WAF

Terraform module to create AWS WAF v2 resources

Version

v2.1.0

Repository

Submodules

api-keyip-setlogging-configurationregex-pattern-setrule-groupweb-acl-associationweb-acl-ruleweb-acl-rule-group-association

Inputs

association_configoptionalmap(object({ default_size_inspection_limit = string }))

Configuration for body inspection size limits per resource type. Keys are resource types (e.g., `CLOUDFRONT`, `API_GATEWAY`, `COGNITO_USER_POOL`, `APP_RUNNER_SERVICE`, `VERIFIED_ACCESS_INSTANCE`)

Default{}

association_resource_arnsoptionalmap(string)

Map of resource ARNs to associate with the Web ACL. Key is a friendly name, value is the resource ARN

Default{}

captcha_configoptionalobject({ immunity_time_property = object({ immunity_time = number }) })

CAPTCHA configuration for the Web ACL. Specifies how long a CAPTCHA timestamp is considered valid

Defaultnull

challenge_configoptionalobject({ immunity_time_property = object({ immunity_time = number }) })

Challenge configuration for the Web ACL. Specifies how long a challenge timestamp is considered valid

Defaultnull

createoptionalbool

Controls if resources should be created (affects all resources)

Defaulttrue

create_logging_configurationoptionalbool

Controls if a logging configuration should be created for the Web ACL

Defaultfalse

custom_response_bodiesoptionalmap(object({ content = string content_type = string }))

Map of custom response body configurations. Key is the reference key, used in custom responses

Default{}

data_protection_configoptionalany

Data protection configuration. `data_protections` is a list of objects with `field` (object with `field_keys` list and `field_type` one of `SINGLE_HEADER`/`SINGLE_COOKIE`/`SINGLE_QUERY_ARGUMENT`/`QUERY_STRING`/`BODY`), `action` (`HASH` or `SUBSTITUTION`), `exclude_rate_based_details` (bool, optional…

Defaultnull

default_actionoptionalany

Action to perform if none of the rules contained in the Web ACL match. Use `allow` or `block` for simple actions, or provide an object for custom request handling/response. See examples for object structure

Defaultallow

descriptionoptionalstring

A friendly description of the Web ACL

Defaultnull

logging_filteroptionalobject({ default_behavior = string filters = list(object({ behavior = string req…

A configuration block that specifies which web requests are kept in the logs and which are dropped

Defaultnull

logging_log_destination_configsoptionallist(string)

The Amazon Kinesis Data Firehose, CloudWatch Log Group, or S3 Bucket ARNs for the logging destination. Names must be prefixed with `aws-waf-logs-`

Default[]

logging_redacted_fieldsoptionallist(object({ method = optional(object({})) query_string = optional(object({})) …

The parts of the request that you want to keep out of the logs. Each entry must specify exactly one of `method`, `query_string`, `uri_path`, or `single_header`

Default[]

logging_regionoptionalstring

Region where the WAF logging configuration will be managed. Defaults to the provider region

Defaultnull

nameoptionalstring

A friendly name of the Web ACL. Mutually exclusive with `name_prefix`

Defaultnull

name_prefixoptionalstring

Creates a unique name beginning with the specified prefix. Mutually exclusive with `name` (provider rejects both being set at apply time)

Defaultnull

putin_khuylooptionalbool

Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Russian_invasion_of_Ukraine

Defaulttrue

rule_jsonoptionalstring

Escape hatch: JSON string of WAF rules for cases where dynamic blocks cannot represent all provider features. Mutually exclusive with `rules`

Defaultnull

rulesoptionalany

Map of WAF rule configurations. The key is used as the rule name. Each rule supports: - `priority` - (Required) Rule priority (lower = evaluated first) - `action` - Action for standalone rules. Use string (`allow`, `block`, `count`, `captcha`, `challenge`) or object for custom response - `override_a…

Default{}

scopeoptionalstring

Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`

DefaultREGIONAL

tagsoptionalmap(string)

A map of tags to add to all resources

Default{}

token_domainsoptionallist(string)

Specifies the domains that AWS WAF should accept in a web request token. Enables token use across multiple protected resources

Default[]

visibility_configoptionalobject({ cloudwatch_metrics_enabled = optional(bool, true) metric_name = optiona…

Visibility configuration for the Web ACL. Defines CloudWatch metrics configuration

Default{}

All 23 are optional — the module deploys with none of them set.

Outputs

logging_configuration_id

The ID of the WAF logging configuration

web_acl_application_integration_url

The URL to use in SDK integrations with managed rule groups

web_acl_arn

The ARN of the Web ACL

web_acl_association_ids

Map of Web ACL association IDs

web_acl_capacity

Web ACL capacity units (WCUs) currently being used by this Web ACL

web_acl_description

The description of the Web ACL

web_acl_id

The ID of the Web ACL

web_acl_lock_token

A token used for optimistic locking

web_acl_name

The name of the Web ACL

web_acl_rule_names

List of rule names in the Web ACL

web_acl_tags_all

A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block

web_acl_visibility_config

The visibility configuration of the Web ACL

What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.