Skip to content

Commit

Permalink
Added support for custom_request_handling and custom_response to the …
Browse files Browse the repository at this point in the history 
…actions in WAFv2 RuleSet resources.
  • Loading branch information
@andyalm
andyalm committed May 19, 2021
1 parent b715e65 commit 35d2d6a
Show file tree
Hide file tree
Showing 2 changed files with 276 additions and 7 deletions.
6 changes: 3 additions & 3 deletions aws/resource_aws_wafv2_rule_group.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -86,9 +86,9 @@ func resourceAwsWafv2RuleGroup() *schema.Resource {
MaxItems: 1,
Elem: &schema.Resource{
Schema: map[string]*schema.Schema{
"allow": wafv2EmptySchema(),
"block": wafv2EmptySchema(),
"count": wafv2EmptySchema(),
"allow": wafv2AllowConfigSchema(),
"block": wafv2BlockConfigSchema(),
"count": wafv2CountConfigSchema(),
},
},
},
Expand Down
277 changes: 273 additions & 4 deletions aws/resource_aws_wafv2_rule_group_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1160,13 +1160,34 @@ func TestAccAwsWafv2RuleGroup_RuleAction(t *testing.T) {
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"action.#": "1",
"action.0.allow.#": "1",
"action.0.block.#": "0",
"action.0.count.#": "0",
"action.0.allow.0.custom_request_handling.#": "0",
"action.0.block.#": "0",
"action.0.count.#": "0",
}),
),
},
{
Config: testAccAwsWafv2RuleGroupConfig_RuleActionBlock(ruleGroupName),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
resource.TestCheckResourceAttr(resourceName, "description", ""),
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"action.#": "1",
"action.0.allow.#": "0",
"action.0.block.#": "1",
"action.0.block.0.custom_response.#": "0",
"action.0.count.#": "0",
}),
),
},
{
Config: testAccAwsWafv2RuleGroupConfig_RuleActionCount(ruleGroupName),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
Expand All @@ -1179,13 +1200,60 @@ func TestAccAwsWafv2RuleGroup_RuleAction(t *testing.T) {
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"action.#": "1",
"action.0.allow.#": "0",
"action.0.block.#": "1",
"action.0.block.#": "0",
"action.0.count.#": "1",
"action.0.count.0.custom_request_handling.#": "0",
}),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateIdFunc: testAccAwsWafv2RuleGroupImportStateIdFunc(resourceName),
},
},
})
}

func TestAccAwsWafv2RuleGroup_RuleAction_CustomRequestHandling(t *testing.T) {
var v wafv2.RuleGroup
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
resourceName := "aws_wafv2_rule_group.test"

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t); testAccPreCheckAWSWafv2ScopeRegional(t) },
ErrorCheck: testAccErrorCheck(t, wafv2.EndpointsID),
Providers: testAccProviders,
CheckDestroy: testAccCheckAwsWafv2RuleGroupDestroy,
Steps: []resource.TestStep{
{
Config: testAccAwsWafv2RuleGroupConfig_RuleActionAllow_CustomRequestHandling(ruleGroupName),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
resource.TestCheckResourceAttr(resourceName, "description", ""),
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"action.#": "1",
"action.0.allow.#": "1",
"action.0.allow.0.custom_request_handling.#": "1",
"action.0.allow.0.custom_request_handling.0.insert_headers.#": "2",
"action.0.allow.0.custom_request_handling.0.insert_headers.0.name": "x-hdr1",
"action.0.allow.0.custom_request_handling.0.insert_headers.0.value": "test-val1",
"action.0.allow.0.custom_request_handling.0.insert_headers.1.name": "x-hdr2",
"action.0.allow.0.custom_request_handling.0.insert_headers.1.value": "test-val2",
"action.0.block.#": "0",
"action.0.count.#": "0",
}),
),
},
{
Config: testAccAwsWafv2RuleGroupConfig_RuleActionCount(ruleGroupName),
Config: testAccAwsWafv2RuleGroupConfig_RuleActionCount_CustomRequestHandling(ruleGroupName),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
Expand All @@ -1200,6 +1268,59 @@ func TestAccAwsWafv2RuleGroup_RuleAction(t *testing.T) {
"action.0.allow.#": "0",
"action.0.block.#": "0",
"action.0.count.#": "1",
"action.0.count.0.custom_request_handling.#": "1",
"action.0.count.0.custom_request_handling.0.insert_headers.#": "2",
"action.0.count.0.custom_request_handling.0.insert_headers.0.name": "x-hdr1",
"action.0.count.0.custom_request_handling.0.insert_headers.0.value": "test-val1",
"action.0.count.0.custom_request_handling.0.insert_headers.1.name": "x-hdr2",
"action.0.count.0.custom_request_handling.0.insert_headers.1.value": "test-val2",
}),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
ImportStateIdFunc: testAccAwsWafv2RuleGroupImportStateIdFunc(resourceName),
},
},
})
}

func TestAccAwsWafv2RuleGroup_RuleAction_CustomResponse(t *testing.T) {
var v wafv2.RuleGroup
ruleGroupName := acctest.RandomWithPrefix("tf-acc-test")
resourceName := "aws_wafv2_rule_group.test"

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t); testAccPreCheckAWSWafv2ScopeRegional(t) },
ErrorCheck: testAccErrorCheck(t, wafv2.EndpointsID),
Providers: testAccProviders,
CheckDestroy: testAccCheckAwsWafv2RuleGroupDestroy,
Steps: []resource.TestStep{
{
Config: testAccAwsWafv2RuleGroupConfig_RuleActionBlock_CustomResponse(ruleGroupName),
Check: resource.ComposeTestCheckFunc(
testAccCheckAwsWafv2RuleGroupExists(resourceName, &v),
testAccMatchResourceAttrRegionalARN(resourceName, "arn", "wafv2", regexp.MustCompile(`regional/rulegroup/.+$`)),
resource.TestCheckResourceAttr(resourceName, "capacity", "2"),
resource.TestCheckResourceAttr(resourceName, "name", ruleGroupName),
resource.TestCheckResourceAttr(resourceName, "description", ""),
resource.TestCheckResourceAttr(resourceName, "scope", wafv2.ScopeRegional),
resource.TestCheckResourceAttr(resourceName, "visibility_config.#", "1"),
resource.TestCheckResourceAttr(resourceName, "rule.#", "1"),
resource.TestCheckTypeSetElemNestedAttrs(resourceName, "rule.*", map[string]string{
"action.#": "1",
"action.0.allow.#": "0",
"action.0.block.#": "1",
"action.0.block.0.custom_response.#": "1",
"action.0.block.0.custom_response.0.response_code": "429",
"action.0.block.0.custom_response.0.response_headers.#": "2",
"action.0.block.0.custom_response.0.response_headers.0.name": "x-hdr1",
"action.0.block.0.custom_response.0.response_headers.0.value": "test-val1",
"action.0.block.0.custom_response.0.response_headers.1.name": "x-hdr2",
"action.0.block.0.custom_response.0.response_headers.1.value": "test-val2",
"action.0.count.#": "0",
}),
),
},
Expand Down Expand Up @@ -1753,6 +1874,55 @@ resource "aws_wafv2_rule_group" "test" {
`, name)
}

func testAccAwsWafv2RuleGroupConfig_RuleActionAllow_CustomRequestHandling(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
capacity = 2
name = "%s"
scope = "REGIONAL"
rule {
name = "rule-1"
priority = 1
action {
allow {
custom_request_handling {
insert_headers {
name = "x-hdr1"
value = "test-val1"
}
insert_headers {
name = "x-hdr2"
value = "test-val2"
}
}
}
}
statement {
geo_match_statement {
country_codes = ["US", "NL"]
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-rule-metric-name"
sampled_requests_enabled = false
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-metric-name"
sampled_requests_enabled = false
}
}
`, name)
}

func testAccAwsWafv2RuleGroupConfig_RuleActionBlock(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
Expand Down Expand Up @@ -1790,6 +1960,56 @@ resource "aws_wafv2_rule_group" "test" {
`, name)
}

func testAccAwsWafv2RuleGroupConfig_RuleActionBlock_CustomResponse(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
capacity = 2
name = "%s"
scope = "REGIONAL"
rule {
name = "rule-1"
priority = 1
action {
block {
custom_response {
response_code = 429
response_headers {
name = "x-hdr1"
value = "test-val1"
}
response_headers {
name = "x-hdr2"
value = "test-val2"
}
}
}
}
statement {
geo_match_statement {
country_codes = ["US", "NL"]
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-rule-metric-name"
sampled_requests_enabled = false
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-metric-name"
sampled_requests_enabled = false
}
}
`, name)
}

func testAccAwsWafv2RuleGroupConfig_RuleActionCount(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
Expand Down Expand Up @@ -1827,6 +2047,55 @@ resource "aws_wafv2_rule_group" "test" {
`, name)
}

func testAccAwsWafv2RuleGroupConfig_RuleActionCount_CustomRequestHandling(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
capacity = 2
name = "%s"
scope = "REGIONAL"
rule {
name = "rule-1"
priority = 1
action {
count {
custom_request_handling {
insert_headers {
name = "x-hdr1"
value = "test-val1"
}
insert_headers {
name = "x-hdr2"
value = "test-val2"
}
}
}
}
statement {
geo_match_statement {
country_codes = ["US", "NL"]
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-rule-metric-name"
sampled_requests_enabled = false
}
}
visibility_config {
cloudwatch_metrics_enabled = false
metric_name = "friendly-metric-name"
sampled_requests_enabled = false
}
}
`, name)
}

func testAccAwsWafv2RuleGroupConfig_ByteMatchStatement(name string) string {
return fmt.Sprintf(`
resource "aws_wafv2_rule_group" "test" {
Expand Down

0 comments on commit 35d2d6a

Please sign in to comment.