github/workflows/release-branch.yml

@@ -10,6 +10,7 @@ on:
       - 'docs/**'
       - 'examples/**'
       - 'test/**'
+      - 'README.*'
 
 permissions:
   contents: write

.github/workflows/release-published.yml

@@ -11,4 +11,4 @@ permissions:
 
 jobs:
   terraform-module:
-    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release.yml@main
+    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-published.yml@main

examples/complete/main.tf

@@ -48,10 +48,12 @@ module "waf" {
         name        = "AWSManagedRulesCommonRuleSet"
         vendor_name = "AWS"
 
-        excluded_rule = [
-          "SizeRestrictions_QUERYSTRING",
-          "NoUserAgent_HEADER"
-        ]
+        excluded_rule = {
+          "SizeRestrictions_QUERYSTRING" = {},
+          "NoUserAgent_HEADER" = {
+            action = "block"
+          }
+        }
       }
 
       visibility_config = {
@@ -207,5 +209,12 @@ module "waf" {
     }
   ]
 
+  custom_response_bodies = {
+    "foobar" = {
+      content      = "this is custom response"
+      content_type = "TEXT_PLAIN"
+    }
+  }
+
   context = module.this.context
 }

examples/complete/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.2.4"
+  required_version = ">= 1.3"
 
   required_providers {
     aws = {

main.tf

@@ -2,14 +2,14 @@ resource "aws_wafv2_web_acl_association" "default" {
   count = module.this.enabled && length(var.association_resource_arns) > 0 ? length(var.association_resource_arns) : 0
 
   resource_arn = var.association_resource_arns[count.index]
-  web_acl_arn  = join("", aws_wafv2_web_acl.default.*.arn)
+  web_acl_arn  = join("", aws_wafv2_web_acl.default[*].arn)
 }
 
 resource "aws_wafv2_web_acl_logging_configuration" "default" {
   count = module.this.enabled && length(var.log_destination_configs) > 0 ? 1 : 0
 
   log_destination_configs = var.log_destination_configs
-  resource_arn            = join("", aws_wafv2_web_acl.default.*.arn)
+  resource_arn            = join("", aws_wafv2_web_acl.default[*].arn)
 
   dynamic "redacted_fields" {
     for_each = var.redacted_fields

outputs.tf

@@ -1,19 +1,19 @@
 output "id" {
   description = "The ID of the WAF WebACL."
-  value       = join("", aws_wafv2_web_acl.default.*.id)
+  value       = join("", aws_wafv2_web_acl.default[*].id)
 }
 
 output "arn" {
   description = "The ARN of the WAF WebACL."
-  value       = join("", aws_wafv2_web_acl.default.*.arn)
+  value       = join("", aws_wafv2_web_acl.default[*].arn)
 }
 
 output "capacity" {
   description = "The web ACL capacity units (WCUs) currently being used by this web ACL."
-  value       = join("", aws_wafv2_web_acl.default.*.capacity)
+  value       = join("", aws_wafv2_web_acl.default[*].capacity)
 }
 
 output "logging_config_id" {
   description = "The ARN of the WAFv2 Web ACL logging configuration."
-  value       = join("", aws_wafv2_web_acl_logging_configuration.default.*.id)
+  value       = join("", aws_wafv2_web_acl_logging_configuration.default[*].id)
 }

rules.tf

@@ -80,6 +80,8 @@ locals {
       rule.action,
     ) => rule
   } : {}
+
+  custom_response_bodies = module.this.enabled && var.custom_response_bodies != null ? var.custom_response_bodies : {}
 }
 
 resource "aws_wafv2_web_acl" "default" {
@@ -361,11 +363,29 @@ resource "aws_wafv2_web_acl" "default" {
             name        = managed_rule_group_statement.value.name
             vendor_name = managed_rule_group_statement.value.vendor_name
 
-            dynamic "excluded_rule" {
-              for_each = lookup(managed_rule_group_statement.value, "excluded_rule", null) != null ? toset(managed_rule_group_statement.value.excluded_rule) : []
+            dynamic "rule_action_override" {
+              for_each = lookup(managed_rule_group_statement.value, "excluded_rule", null) != null ? managed_rule_group_statement.value.excluded_rule : {}
 
               content {
-                name = excluded_rule.value
+                name = rule_action_override.key
+                action_to_use {
+                  dynamic "allow" {
+                    for_each = rule_action_override.value.action == "allow" ? [1] : []
+                    content {}
+                  }
+                  dynamic "block" {
+                    for_each = rule_action_override.value.action == "block" ? [1] : []
+                    content {}
+                  }
+                  dynamic "count" {
+                    for_each = rule_action_override.value.action == "count" ? [1] : []
+                    content {}
+                  }
+                  dynamic "captcha" {
+                    for_each = rule_action_override.value.action == "captcha" ? [1] : []
+                    content {}
+                  }
+                }
               }
             }
           }
@@ -576,11 +596,29 @@ resource "aws_wafv2_web_acl" "default" {
           content {
             arn = rule_group_reference_statement.value.arn
 
-            dynamic "excluded_rule" {
-              for_each = lookup(rule_group_reference_statement.value, "excluded_rule", null) != null ? toset(rule_group_reference_statement.value.excluded_rule) : []
+            dynamic "rule_action_override" {
+              for_each = lookup(rule_group_reference_statement.value, "excluded_rule", null) != null ? rule_group_reference_statement.value.excluded_rule : {}
 
               content {
-                name = excluded_rule.value
+                name = rule_action_override.key
+                action_to_use {
+                  dynamic "allow" {
+                    for_each = rule_action_override.value.action == "allow" ? [1] : []
+                    content {}
+                  }
+                  dynamic "block" {
+                    for_each = rule_action_override.value.action == "block" ? [1] : []
+                    content {}
+                  }
+                  dynamic "count" {
+                    for_each = rule_action_override.value.action == "count" ? [1] : []
+                    content {}
+                  }
+                  dynamic "captcha" {
+                    for_each = rule_action_override.value.action == "captcha" ? [1] : []
+                    content {}
+                  }
+                }
               }
             }
           }
@@ -645,7 +683,9 @@ resource "aws_wafv2_web_acl" "default" {
                 dynamic "body" {
                   for_each = lookup(field_to_match.value, "body", null) != null ? [1] : []
 
-                  content {}
+                  content {
+                    oversize_handling = try(field_to_match.value.body.oversize_handling, null)
+                  }
                 }
 
                 dynamic "method" {
@@ -934,5 +974,15 @@ resource "aws_wafv2_web_acl" "default" {
       }
     }
   }
+
+  # Attach a list of custom response bodies to the web ACL
+  dynamic "custom_response_body" {
+    for_each = local.custom_response_bodies
+    content {
+      key          = custom_response_body.key
+      content      = custom_response_body.value.content
+      content_type = custom_response_body.value.content_type
+    }
+  }
 }
 

variables.tf

@@ -178,7 +178,7 @@ variable "managed_rule_group_statement_rules" {
       vendor_name:
         The name of the managed rule group vendor.
       excluded_rule:
-        The list of names of the rules to exclude.
+        The map rules to exclude with the action to take.
 
     visibility_config:
       Defines and enables Amazon CloudWatch metrics and web request sample collection.
@@ -291,7 +291,7 @@ variable "rule_group_reference_statement_rules" {
       arn:
         The ARN of the `aws_wafv2_rule_group` resource.
       excluded_rule:
-        The list of names of the rules to exclude.
+        The map rules to exclude with the action to take.
 
     visibility_config:
       Defines and enables Amazon CloudWatch metrics and web request sample collection.
@@ -451,3 +451,22 @@ variable "redacted_fields" {
       The list of names of the query headers to redact.
   DOC
 }
+
+variable "custom_response_bodies" {
+  type = map(object({
+    content      = string
+    content_type = string
+  }))
+  description = <<-DOC
+    A map of the custom response bodies to include with the WAF ACL.
+    See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#custom-response
+
+    key:
+      The name of the custom response.
+    content:  
+      The custom response body.
+    content_type:
+      The content type of the custom response.
+  DOC
+  default     = {}
+}

versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.2.4"
+  required_version = ">= 1.3"
 
   required_providers {
     aws = {