locals {
  name_prefix        = lower("${var.env_prefix}-${var.project_group}")
  metric_name_prefix = "${var.env_prefix}${var.project_group}"
}

resource "aws_waf_ipset" "main" {
  name = "${local.name_prefix}-ipset"

  dynamic "ip_set_descriptors" {
    for_each = var.whilelisted_ip_set
    content {
      type  = ip_set_descriptors.value.type
      value = ip_set_descriptors.value.value
    }
  }
}

resource "aws_waf_rule" "main" {
  name        = "${local.name_prefix}-waf_rules"
  metric_name = "${local.metric_name_prefix}WafRule"

  predicates {
    data_id = aws_waf_ipset.main.id
    negated = false
    type    = "IPMatch"
  }

  depends_on = [aws_waf_ipset.main]
}

resource "aws_waf_web_acl" "main" {
  name        = "${local.name_prefix}-web_acl"
  metric_name = "${local.metric_name_prefix}WebAcl"

  default_action {
    type = "BLOCK"
  }

  rules {
    action {
      type = "ALLOW"
    }

    priority = 1
    rule_id  = aws_waf_rule.main.id
    type     = "REGULAR"
  }

  depends_on = [
    aws_waf_ipset.main,
    aws_waf_rule.main,
  ]

  lifecycle {
    ignore_changes = [tags]
  }
}