如何從 AWS WAF Terraform 資源 aws_wafv2_web_acl 中動態排除可變規則列表

Question

我正在嘗試使用具有多個規則的 Terraform 創建 AWS WEB-ACL，還想從 AWS Managed rulset 中排除多個規則。 但我無法動態排除來自變量的多個規則。 這是我的代碼。

變量.tfvars

# Region
region="us-east-1"

# Environment
environment="nonprod"


# ACLs Definations
acls = {
  web: {
    AWSManagedRuleSets: [
      {
        name: "AWSManagedRulesCommonRuleSet",
        vendor_name: "AWS",
        excluded_rule: [
          "SizeRestrictions_QUERYSTRING",
          "NoUserAgent_HEADER"
        ]
      }
    ]
  },

  api: {
    AWSManagedRuleSets: [
      {
        name: "AWSManagedRulesCommonRuleSet",
        vendor_name: "AWS",
        excluded_rule: [
          "SizeRestrictions_QUERYSTRING",
          "NoUserAgent_HEADER"
        ]
      },
      {
        name: "AWSManagedRulesLinuxRuleSet",
        vendor_name: "AWS",
        excluded_rule: []
      }
    ]
  },
}

主程序

resource "aws_wafv2_web_acl" "web_acl" {
  for_each = var.acls
  name        = "waf-web-acl-${lower(var.environment)}-${each.key}"
  description = "WAF ACL ap-${each.key} for env ${lower(var.environment)}"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }


  dynamic "rule" {
    for_each = var.acls[each.key]["AWSManagedRuleSets"]
    content {
      name = rule.value.name
      priority = 0
      override_action {
        count {}
      }
      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = rule.value.vendor_name
//    HERE I WANNA EXCLUDE ALL THE RULE LISTED IN VARIABLE
//          excluded_rule = rule.value.excluded_rule
//          excluded_rule {
//            name = "SizeRestrictions_QUERYSTRING"
//          }
//          excluded_rule {
//            name = "NoUserAgent_HEADER"
//          }
        }
      }
      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = "waf-rule-${lower(var.environment)}-${each.key}-${rule.value.name}"
        sampled_requests_enabled   = true
      }
    }
}

  tags = {
    ManagedBy = "Terraform"
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "waf-web-acl-${lower(var.environment)}-${each.key}"
    sampled_requests_enabled   = true
  }
}

Answer 1

我無權訪問 AWS，但我認為可以使用如下所示的嵌套block 。

dynamic "rule" {
    for_each = var.acls[each.key]["AWSManagedRuleSets"]
    content {
      name = rule.value.name
      priority = 0
      override_action {
        count {}
      }
      statement {
        managed_rule_group_statement {
          name        = rule.value.name
          vendor_name = rule.value.vendor_name
        }
        // another for_each loop to iterate over excluded_rule list
        dynamic "excluded_rule" {
          for_each = rule.value.excluded_rule
          content {
            name = excluded_rule.value
          }
        }
      }
      visibility_config {
        cloudwatch_metrics_enabled = true
        metric_name                = "waf-rule-${lower(var.environment)}-${each.key}-${rule.value.name}"
        sampled_requests_enabled   = true
      }
    }
}