Open kreynoldsf5 opened 2 years ago
Config immediately after a terraform apply
:
"bot_defense": {
"regional_endpoint": "US",
"policy": {
"protected_app_endpoints": [
{
"metadata": {
"name": "demo-app-bot-defense",
"description": null,
"disable": null
},
"http_methods": [
"POST"
],
"protocol": "BOTH",
"any_domain": {},
"path": {
"prefix": "/cart"
},
"web": {},
"mitigation": {
"block": {
"status": "BadRequest",
"body": "string:///PHA+VGhpcyBpcyBhIGJvdCBkZWZlbnNlIGJsb2NrIHBhZ2UuPC9wPg=="
}
}
}
],
...
Here's the config after a manual update:
"bot_defense": {
"regional_endpoint": "US",
"policy": {
"protected_app_endpoints": [
{
"metadata": {
"name": "demo-app-bot-defense",
"description": "",
"disable": false
},
"http_methods": [
"POST"
],
"protocol": "BOTH",
"domain": {
"exact_value": "micro.gsa.f5demos.com"
},
"path": {
"prefix": "/cart"
},
"web": {},
"mitigation": {
"block": {
"status": "BadRequest",
"body": "string:///PHA+VGhpcyBpcyBhIGJvdCBkZWZlbnNlIGJsb2NrIHBhZ2UuPC9wPg=="
}
}
}
],
"js_insert_all_pages": {
"javascript_location": "AFTER_HEAD"
},
"js_download_path": "/common.js"
},
"timeout": 1000
},
...
Here's an example terraform plan output:
$terraform plan -var-file ./tfvars/gsa.tfvars
...
module.volterra.volterra_http_loadbalancer.frontend: Refreshing state... [id=6048b25a-fac0-4763-8cf7-abd90279b208]
...
No changes. Your infrastructure matches the configuration.
When creating/editing a 'bot_defense' policy under an HTTP loadbalancer, subsequent drift is not detected.
For example, apply this as part of an http lb.
If someone were to manually edit settings in the console (edit domains, path, etc.), running 'plan' or 'apply' would not detect any drift in state.