Wafv2 owasp top 10 (#88)

* Add terraform module to create AWS WAFv2 rule-group that cover OWASP TOP 10 security issues

* Update README for aws-wafv2-top-10-owasp-rules terraform module

* use waf_scope in a name

* use lower function for waf_scope in name

* add some notes about using waf + cloudfront

Author: mglotov

terraform/modules/aws-wafv2-top-10-owasp-rules/README.md

@@ -0,0 +1,68 @@
+There are 2 implementations of AWS WAF: AWS WAF Classic and AWS WAFv2. AWS recommends using AWS WAFv2 for new installations.  
+This terraform module creates AWS WAFv2 rule-group with rules that cover *OWASP TOP 10 security issues* (https://d0.awsstatic.com/whitepapers/Security/aws-waf-owasp.pdf).  
+
+For a CloudFront distribution, AWS WAF is available globally, but you must use the Region US East (N. Virginia) for all of your work. You must create your web ACL using the Region US East (N. Virginia). You must also use this Region to create any other resources that you use in your web ACL, like rule groups, IP sets, and regex pattern sets.  
+
+Example of using this module: 
+```bash
+module "wafv2_owasp_top_10_rules" {
+  source = "../modules/aws-wafv2-top-10-owasp-rules"
+
+  name = "${var.name}-${local.env}"
+
+  waf_scope = "CLOUDFRONT"
+
+  max_expected_uri_size          = "512"
+  max_expected_query_string_size = "1024"
+  max_expected_body_size         = "4096"
+  max_expected_cookie_size       = "4093"
+
+  csrf_expected_header = "x-csrf-token"
+  csrf_expected_size   = "36"
+
+  cloudwatch_metrics_enabled = true
+  blacklisted_cidrs          = ["10.0.0.0/8", "192.168.0.0/16", "169.254.0.0/16", "172.16.0.0/16", "127.0.0.1/32"]
+}
+
+resource "aws_wafv2_web_acl" "example" {
+  name  = "${var.name}-${local.env}-webacl"
+  scope = "CLOUDFRONT"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "owasp_top10_rules"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      rule_group_reference_statement {
+        arn = module.wafv2_owasp_top_10_rules.rule_group_arn
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "owasp-top10-security-issues"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "${var.name}-${local.env}-webacl"
+    sampled_requests_enabled   = false
+  }
+}
+
+resource "aws_cloudfront_distribution" "example" {
+  ...
+  web_acl_id = aws_wafv2_web_acl.example.arn
+  ...
+}
+```