main.tf

provider "aws" {
  region = "us-east-1"
}

data "aws_vpc" "default" {
  default = true
}


###################################################
# DNS Firewall Rule Group
###################################################

# DNS Firewall Advanced rules inspect the pattern of a DNS query instead of
# matching it against a domain list, so they catch threats which no list can
# enumerate. They are billed separately from the foundational rules.
module "rule_group" {
  source = "../../modules/dns-firewall-rule-group"
  # source  = "tedilabs/firewall/aws//modules/dns-firewall-rule-group"
  # version = "~> 0.4.0"

  name = "example-advanced-threat-protection"
  rules = [
    # A domain generated by an algorithm is a strong signal of malware calling
    # home, so this one blocks outright.
    {
      priority = 100
      name     = "block-dga"
      threat_protection = {
        type                 = "DGA"
        confidence_threshold = "HIGH"
      }
      action = "BLOCK"
      action_parameters = {
        response = "NXDOMAIN"
      }
    },
    # A dictionary DGA looks much more like a legitimate domain, so start with
    # `ALERT` and review the query logs before switching it to `BLOCK`.
    {
      priority = 200
      name     = "alert-dictionary-dga"
      threat_protection = {
        type                 = "DICTIONARY_DGA"
        confidence_threshold = "MEDIUM"
      }
      action = "ALERT"
    },
    # Data exfiltration over DNS shows up in TXT queries, so this rule narrows
    # its evaluation to that query type.
    {
      priority   = 300
      name       = "alert-dns-tunneling-txt"
      query_type = "TXT"
      threat_protection = {
        type                 = "DNS_TUNNELING"
        confidence_threshold = "LOW"
      }
      action = "ALERT"
    },
  ]

  tags = {
    "project" = "terraform-aws-firewall-examples"
  }
}

# A foundational rule group with the AWS managed Aggregate Threat List still
# carries the known-bad domains, and runs ahead of the advanced rules.
module "domain_list_aggregate_threat" {
  source = "../../modules/dns-firewall-domain-list"
  # source  = "tedilabs/firewall/aws//modules/dns-firewall-domain-list"
  # version = "~> 0.4.0"

  type = "MANAGED"
  name = "AWSManagedDomainsAggregateThreatList"
}

module "rule_group_foundational" {
  source = "../../modules/dns-firewall-rule-group"
  # source  = "tedilabs/firewall/aws//modules/dns-firewall-rule-group"
  # version = "~> 0.4.0"

  name = "example-foundational-threat-protection"
  rules = [
    {
      priority    = 100
      name        = "block-aggregate-threat"
      domain_list = module.domain_list_aggregate_threat.id
      action      = "BLOCK"
      action_parameters = {
        response = "NODATA"
      }

      # Follow the whole CNAME/DNAME chain rather than trusting the domains it
      # redirects to. `TRUST` inspects only the first domain of the chain.
      dns_redirection_chain_inspection_mode = "INSPECT"
    },
  ]

  tags = {
    "project" = "terraform-aws-firewall-examples"
  }
}


###################################################
# DNS Firewall
###################################################

module "firewall" {
  source = "../../modules/dns-firewall"
  # source  = "tedilabs/firewall/aws//modules/dns-firewall"
  # version = "~> 0.4.0"

  target = {
    type = "VPC"
    id   = data.aws_vpc.default.id
  }
  fail_open_enabled = false

  # The VPC evaluates the associated rule groups from the lowest priority, so
  # the known-bad domains are filtered before the advanced rules run.
  rule_groups = [
    {
      priority = 200
      name     = "example-foundational-threat-protection"
      id       = module.rule_group_foundational.id
    },
    {
      priority = 300
      name     = "example-advanced-threat-protection"
      id       = module.rule_group.id
    },
  ]

  tags = {
    "project" = "terraform-aws-firewall-examples"
  }
}