Skip to content

Commit 7c9d7d6

Browse files
committed
feat: initial implementation
1 parent 9b4a238 commit 7c9d7d6

15 files changed

+776
-254
lines changed

README.md

+118-88
Large diffs are not rendered by default.

README.yaml

+76-46
Original file line numberDiff line numberDiff line change
@@ -1,64 +1,58 @@
1-
---
21
#
32
# This is the canonical configuration for the `README.md`
43
# Run `make readme` to rebuild the `README.md`
54
#
65

76
# Name of this project
8-
name: terraform-example-module
7+
name: terraform-cloudflare-waf-rulesets
98

109
# Logo for this project
1110
#logo: docs/logo.png
1211

1312
# License of this project
14-
license: "APACHE2"
13+
license: APACHE2
1514

1615
# Copyrights
1716
copyrights:
18-
- name: "Cloud Posse, LLC"
19-
url: "https://cloudposse.com"
20-
year: "2020"
17+
- name: Cloud Posse, LLC
18+
url: https://cloudposse.com
19+
year: '2021'
2120

2221
# Canonical GitHub repo
23-
github_repo: cloudposse/terraform-example-module
22+
github_repo: cloudposse/terraform-cloudflare-waf-rulesets
2423

2524
# Badges to display
2625
badges:
27-
- name: "Latest Release"
28-
image: "https://img.shields.io/github/release/cloudposse/terraform-example-module.svg"
29-
url: "https://github.com/cloudposse/terraform-example-module/releases/latest"
30-
- name: "Slack Community"
31-
image: "https://slack.cloudposse.com/badge.svg"
32-
url: "https://slack.cloudposse.com"
33-
- name: "Discourse Forum"
34-
image: "https://img.shields.io/discourse/https/ask.sweetops.com/posts.svg"
35-
url: "https://ask.sweetops.com/"
26+
- name: Latest Release
27+
image: https://img.shields.io/github/release/cloudposse/terraform-cloudflare-waf-rulesets.svg
28+
url: https://github.com/cloudposse/terraform-cloudflare-waf-rulesets/releases/latest
29+
- name: Slack Community
30+
image: https://slack.cloudposse.com/badge.svg
31+
url: https://slack.cloudposse.com
32+
- name: Discourse Forum
33+
image: https://img.shields.io/discourse/https/ask.sweetops.com/posts.svg
34+
url: https://ask.sweetops.com/
3635

3736
# List any related terraform modules that this module may be used with or that this module depends on.
3837
related:
39-
- name: "terraform-null-label"
40-
description: "Terraform module designed to generate consistent names and tags for resources. Use terraform-null-label to implement a strict naming convention."
41-
url: "https://github.com/cloudposse/terraform-null-label"
42-
43-
# List any resources helpful for someone to get started. For example, link to the hashicorp documentation or AWS documentation.
38+
- name: terraform-null-label
39+
description: Terraform Module to define a consistent naming convention by (namespace,
40+
stage, name, [attributes])
41+
url: https://github.com/cloudposse/terraform-null-label
42+
- name: terraform-cloudflare-zone
43+
description:
44+
url: https://github.com/cloudposse/terraform-cloudflare-zone
45+
- name: terraform-cloudflare-waf-rulesets
46+
description:
47+
url: https://github.com/cloudposse/terraform-cloudflare-waf-rulesets
4448
references:
45-
- name: "Terraform Standard Module Structure"
46-
description: "HashiCorp's standard module structure is a file and directory layout we recommend for reusable modules distributed in separate repositories."
47-
url: "https://www.terraform.io/docs/modules/index.html#standard-module-structure"
48-
- name: "Terraform Module Requirements"
49-
description: "HashiCorp's guidance on all the requirements for publishing a module. Meeting the requirements for publishing a module is extremely easy."
50-
url: "https://www.terraform.io/docs/registry/modules/publish.html#requirements"
51-
- name: "Terraform `random_integer` Resource"
52-
description: "The resource random_integer generates random values from a given range, described by the min and max attributes of a given resource."
53-
url: "https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer"
54-
- name: "Terraform Version Pinning"
55-
description: "The required_version setting can be used to constrain which versions of the Terraform CLI can be used with your configuration"
56-
url: "https://www.terraform.io/docs/configuration/terraform.html#specifying-a-required-terraform-version"
57-
58-
# Short description of this project
49+
- name: terraform-provider-cloudflare
50+
description: Cloudflare Terraform Provider
51+
url: https://registry.terraform.io/providers/cloudflare/cloudflare/latest
5952
description: |-
60-
This is `terraform-example-module` project provides all the scaffolding for a typical well-built Cloud Posse module. It's a template repository you can
61-
use when creating new repositories.
53+
Terraform module to manage CloudFlare WAF rulesetes.
54+
55+
NOTE: This module has started as hardfork of https://github.com/innovationnorway/terraform-cloudflare-waf-rulesets with adoption to `ClouPosse` code style.
6256
6357
# Introduction to the project
6458
#introduction: |-
@@ -67,32 +61,68 @@ description: |-
6761
# How to use this module. Should be an easy example to copy and paste.
6862
usage: |-
6963
For a complete example, see [examples/complete](examples/complete).
70-
64+
7165
For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)
7266
(which tests and deploys the example on AWS), see [test](test).
7367
7468
```hcl
75-
module "example" {
76-
source = "https://github.com/cloudposse/terraform-example-module.git?ref=master"
77-
example = "Hello world!"
69+
module "label" {
70+
source = "cloudposse/label/null"
71+
# Cloud Posse recommends pinning every module to a specific version
72+
# version = "x.x.x"
73+
namespace = "eg"
74+
stage = "prod"
75+
name = "waf"
76+
attributes = ["cf"]
77+
delimiter = "-"
78+
}
79+
80+
module "waf_rulesets" {
81+
source = "cloudposse/waf-rulesets/cloudflare"
82+
# Cloud Posse recommends pinning every module to a specific version
83+
# version = "x.x.x"
84+
zone = "cloudposse.co"
85+
86+
rulesets = [
87+
{
88+
name = "OWASP ModSecurity Core Rule Set"
89+
mode = "simulate"
90+
sensitivity = "off"
91+
rule_groups = [
92+
{
93+
name = "OWASP Bad Robots"
94+
mode = "on"
95+
rules = [
96+
{
97+
id = "990012" # Rogue web site crawler
98+
mode = "off"
99+
},
100+
]
101+
},
102+
]
103+
},
104+
]
105+
106+
context = module.label.context
78107
}
79108
```
80109
81110
# Example usage
82111
examples: |-
83112
Here is an example of using this module:
84-
- [`examples/complete`](https://github.com/cloudposse/terraform-example-module/) - complete example of using this module
113+
- [`examples/complete`](https://github.com/cloudposse/terraform-cloudflare-waf-rulesets/) - complete example of using this module
85114
86115
# How to get started quickly
87116
#quickstart: |-
88117
# Here's how to get started...
89118

90119
# Other files to include in this README from the project folder
91120
include:
92-
- "docs/targets.md"
93-
- "docs/terraform.md"
121+
- docs/targets.md
122+
- docs/terraform.md
94123

95124
# Contributors to this project
96125
contributors:
97-
- name: "Erik Osterman"
98-
github: "osterman"
126+
- name: Vladimir Syromyatnikov
127+
github: SweetOps
128+

docs/terraform.md

+38-24
Original file line numberDiff line numberDiff line change
@@ -3,43 +3,57 @@
33

44
| Name | Version |
55
|------|---------|
6-
| terraform | >= 0.13 |
7-
| local | >= 1.2 |
8-
| random | >= 2.2 |
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
7+
| <a name="requirement_cloudflare"></a> [cloudflare](#requirement\_cloudflare) | >= 2.19 |
98

109
## Providers
1110

1211
| Name | Version |
1312
|------|---------|
14-
| random | >= 2.2 |
13+
| <a name="provider_cloudflare"></a> [cloudflare](#provider\_cloudflare) | >= 2.19 |
14+
15+
## Modules
16+
17+
| Name | Source | Version |
18+
|------|--------|---------|
19+
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 |
20+
21+
## Resources
22+
23+
| Name | Type |
24+
|------|------|
25+
| [cloudflare_waf_group.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_group) | resource |
26+
| [cloudflare_waf_package.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_package) | resource |
27+
| [cloudflare_waf_rule.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/waf_rule) | resource |
28+
| [cloudflare_waf_groups.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/waf_groups) | data source |
29+
| [cloudflare_waf_packages.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/waf_packages) | data source |
30+
| [cloudflare_zones.default](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/zones) | data source |
1531

1632
## Inputs
1733

1834
| Name | Description | Type | Default | Required |
1935
|------|-------------|------|---------|:--------:|
20-
| additional\_tag\_map | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. | `map(string)` | `{}` | no |
21-
| attributes | Additional attributes (e.g. `1`) | `list(string)` | `[]` | no |
22-
| context | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
23-
| delimiter | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
24-
| enabled | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
25-
| environment | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
26-
| example | Example variable | `string` | `"hello world"` | no |
27-
| id\_length\_limit | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
28-
| label\_key\_case | The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. | `string` | `null` | no |
29-
| label\_order | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
30-
| label\_value\_case | The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. | `string` | `null` | no |
31-
| name | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
32-
| namespace | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |
33-
| regex\_replace\_chars | Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
34-
| stage | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
35-
| tags | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
36+
| <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. | `map(string)` | `{}` | no |
37+
| <a name="input_attributes"></a> [attributes](#input\_attributes) | Additional attributes (e.g. `1`) | `list(string)` | `[]` | no |
38+
| <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {}<br>}</pre> | no |
39+
| <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
40+
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
41+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
42+
| <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
43+
| <a name="input_label_key_case"></a> [label\_key\_case](#input\_label\_key\_case) | The letter case of label keys (`tag` names) (i.e. `name`, `namespace`, `environment`, `stage`, `attributes`) to use in `tags`.<br>Possible values: `lower`, `title`, `upper`.<br>Default value: `title`. | `string` | `null` | no |
44+
| <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The naming order of the id output and Name tag.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 5 elements, but at least one must be present. | `list(string)` | `null` | no |
45+
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | The letter case of output label values (also used in `tags` and `id`).<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Default value: `lower`. | `string` | `null` | no |
46+
| <a name="input_name"></a> [name](#input\_name) | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
47+
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |
48+
| <a name="input_regex_replace_chars"></a> [regex\_replace\_chars](#input\_regex\_replace\_chars) | Regex to replace chars with empty string in `namespace`, `environment`, `stage` and `name`.<br>If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
49+
| <a name="input_rulesets"></a> [rulesets](#input\_rulesets) | A list of `rulesets` objects.<br>name:<br> The name of the firewall package.<br>sensitivity:<br> The sensitivity of the firewall package.<br>mode:<br> The default action that will be taken for rules under the firewall package. <br> Possible values: `simulate`, `block`, `challenge`.<br>rule\_groups:<br> name:<br> The name of the firewall rule group.<br> mode:<br> Whether or not the rules contained within this group are configurable/usable. <br> Possible values: `on`, `off`.<br>rules:<br> id:<br> The ID of the WAF rule.<br> mode:<br> The mode to use when the rule is triggered. Value is restricted based on the allowed\_modes of the rule. <br> Possible values: `default`, `disable`, `simulate`, `block`, `challenge`, `on`, `off`. | <pre>list(object({<br> name = string<br> sensitivity = string<br> mode = string<br> rule_groups = list(object({<br> name = string<br> mode = string<br> rules = list(object({<br> id = string<br> mode = string<br> }))<br> }))<br> }))</pre> | n/a | yes |
50+
| <a name="input_stage"></a> [stage](#input\_stage) | Stage, e.g. 'prod', 'staging', 'dev', OR 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
51+
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
52+
| <a name="input_zone"></a> [zone](#input\_zone) | The name of the DNS zone. | `string` | n/a | yes |
3653

3754
## Outputs
3855

3956
| Name | Description |
4057
|------|-------------|
41-
| example | Example output |
42-
| id | ID of the created example |
43-
| random | Stable random number for this example |
44-
58+
| <a name="output_rulesets"></a> [rulesets](#output\_rulesets) | A list of `rulesets` objects. |
4559
<!-- markdownlint-restore -->

examples/complete/fixtures.us-east-2.tfvars

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
region = "us-east-2"
1+
zone = "cloudposse.co"
22

33
namespace = "eg"
44

examples/complete/main.tf

+22-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,27 @@
1-
module "example" {
1+
module "waf_rulesets" {
22
source = "../.."
33

4-
example = var.example
4+
zone = var.zone
5+
6+
rulesets = [
7+
{
8+
name = "OWASP ModSecurity Core Rule Set"
9+
mode = "simulate"
10+
sensitivity = "off"
11+
rule_groups = [
12+
{
13+
name = "OWASP Bad Robots"
14+
mode = "on"
15+
rules = [
16+
{
17+
id = "990012" # Rogue web site crawler
18+
mode = "off"
19+
},
20+
]
21+
},
22+
]
23+
},
24+
]
525

626
context = module.this.context
727
}

examples/complete/outputs.tf

+3-13
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,4 @@
1-
output "id" {
2-
description = "ID of the created example"
3-
value = module.example.id
4-
}
5-
6-
output "example" {
7-
description = "Output \"example\" from example module"
8-
value = module.example.example
9-
}
10-
11-
output "random" {
12-
description = "Output \"random\" from example module"
13-
value = module.example.random
1+
output "rulesets" {
2+
description = "A list of `rulesets` objects."
3+
value = module.waf_rulesets.rulesets
144
}

examples/complete/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
variable "example" {
1+
variable "zone" {
22
type = string
3-
description = "The value which will be passed to the example module"
3+
description = "The name of the DNS zone."
44
}

examples/complete/versions.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 0.12.26"
2+
required_version = ">= 0.13"
33

44
required_providers {
5-
local = {
6-
source = "hashicorp/local"
7-
version = ">= 1.2"
5+
cloudflare = {
6+
source = "cloudflare/cloudflare"
7+
version = ">= 2.19"
88
}
99
}
1010
}

0 commit comments

Comments
 (0)