umotif-public / terraform-aws-waf-webaclv2

Terraform module to configure WAF V2 Web ACL with managed rules for Application Load Balancer
https://registry.terraform.io/modules/umotif-public/waf-webaclv2/aws
Other
137 stars 124 forks source link

XFF is not taken into account in a and_statement #129

Open Taeglin opened 10 months ago

Taeglin commented 10 months ago

What is the current behavior? XFF is not taken into account in a and_statement

If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem.

`{ name = "Block_Non_Admin_IPs_For_Admin" priority = "1"

  action = "block"

  visibility_config = {
    metric_name = "Allow_Admin_IPs"
  }

  and_statement = {
    statements = [ # 2 or more statements are required for AND
      {
        not_statement = {
          ip_set_reference_statement = {
            arn = aws_wafv2_ip_set.admin_IPs_cloudfront.arn

            ip_set_forwarded_ip_config = {
              fallback_behavior = "NO_MATCH"
              header_name       = "X-Forwarded-For"
              position          = "ANY"
            }
          }
        }
      },
      {
        byte_match_statement = {
          field_to_match = {
            uri_path = "{}"
          }

          positional_constraint = "STARTS_WITH"
          search_string         = "/admin"
          priority              = 0
          type                  = "NONE"
        }
      }
    ]
  }
}`

What is the expected behavior?

When running terraform plan, I should see the XFF added in the rule but it's not Software versions?