feat: add authorized endpoints with constraints for WAF rules (#888)

Author: gcharest

terraform/variables.tf

@@ -42,3 +42,27 @@ variable "slack_webhook_url" {
   type        = string
   sensitive   = true
 }
+
+variable "authorized_endpoints_with_constraints" {
+  description = "List of authorized endpoints with their positional constraints"
+  type = list(object({
+    path                  = string
+    positional_constraint = string
+  }))
+  default = [
+    { path = "/auth/login", positional_constraint = "EXACTLY" },
+    { path = "/auth/logout", positional_constraint = "EXACTLY" },
+    { path = "/auth/callback", positional_constraint = "EXACTLY" },
+    { path = "/auth/me", positional_constraint = "EXACTLY" },
+    { path = "/request_access", positional_constraint = "EXACTLY" },
+    { path = "/active_requests", positional_constraint = "EXACTLY" },
+    { path = "/past_requests", positional_constraint = "EXACTLY" },
+    { path = "/accounts", positional_constraint = "EXACTLY" },
+    { path = "/geolocate", positional_constraint = "STARTS_WITH" },
+    { path = "/hook", positional_constraint = "STARTS_WITH" },
+    { path = "/version", positional_constraint = "EXACTLY" },
+    { path = "/static", positional_constraint = "STARTS_WITH" },
+    { path = "/access", positional_constraint = "STARTS_WITH" },
+    { path = "/health", positional_constraint = "EXACTLY" }
+  ]
+}

terraform/waf.tf

@@ -151,218 +151,23 @@ resource "aws_wafv2_web_acl" "sre-bot" {
     }
 
     statement {
-      and_statement {
+      not_statement {
         statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/auth/login"
-                field_to_match {
-                  uri_path {}
+          or_statement {
+            dynamic "statement" {
+              for_each = var.authorized_endpoints_with_constraints
+              content {
+                byte_match_statement {
+                  search_string = statement.value.path
+                  field_to_match {
+                    uri_path {}
+                  }
+                  text_transformation {
+                    priority = 0
+                    type     = "NONE"
+                  }
+                  positional_constraint = statement.value.positional_constraint
                 }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/auth/logout"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/auth/callback"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/static"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "STARTS_WITH"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/auth/me"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/request_access"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/active_requests"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/past_requests"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/geolocate"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "STARTS_WITH"
-              }
-            }
-          }
-        }
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/hook"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "STARTS_WITH"
-              }
-            }
-          }
-        }
-
-        statement {
-          not_statement {
-            statement {
-              byte_match_statement {
-                search_string = "/version"
-                field_to_match {
-                  uri_path {}
-                }
-                text_transformation {
-                  priority = 0
-                  type     = "NONE"
-                }
-                positional_constraint = "EXACTLY"
               }
             }
           }