search

trussworks / terraform-aws-wafv2

Creates a WAF using AWS WAFv2 and AWS Managed Rule Sets
https://registry.terraform.io/modules/trussworks/wafv2
Apache License 2.0
104 stars 58 forks source link

Feature/add flags to disable cloudwatch metrics #59

Closed schemmeltobi closed 2 years ago

schemmeltobi commented 3 years ago

Hi,

I don't know if this feature is desired or not 🤷. Basically it allows you to enable or disable cloudwatch metrics and request sampling.

I wanted to disable those in my project, which is why I created this PR. However I thought I could contribute. Maybe others find this useful.

The functional changes are all in the first commit. The second commit contains only non-functional changes (i.e. docs and terraform fmt). I hope this helps with the reviewability.

BR Tobi

dynamike commented 3 years ago

It's not clear to me there's a particular outcome that would benefit from disabled metrics. Could you clarify why disabling made sense for your project?

schemmeltobi commented 3 years ago

Hi,

we are using the module to create a WAF, which blocks our public services from being scraped by entities like censys.io etc. Therefore we deny list their public IPs. We are not particularly interested in the metrics of the WAF since it would only tell us how they try to scrape us. This is why we want to disable the metrics to save some 💰

BR Tobi

dynamike commented 2 years ago

So for that specific use case, I would argue that it makes more sense to use another mechanism to block IPs. Those could either be Security Groups or ALB forwarding rules. I'm going to close this PR. Feel free to re-open if you've got other questions.