azurerm_web_application_firewall_policy does not support rule group REQUEST-944-APPLICATION-ATTACK-JAVA

tjanuario commented 3 years ago

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

New or Affected Resource(s)

azurerm_web_application_firewall_policy

Description

With version 2.35.0

resource: azurerm_web_application_firewall_policy

managed_rule_set {
  type    = "OWASP"
  version = "3.1"

  rule_group_override {
    rule_group_name = "REQUEST-944-APPLICATION-ATTACK-JAVA"
    disabled_rules  = [
      "944120",      # Possible payload execution and remote command execution
      "944130",      # Suspicious Java classes
      "944200"       # Exploitation of Java deserialization Apache Commons
    ]
  }
}

Results in the following error on apply: Error: expected managed_rules.0.managed_rule_set.0.rule_group_override.11.rule_group_name to be one of [crs_20_protocol_violations crs_21_protocol_anomalies crs_23_request_limits crs_30_http_policy crs_35_bad_robots crs_40_generic_attacks crs_41_sql_injection_attacks crs_41_xss_attacks crs_42_tight_security crs_45_trojans General REQUEST-911-METHOD-ENFORCEMENT REQUEST-913-SCANNER-DETECTION REQUEST-920-PROTOCOL-ENFORCEMENT REQUEST-921-PROTOCOL-ATTACK REQUEST-930-APPLICATION-ATTACK-LFI REQUEST-931-APPLICATION-ATTACK-RFI REQUEST-932-APPLICATION-ATTACK-RCE REQUEST-933-APPLICATION-ATTACK-PHP REQUEST-941-APPLICATION-ATTACK-XSS REQUEST-942-APPLICATION-ATTACK-SQLI REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION], got REQUEST-944-APPLICATION-ATTACK-JAVA

tjanuario commented 3 years ago

To be clear, this means that none of the elements in the REQUEST-944-APPLICATION-ATTACK-JAVA section can be disabled using the terraform configuration.

ghost commented 3 years ago

This has been released in version 2.42.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.42.0"
}
# ... other configuration ...

ghost commented 3 years ago

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!

hashicorp / terraform-provider-azurerm