Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/add missing regex comp #438

Merged
merged 15 commits into from
Jul 19, 2023
Merged

Fix/add missing regex comp #438

merged 15 commits into from
Jul 19, 2023

Conversation

falila
Copy link
Contributor

@falila falila commented Jul 19, 2023

Fix WAF missing regex group.

@falila falila marked this pull request as ready for review July 19, 2023 15:35
@github-actions
Copy link

⚠ Terrform update available

Terraform: 1.5.3 (using 1.4.2)
Terragrunt: 0.48.4 (using 0.46.3)

@github-actions
Copy link

Staging: load_balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy
Show summary
CHANGE NAME
update aws_wafv2_regex_pattern_set.valid_app_uri_paths
Show plan
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_wafv2_regex_pattern_set.valid_app_uri_paths will be updated in-place
  ~ resource "aws_wafv2_regex_pattern_set" "valid_app_uri_paths" {
        id          = "2020c3bc-eb87-45f3-8ee7-99cd707612e7"
        name        = "valid_app_uri_paths"
        tags        = {}
        # (5 unchanged attributes hidden)

      - regular_expression {
          - regex_string = "^\\/(?:en|fr)?\\/?(?:(admin|id|api|auth|signup|myforms|unsupported-browser|terms-of-use|404)(?:\\/[\\w-]+))?\\/?$" -> null
        }
      - regular_expression {
          - regex_string = "^\\/(?:en|fr)?\\/?(?:(form-builder|sla|unlock-publishing|terms-and-conditions|javascript-disabled)(?:\\/[\\w-]+))?\\/?$" -> null
        }
      - regular_expression {
          - regex_string = "^\\/(?:en|fr)?\\/?(?:(static|_next|img|favicon\\.ico)(?:\\/[\\w-]+))?\\/?$" -> null
        }
      - regular_expression {
          - regex_string = "^\\/(?:en|fr)?\\/?(?:\\/[\\w-]+)?\\/?$" -> null
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(admin|id|api|auth|signup|myforms|unsupported-browser|terms-of-use|404)(?:\\/[\\w-]+)*)?(?:\\/.*)?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(form-builder|sla|unlock-publishing|terms-and-conditions|javascript-disabled)(?:\\/[\\w-]+)*)?(?:\\/.*)?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:(static|_next|img|favicon\\.ico)(?:\\/[\\w-]+)*)?(?:\\/.*)?$"
        }
      + regular_expression {
          + regex_string = "^\\/(?:en|fr)?\\/?(?:\\/[\\w-]+)*)?(?:\\/.*)?$"
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.firehose_waf_logs,
  on kinesis.tf line 30, in resource "aws_s3_bucket" "firehose_waf_logs":
  30: resource "aws_s3_bucket" "firehose_waf_logs" {

Use the aws_s3_bucket_lifecycle_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Show Conftest results
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]

18 tests, 17 passed, 1 warning, 0 failures, 0 exceptions

@falila falila merged commit 923a0b7 into develop Jul 19, 2023
@falila falila deleted the fix/add-missing-regex-comp branch July 19, 2023 15:53
bryan-robitaille added a commit that referenced this pull request Aug 16, 2023
* chore: new workflow for full infrastructure plan against staging (#424)

* feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)

* add cloudwatch logs expiry

* rename slack lambda function

* add cloudwatch expiry to cognito lambdas

* update lambda for new streams

* remove redundant alarms

* create log subscriptions for all lambdas

* reliability and submission lambda error processing

* add error property

* Nagware updates

* archive form responses updates

* dlq consumer

* update yarn lock for archive form responses

* update slack messaging to include more info

* archive form templates updates

* audit logs processor lambda updates

* formatting

* fix cloudwatch block scope

* removed included file in lib package for nagware lambda because it does not exist anymore

* fix security issues and add permissions

* missed kms entry on resource

* add missing input var

* Add missing vars on alarm module

* typo in module def for alarms

* fix typo

* fixed few issues

---------

Co-authored-by: Bryan Robitaille <[email protected]>

* Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)

This reverts commit 7f502df.

* Revert "Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)" (#428)

This reverts commit 063e411.

* fix: permission for Cloudwatch to run Notify Slack lambda (#429)

* fix: permission for Cloudwatch to run Notify Slack lambda (second attempt) (#430)

* fix: Terraform module version reference (#427)

Update the Terraform module version references so
they are in the correct format.  This will allow Renovate
dependency PRs to update them module versions
without stripping the `//sub-directory` path.

* feat: added missing cloudwatch subscription filter for submission logs (#431)

* feat: added missing cloudwatch subscription filter for submission logs

* chore: remove reliability queue alarm that is not needed anymore

* chore: format all console logs in JSON (#432)

* fix: multiple issues with NotifySlack lambda (#434)

* chore(deps): update all non-major github action dependencies (#418)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update all non-major docker images (#417)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* Update WAF rules to support newly added URIs (#433)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* disabled waf regex till provider is merged (#435)

* Attempt to fix waf limit exceeded error (#437)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* Fix/add missing regex comp (#438)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* add missing regex component to match path

* removed duplicated expression

* removed duplicate expression

* Fix WAF InvalidParameterException (#439)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* add missing regex component to match path

* removed duplicated expression

* removed duplicate expression

* refactor capture group, and restricted capture for home page

* fix invalid syntax (#441)

* Restore missing output for lambda function name (#443)

* feat: nagware sends email to all template associated users (#442)

* feat: nagware sends email to all template associated users

* fix: spelling

* Feature/alarm for privileges (#445)

* Remove unknown error ref

* Add events to listen for by subscriber

* fix destructuring

* Feat/dontnagtestresponse (#449)

* feat: delete overdue draft form responses and dont nag

Signed-off-by: Daine Trinidad <[email protected]>

* chore: reverting some changes for lockfile

Signed-off-by: Daine Trinidad <[email protected]>

* chore: some cleanup

Signed-off-by: Daine Trinidad <[email protected]>

* chore: re-adding template file that got lost during merge

Signed-off-by: Daine Trinidad <[email protected]>

* chore: removing file again for cleaner diff and history

Signed-off-by: Daine Trinidad <[email protected]>

* chore: fixed file refactor

Signed-off-by: Daine Trinidad <[email protected]>

* fix: refactor missed the terraform file; fixed the new name for the file

Signed-off-by: Daine Trinidad <[email protected]>

* fix: horrible typo, missing 's'

Signed-off-by: Daine Trinidad <[email protected]>

* fix: move var declaration inside try catch & comment cleanup

Signed-off-by: Daine Trinidad <[email protected]>

---------

Signed-off-by: Daine Trinidad <[email protected]>

* doc: update readme to inform about signed commits on this repo (#450)

* feat: added severity level to alarms being sent to Slack (#451)

* add path for profile (#453)

* chore(deps): update all non-major github action dependencies (#447)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update all non-major docker images (#446)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): lock file maintenance (#419)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* Bump version

* update version

* refactor: rework Nagware warning message being sent to Slack (#457)

* fix: nagware notification layout (#460)

* Host header fix (#461)

---------

Signed-off-by: Daine Trinidad <[email protected]>
Co-authored-by: Clément JANIN <[email protected]>
Co-authored-by: Pat Heard <[email protected]>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Raphael <[email protected]>
Co-authored-by: Dave Samojlenko <[email protected]>
Co-authored-by: Daine Trinidad <[email protected]>
Co-authored-by: Tim Arney <[email protected]>
craigzour added a commit that referenced this pull request Aug 17, 2023
* chore: new workflow for full infrastructure plan against staging (#424)

* feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)

* add cloudwatch logs expiry

* rename slack lambda function

* add cloudwatch expiry to cognito lambdas

* update lambda for new streams

* remove redundant alarms

* create log subscriptions for all lambdas

* reliability and submission lambda error processing

* add error property

* Nagware updates

* archive form responses updates

* dlq consumer

* update yarn lock for archive form responses

* update slack messaging to include more info

* archive form templates updates

* audit logs processor lambda updates

* formatting

* fix cloudwatch block scope

* removed included file in lib package for nagware lambda because it does not exist anymore

* fix security issues and add permissions

* missed kms entry on resource

* add missing input var

* Add missing vars on alarm module

* typo in module def for alarms

* fix typo

* fixed few issues

---------

Co-authored-by: Bryan Robitaille <[email protected]>

* Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)

This reverts commit 7f502df.

* Revert "Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)" (#428)

This reverts commit 063e411.

* fix: permission for Cloudwatch to run Notify Slack lambda (#429)

* fix: permission for Cloudwatch to run Notify Slack lambda (second attempt) (#430)

* fix: Terraform module version reference (#427)

Update the Terraform module version references so
they are in the correct format.  This will allow Renovate
dependency PRs to update them module versions
without stripping the `//sub-directory` path.

* feat: added missing cloudwatch subscription filter for submission logs (#431)

* feat: added missing cloudwatch subscription filter for submission logs

* chore: remove reliability queue alarm that is not needed anymore

* chore: format all console logs in JSON (#432)

* fix: multiple issues with NotifySlack lambda (#434)

* chore(deps): update all non-major github action dependencies (#418)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update all non-major docker images (#417)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* Update WAF rules to support newly added URIs (#433)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* disabled waf regex till provider is merged (#435)

* Attempt to fix waf limit exceeded error (#437)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* Fix/add missing regex comp (#438)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* add missing regex component to match path

* removed duplicated expression

* removed duplicate expression

* Fix WAF InvalidParameterException (#439)

* updated regex pattern to support newly added uris

* add page

* fix typo in resource name

* fix undo introduced typo

* try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template

* reset staging state:disabled regex till the provider upgrade is merged

* attempt to fix waf limit exceeded error

* renamed rule

* fix undeclared resource name

* attempt to fix resource name mismatch

* add missing regex component to match path

* removed duplicated expression

* removed duplicate expression

* refactor capture group, and restricted capture for home page

* fix invalid syntax (#441)

* Restore missing output for lambda function name (#443)

* feat: nagware sends email to all template associated users (#442)

* feat: nagware sends email to all template associated users

* fix: spelling

* Feature/alarm for privileges (#445)

* Remove unknown error ref

* Add events to listen for by subscriber

* fix destructuring

* Feat/dontnagtestresponse (#449)

* feat: delete overdue draft form responses and dont nag

Signed-off-by: Daine Trinidad <[email protected]>

* chore: reverting some changes for lockfile

Signed-off-by: Daine Trinidad <[email protected]>

* chore: some cleanup

Signed-off-by: Daine Trinidad <[email protected]>

* chore: re-adding template file that got lost during merge

Signed-off-by: Daine Trinidad <[email protected]>

* chore: removing file again for cleaner diff and history

Signed-off-by: Daine Trinidad <[email protected]>

* chore: fixed file refactor

Signed-off-by: Daine Trinidad <[email protected]>

* fix: refactor missed the terraform file; fixed the new name for the file

Signed-off-by: Daine Trinidad <[email protected]>

* fix: horrible typo, missing 's'

Signed-off-by: Daine Trinidad <[email protected]>

* fix: move var declaration inside try catch & comment cleanup

Signed-off-by: Daine Trinidad <[email protected]>

---------

Signed-off-by: Daine Trinidad <[email protected]>

* doc: update readme to inform about signed commits on this repo (#450)

* feat: added severity level to alarms being sent to Slack (#451)

* add path for profile (#453)

* chore(deps): update all non-major github action dependencies (#447)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): update all non-major docker images (#446)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* chore(deps): lock file maintenance (#419)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* refactor: rework Nagware warning message being sent to Slack (#457)

* fix: nagware notification layout (#460)

* Host header fix (#461)

* release: 3.2.0 (#458)

* fix: use valid ReCaptcha site key for production environment (#462)

* release 3.2.1

---------

Signed-off-by: Daine Trinidad <[email protected]>
Co-authored-by: Bryan Robitaille <[email protected]>
Co-authored-by: Bryan Robitaille <[email protected]>
Co-authored-by: Pat Heard <[email protected]>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Raphael <[email protected]>
Co-authored-by: Dave Samojlenko <[email protected]>
Co-authored-by: Daine Trinidad <[email protected]>
Co-authored-by: Tim Arney <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants