fix: missing WAF rule and certificate. Health check now targets load balancer DNS

[craigzour]

Summary | Résumé

• Added basic WAF rule to only allow GET request on "/" for the Cloudfront distribution
• Added missing certificate for our Cloudfront distribution
• Health check now targets load balancer DNS address

[github-actions]

⚠ Terrform update available

Terraform: 1.6.4 (using 1.4.2)
Terragrunt: 0.53.3 (using 0.46.3)

[github-actions]

Staging: load_balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

⚠️   Warning: resources will be destroyed by this change!

Plan: 5 to add, 6 to change, 2 to destroy

Show summary

CHANGE	NAME
recreate	aws_acm_certificate.form_viewer
	aws_route53_record.form_viewer_certificate_validation["forms-staging.cdssandbox.xyz"]
add	aws_acm_certificate.form_viewer_maintenance_mode
	aws_route53_record.form_viewer_certificate_validation["form-viewer-1810755345.ca-central-1.elb.amazonaws.com"]
	aws_wafv2_web_acl.forms_maintenance_mode_acl
update	aws_cloudfront_distribution.maintenance_mode
	aws_lb_listener.form_viewer_https
	aws_route53_health_check.gc_forms_application
	aws_s3_bucket.maintenance_mode
	aws_s3_bucket_policy.allow_cloudfront_to_access_static_website_in_s3
	aws_wafv2_regex_pattern_set.forms_base_url

Show plan

Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy
 <= read (data resources)

Terraform will perform the following actions:

  # data.aws_iam_policy_document.allow_cloudfront_to_access_static_website_in_s3 will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "aws_iam_policy_document" "allow_cloudfront_to_access_static_website_in_s3" {
      + id   = (known after apply)
      + json = (known after apply)

      + statement {
          + actions   = [
              + "s3:GetObject",
            ]
          + effect    = "Allow"
          + resources = [
              + "arn:aws:s3:::gc-forms-application-maintenance-page",
              + "arn:aws:s3:::gc-forms-application-maintenance-page/*",
            ]

          + principals {
              + identifiers = [
                  + "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2PGE1KRH6OS33",
                ]
              + type        = "AWS"
            }
        }
    }

  # aws_acm_certificate.form_viewer must be replaced
+/- resource "aws_acm_certificate" "form_viewer" {
      ~ arn                       = "arn:aws:acm:ca-central-1:687401027353:certificate/387f24ee-0a1d-48be-979a-e4196ea1a401" -> (known after apply)
      ~ domain_validation_options = [
          - {
              - domain_name           = "forms-staging.cdssandbox.xyz"
              - resource_record_name  = "_42cd5dd49f1c1123566280c716149b50.forms-staging.cdssandbox.xyz."
              - resource_record_type  = "CNAME"
              - resource_record_value = "_daaca6a8062fb25ab6d88dcde571d1a3.rlltrpyzyf.acm-validations.aws."
            },
          + {
              + domain_name           = "form-viewer-1810755345.ca-central-1.elb.amazonaws.com"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
          + {
              + domain_name           = "forms-staging.cdssandbox.xyz"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      ~ id                        = "arn:aws:acm:ca-central-1:687401027353:certificate/387f24ee-0a1d-48be-979a-e4196ea1a401" -> (known after apply)
      ~ status                    = "ISSUED" -> (known after apply)
      ~ subject_alternative_names = [ # forces replacement
          + "form-viewer-1810755345.ca-central-1.elb.amazonaws.com",
        ]
        tags                      = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
      ~ validation_emails         = [] -> (known after apply)
        # (3 unchanged attributes hidden)

      - options {
          - certificate_transparency_logging_preference = "ENABLED" -> null
        }
    }

  # aws_acm_certificate.form_viewer_maintenance_mode will be created
  + resource "aws_acm_certificate" "form_viewer_maintenance_mode" {
      + arn                       = (known after apply)
      + domain_name               = "forms-staging.cdssandbox.xyz"
      + domain_validation_options = [
          + {
              + domain_name           = "form-viewer-1810755345.ca-central-1.elb.amazonaws.com"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
          + {
              + domain_name           = "forms-staging.cdssandbox.xyz"
              + resource_record_name  = (known after apply)
              + resource_record_type  = (known after apply)
              + resource_record_value = (known after apply)
            },
        ]
      + id                        = (known after apply)
      + status                    = (known after apply)
      + subject_alternative_names = [
          + "form-viewer-1810755345.ca-central-1.elb.amazonaws.com",
        ]
      + tags                      = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + tags_all                  = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + validation_emails         = (known after apply)
      + validation_method         = "DNS"
    }

  # aws_cloudfront_distribution.maintenance_mode will be updated in-place
  ~ resource "aws_cloudfront_distribution" "maintenance_mode" {
        id                             = "E2NX6QAIR13JTM"
        tags                           = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
      + web_acl_id                     = (known after apply)
        # (19 unchanged attributes hidden)

      ~ viewer_certificate {
          + acm_certificate_arn            = (known after apply)
          - cloudfront_default_certificate = true -> null
          ~ minimum_protocol_version       = "TLSv1" -> "TLSv1.2_2021"
          + ssl_support_method             = "sni-only"
        }

        # (3 unchanged blocks hidden)
    }

  # aws_lb_listener.form_viewer_https will be updated in-place
  ~ resource "aws_lb_listener" "form_viewer_https" {
      ~ certificate_arn   = "arn:aws:acm:ca-central-1:687401027353:certificate/387f24ee-0a1d-48be-979a-e4196ea1a401" -> (known after apply)
        id                = "arn:aws:elasticloadbalancing:ca-central-1:687401027353:listener/app/form-viewer/5e6bc2d9ab810b68/028e8eeeed9c3a34"
        tags              = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (6 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # aws_route53_health_check.gc_forms_application will be updated in-place
  ~ resource "aws_route53_health_check" "gc_forms_application" {
      ~ disabled               = true -> false
      ~ fqdn                   = "forms-staging.cdssandbox.xyz" -> "form-viewer-1810755345.ca-central-1.elb.amazonaws.com"
        id                     = "0005571a-3937-4194-ad31-dc5f16a05e93"
        tags                   = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (13 unchanged attributes hidden)
    }

  # aws_route53_record.form_viewer_certificate_validation["form-viewer-1810755345.ca-central-1.elb.amazonaws.com"] will be created
  + resource "aws_route53_record" "form_viewer_certificate_validation" {
      + allow_overwrite = true
      + fqdn            = (known after apply)
      + id              = (known after apply)
      + name            = (known after apply)
      + records         = (known after apply)
      + ttl             = 60
      + type            = (known after apply)
      + zone_id         = "ZQSVJUPU6J1EY"
    }

  # aws_route53_record.form_viewer_certificate_validation["forms-staging.cdssandbox.xyz"] must be replaced
-/+ resource "aws_route53_record" "form_viewer_certificate_validation" {
      ~ fqdn            = "_42cd5dd49f1c1123566280c716149b50.forms-staging.cdssandbox.xyz" -> (known after apply)
      ~ id              = "Z05990652HOQ0SGHD81ZC__42cd5dd49f1c1123566280c716149b50.forms-staging.cdssandbox.xyz._CNAME" -> (known after apply)
      ~ name            = "_42cd5dd49f1c1123566280c716149b50.forms-staging.cdssandbox.xyz" # forces replacement -> (known after apply)
      ~ records         = [
          - "_daaca6a8062fb25ab6d88dcde571d1a3.rlltrpyzyf.acm-validations.aws.",
        ] -> (known after apply)
      ~ type            = "CNAME" -> (known after apply)
        # (3 unchanged attributes hidden)
    }

  # aws_s3_bucket.maintenance_mode will be updated in-place
  ~ resource "aws_s3_bucket" "maintenance_mode" {
        id                          = "gc-forms-application-maintenance-page"
        tags                        = {
            "CostCentre" = "forms-platform-staging"
            "Terraform"  = "true"
        }
        # (13 unchanged attributes hidden)

      - grant {
          - permissions = [
              - "READ",
            ] -> null
          - type        = "Group" -> null
          - uri         = "http://acs.amazonaws.com/groups/global/AllUsers" -> null
        }
      - grant {
          - id          = "8ee828b5522b38b6797b8f886ed0b30f039d4eaa7ea331fa60669a6e0352d7e5" -> null
          - permissions = [
              - "FULL_CONTROL",
            ] -> null
          - type        = "CanonicalUser" -> null
        }

      - website {
          - index_document = "index.html" -> null
        }

        # (2 unchanged blocks hidden)
    }

  # aws_s3_bucket_policy.allow_cloudfront_to_access_static_website_in_s3 will be updated in-place
  ~ resource "aws_s3_bucket_policy" "allow_cloudfront_to_access_static_website_in_s3" {
        id     = "gc-forms-application-maintenance-page"
      ~ policy = jsonencode(
            {
              - Statement = [
                  - {
                      - Action    = "s3:GetObject"
                      - Effect    = "Allow"
                      - Principal = {
                          - AWS = "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2PGE1KRH6OS33"
                        }
                      - Resource  = [
                          - "arn:aws:s3:::gc-forms-application-maintenance-page/*",
                          - "arn:aws:s3:::gc-forms-application-maintenance-page",
                        ]
                      - Sid       = ""
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> (known after apply)
        # (1 unchanged attribute hidden)
    }

  # aws_wafv2_regex_pattern_set.forms_base_url will be updated in-place
  ~ resource "aws_wafv2_regex_pattern_set" "forms_base_url" {
        id          = "92da9411-8b49-4c9e-b80f-ac7ea482f3d1"
        name        = "forms_base_url"
        tags        = {}
        # (5 unchanged attributes hidden)

      + regular_expression {
          + regex_string = "^form-viewer-1810755345.ca-central-1.elb.amazonaws.com$"
        }

        # (1 unchanged block hidden)
    }

  # aws_wafv2_web_acl.forms_maintenance_mode_acl will be created
  + resource "aws_wafv2_web_acl" "forms_maintenance_mode_acl" {
      + arn        = (known after apply)
      + capacity   = (known after apply)
      + id         = (known after apply)
      + lock_token = (known after apply)
      + name       = "GCFormsMaintenanceMode"
      + scope      = "CLOUDFRONT"
      + tags       = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }
      + tags_all   = {
          + "CostCentre" = "forms-platform-staging"
          + "Terraform"  = "true"
        }

      + default_action {
          + block {
            }
        }

      + rule {
          + name     = "AllowGetRequestOnRootOnly"
          + priority = 0

          + action {
              + allow {
                }
            }

          + statement {
              + and_statement {
                  + statement {
                      + byte_match_statement {
                          + positional_constraint = "EXACTLY"
                          + search_string         = "GET"

                          + field_to_match {
                              + method {}
                            }

                          + text_transformation {
                              + priority = 0
                              + type     = "NONE"
                            }
                        }
                    }
                  + statement {
                      + byte_match_statement {
                          + positional_constraint = "EXACTLY"
                          + search_string         = "/"

                          + field_to_match {
                              + uri_path {}
                            }

                          + text_transformation {
                              + priority = 0
                              + type     = "NONE"
                            }
                        }
                    }
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = false
              + metric_name                = "AllowGetRequestOnRootOnly"
              + sampled_requests_enabled   = false
            }
        }

      + visibility_config {
          + cloudwatch_metrics_enabled = false
          + metric_name                = "forms_maintenance_mode_global_rule"
          + sampled_requests_enabled   = false
        }
    }

Plan: 5 to add, 6 to change, 2 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.firehose_waf_logs,
  on kinesis.tf line 30, in resource "aws_s3_bucket" "firehose_waf_logs":
  30: resource "aws_s3_bucket" "firehose_waf_logs" {

Use the aws_s3_bucket_lifecycle_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_s3_bucket_object.maintenance_static_page"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.forms_base_url"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_regex_pattern_set.valid_app_uri_paths"]

22 tests, 19 passed, 3 warnings, 0 failures, 0 exceptions

[bryan-robitaille]

Let's try it. Hopefully the cert validation entries will be the same across both.