[NDR-182] Exclude body firewall rule for api (#357)

* [NDR-182] exclude body rule

* [NDR-182] temp remove count

* [NDR-182] fixing dodgy dynamic

* [NDR-182] revert count

* [NDR-182] rebase error

---------

Co-authored-by: Sam Whyte <[email protected]>

Author: SWhyteAnswer

infrastructure/modules/firewall_waf_v2/README.md

@@ -28,7 +28,7 @@ module "waf_acl" {
   # Required: resource owner for tagging
   owner = "security-team"
 
-  # True if using the firewall for an api - removes AWSBotControl
+  # True if using the firewall for an api - removes AWSBotControl and SizeRestrictions_BODY
   api = true
 }
 
@@ -53,7 +53,7 @@ module "waf_acl" {
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_api"></a> [api](#input\_api) | True if using the firewall for an api - removes AWSBotControl. | `bool` | `false` | no |
+| <a name="input_api"></a> [api](#input\_api) | True if using the firewall for an api - removes AWSBotControl and SizeRestrictions\_BODY | `bool` | `false` | no |
 | <a name="input_cloudfront_acl"></a> [cloudfront\_acl](#input\_cloudfront\_acl) | Set to true if this WAF ACL is for a CloudFront distribution. | `bool` | n/a | yes |
 | <a name="input_environment"></a> [environment](#input\_environment) | Environment name used for tagging and resource naming. | `string` | n/a | yes |
 | <a name="input_owner"></a> [owner](#input\_owner) | Name of the owner used for tagging. | `string` | n/a | yes |

infrastructure/modules/firewall_waf_v2/local.tf

@@ -7,7 +7,7 @@ locals {
       name                    = "AWSCoreRuleSet"
       managed_rule_name       = "AWSManagedRulesCommonRuleSet"
       cloudwatch_metrics_name = "AWS-core-ruleset"
-      excluded_rules          = []
+      excluded_rules          = var.api ? ["SizeRestrictions_BODY"] : []
       bypass                  = ["Yes"]
     },
     {

infrastructure/modules/firewall_waf_v2/main.tf

@@ -47,9 +47,9 @@ resource "aws_wafv2_web_acl" "waf_v2_acl" {
 
 
           dynamic "rule_action_override" {
-            for_each = rule.value["excluded_rules"]
+            for_each = rule.value.excluded_rules
             content {
-              name = excluded_rule.value
+              name = rule_action_override.value
               action_to_use {
                 allow {}
               }

infrastructure/modules/firewall_waf_v2/variables.tf

@@ -14,7 +14,7 @@ variable "cloudfront_acl" {
 }
 
 variable "api" {
-  description = "True if using the firewall for an api - removes AWSBotControl."
+  description = "True if using the firewall for an api - removes AWSBotControl and SizeRestrictions_BODY"
   type        = bool
   default     = false
 }