-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix WAF InvalidParameterException #439
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…pported else will fallback on regular regex_string template
⚠ Terrform update availableTerraform: 1.5.3 (using 1.4.2)
Terragrunt: 0.48.4 (using 0.46.3) |
Staging: load_balancer✅ Terraform Init: Plan: 0 to add, 1 to change, 0 to destroy Show summary
Show planResource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# aws_wafv2_regex_pattern_set.valid_app_uri_paths will be updated in-place
~ resource "aws_wafv2_regex_pattern_set" "valid_app_uri_paths" {
id = "2020c3bc-eb87-45f3-8ee7-99cd707612e7"
name = "valid_app_uri_paths"
tags = {}
# (5 unchanged attributes hidden)
- regular_expression {
- regex_string = "^\\/(?:en|fr)?\\/?(?:(admin|id|api|auth|signup|myforms|unsupported-browser|terms-of-use|404)(?:\\/[\\w-]+))?\\/?$" -> null
}
- regular_expression {
- regex_string = "^\\/(?:en|fr)?\\/?(?:(form-builder|sla|unlock-publishing|terms-and-conditions|javascript-disabled)(?:\\/[\\w-]+))?\\/?$" -> null
}
- regular_expression {
- regex_string = "^\\/(?:en|fr)?\\/?(?:(static|_next|img|favicon\\.ico)(?:\\/[\\w-]+))?\\/?$" -> null
}
- regular_expression {
- regex_string = "^\\/(?:en|fr)?\\/?(?:\\/[\\w-]+)?\\/?$" -> null
}
+ regular_expression {
+ regex_string = "^\\/(?:en|fr)?\\/?$"
}
+ regular_expression {
+ regex_string = "^\\/(?:en|fr)?\\/?(?:(admin|id|api|auth|signup|myforms|unsupported-browser|terms-of-use|404)(?:\\/[\\w-]+)?+)(?:\\/.*)?$"
}
+ regular_expression {
+ regex_string = "^\\/(?:en|fr)?\\/?(?:(form-builder|sla|unlock-publishing|terms-and-conditions|javascript-disabled)(?:\\/[\\w-]+)?+)(?:\\/.*)?$"
}
+ regular_expression {
+ regex_string = "^\\/(?:en|fr)?\\/?(?:(static|_next|img|favicon\\.ico)(?:\\/[\\w-]+)*)(?:\\/.*)?$"
}
}
Plan: 0 to add, 1 to change, 0 to destroy.
Warning: Argument is deprecated
with aws_s3_bucket.firehose_waf_logs,
on kinesis.tf line 30, in resource "aws_s3_bucket" "firehose_waf_logs":
30: resource "aws_s3_bucket" "firehose_waf_logs" {
Use the aws_s3_bucket_lifecycle_configuration resource instead
(and 5 more similar warnings elsewhere)
─────────────────────────────────────────────────────────────────────────────
Saved the plan to: plan.tfplan
To perform exactly these actions, run the following command to apply:
terraform apply "plan.tfplan"
Show Conftest resultsWARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]
18 tests, 17 passed, 1 warning, 0 failures, 0 exceptions
|
bryan-robitaille
approved these changes
Jul 19, 2023
bryan-robitaille
added a commit
that referenced
this pull request
Aug 16, 2023
* chore: new workflow for full infrastructure plan against staging (#424) * feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421) * add cloudwatch logs expiry * rename slack lambda function * add cloudwatch expiry to cognito lambdas * update lambda for new streams * remove redundant alarms * create log subscriptions for all lambdas * reliability and submission lambda error processing * add error property * Nagware updates * archive form responses updates * dlq consumer * update yarn lock for archive form responses * update slack messaging to include more info * archive form templates updates * audit logs processor lambda updates * formatting * fix cloudwatch block scope * removed included file in lib package for nagware lambda because it does not exist anymore * fix security issues and add permissions * missed kms entry on resource * add missing input var * Add missing vars on alarm module * typo in module def for alarms * fix typo * fixed few issues --------- Co-authored-by: Bryan Robitaille <[email protected]> * Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426) This reverts commit 7f502df. * Revert "Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)" (#428) This reverts commit 063e411. * fix: permission for Cloudwatch to run Notify Slack lambda (#429) * fix: permission for Cloudwatch to run Notify Slack lambda (second attempt) (#430) * fix: Terraform module version reference (#427) Update the Terraform module version references so they are in the correct format. This will allow Renovate dependency PRs to update them module versions without stripping the `//sub-directory` path. * feat: added missing cloudwatch subscription filter for submission logs (#431) * feat: added missing cloudwatch subscription filter for submission logs * chore: remove reliability queue alarm that is not needed anymore * chore: format all console logs in JSON (#432) * fix: multiple issues with NotifySlack lambda (#434) * chore(deps): update all non-major github action dependencies (#418) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update all non-major docker images (#417) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Update WAF rules to support newly added URIs (#433) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * disabled waf regex till provider is merged (#435) * Attempt to fix waf limit exceeded error (#437) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * Fix/add missing regex comp (#438) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * add missing regex component to match path * removed duplicated expression * removed duplicate expression * Fix WAF InvalidParameterException (#439) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * add missing regex component to match path * removed duplicated expression * removed duplicate expression * refactor capture group, and restricted capture for home page * fix invalid syntax (#441) * Restore missing output for lambda function name (#443) * feat: nagware sends email to all template associated users (#442) * feat: nagware sends email to all template associated users * fix: spelling * Feature/alarm for privileges (#445) * Remove unknown error ref * Add events to listen for by subscriber * fix destructuring * Feat/dontnagtestresponse (#449) * feat: delete overdue draft form responses and dont nag Signed-off-by: Daine Trinidad <[email protected]> * chore: reverting some changes for lockfile Signed-off-by: Daine Trinidad <[email protected]> * chore: some cleanup Signed-off-by: Daine Trinidad <[email protected]> * chore: re-adding template file that got lost during merge Signed-off-by: Daine Trinidad <[email protected]> * chore: removing file again for cleaner diff and history Signed-off-by: Daine Trinidad <[email protected]> * chore: fixed file refactor Signed-off-by: Daine Trinidad <[email protected]> * fix: refactor missed the terraform file; fixed the new name for the file Signed-off-by: Daine Trinidad <[email protected]> * fix: horrible typo, missing 's' Signed-off-by: Daine Trinidad <[email protected]> * fix: move var declaration inside try catch & comment cleanup Signed-off-by: Daine Trinidad <[email protected]> --------- Signed-off-by: Daine Trinidad <[email protected]> * doc: update readme to inform about signed commits on this repo (#450) * feat: added severity level to alarms being sent to Slack (#451) * add path for profile (#453) * chore(deps): update all non-major github action dependencies (#447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update all non-major docker images (#446) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): lock file maintenance (#419) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Bump version * update version * refactor: rework Nagware warning message being sent to Slack (#457) * fix: nagware notification layout (#460) * Host header fix (#461) --------- Signed-off-by: Daine Trinidad <[email protected]> Co-authored-by: Clément JANIN <[email protected]> Co-authored-by: Pat Heard <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Raphael <[email protected]> Co-authored-by: Dave Samojlenko <[email protected]> Co-authored-by: Daine Trinidad <[email protected]> Co-authored-by: Tim Arney <[email protected]>
craigzour
added a commit
that referenced
this pull request
Aug 17, 2023
* chore: new workflow for full infrastructure plan against staging (#424) * feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421) * add cloudwatch logs expiry * rename slack lambda function * add cloudwatch expiry to cognito lambdas * update lambda for new streams * remove redundant alarms * create log subscriptions for all lambdas * reliability and submission lambda error processing * add error property * Nagware updates * archive form responses updates * dlq consumer * update yarn lock for archive form responses * update slack messaging to include more info * archive form templates updates * audit logs processor lambda updates * formatting * fix cloudwatch block scope * removed included file in lib package for nagware lambda because it does not exist anymore * fix security issues and add permissions * missed kms entry on resource * add missing input var * Add missing vars on alarm module * typo in module def for alarms * fix typo * fixed few issues --------- Co-authored-by: Bryan Robitaille <[email protected]> * Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426) This reverts commit 7f502df. * Revert "Revert "feat: use Lambda and Cloudwatch Logs to send reviewed alarms to Slack channels (#421)" (#426)" (#428) This reverts commit 063e411. * fix: permission for Cloudwatch to run Notify Slack lambda (#429) * fix: permission for Cloudwatch to run Notify Slack lambda (second attempt) (#430) * fix: Terraform module version reference (#427) Update the Terraform module version references so they are in the correct format. This will allow Renovate dependency PRs to update them module versions without stripping the `//sub-directory` path. * feat: added missing cloudwatch subscription filter for submission logs (#431) * feat: added missing cloudwatch subscription filter for submission logs * chore: remove reliability queue alarm that is not needed anymore * chore: format all console logs in JSON (#432) * fix: multiple issues with NotifySlack lambda (#434) * chore(deps): update all non-major github action dependencies (#418) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update all non-major docker images (#417) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Update WAF rules to support newly added URIs (#433) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * disabled waf regex till provider is merged (#435) * Attempt to fix waf limit exceeded error (#437) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * Fix/add missing regex comp (#438) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * add missing regex component to match path * removed duplicated expression * removed duplicate expression * Fix WAF InvalidParameterException (#439) * updated regex pattern to support newly added uris * add page * fix typo in resource name * fix undo introduced typo * try updating resource type to wafv1 where regex_pattern_strings is supported else will fallback on regular regex_string template * reset staging state:disabled regex till the provider upgrade is merged * attempt to fix waf limit exceeded error * renamed rule * fix undeclared resource name * attempt to fix resource name mismatch * add missing regex component to match path * removed duplicated expression * removed duplicate expression * refactor capture group, and restricted capture for home page * fix invalid syntax (#441) * Restore missing output for lambda function name (#443) * feat: nagware sends email to all template associated users (#442) * feat: nagware sends email to all template associated users * fix: spelling * Feature/alarm for privileges (#445) * Remove unknown error ref * Add events to listen for by subscriber * fix destructuring * Feat/dontnagtestresponse (#449) * feat: delete overdue draft form responses and dont nag Signed-off-by: Daine Trinidad <[email protected]> * chore: reverting some changes for lockfile Signed-off-by: Daine Trinidad <[email protected]> * chore: some cleanup Signed-off-by: Daine Trinidad <[email protected]> * chore: re-adding template file that got lost during merge Signed-off-by: Daine Trinidad <[email protected]> * chore: removing file again for cleaner diff and history Signed-off-by: Daine Trinidad <[email protected]> * chore: fixed file refactor Signed-off-by: Daine Trinidad <[email protected]> * fix: refactor missed the terraform file; fixed the new name for the file Signed-off-by: Daine Trinidad <[email protected]> * fix: horrible typo, missing 's' Signed-off-by: Daine Trinidad <[email protected]> * fix: move var declaration inside try catch & comment cleanup Signed-off-by: Daine Trinidad <[email protected]> --------- Signed-off-by: Daine Trinidad <[email protected]> * doc: update readme to inform about signed commits on this repo (#450) * feat: added severity level to alarms being sent to Slack (#451) * add path for profile (#453) * chore(deps): update all non-major github action dependencies (#447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update all non-major docker images (#446) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): lock file maintenance (#419) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * refactor: rework Nagware warning message being sent to Slack (#457) * fix: nagware notification layout (#460) * Host header fix (#461) * release: 3.2.0 (#458) * fix: use valid ReCaptcha site key for production environment (#462) * release 3.2.1 --------- Signed-off-by: Daine Trinidad <[email protected]> Co-authored-by: Bryan Robitaille <[email protected]> Co-authored-by: Bryan Robitaille <[email protected]> Co-authored-by: Pat Heard <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Raphael <[email protected]> Co-authored-by: Dave Samojlenko <[email protected]> Co-authored-by: Daine Trinidad <[email protected]> Co-authored-by: Tim Arney <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary | Résumé
Fix WAF invalid parameter exception error on regex pattern set while parsing regex resources.