locals {
  account_alias = data.aws_iam_account_alias.current.account_alias
}

data "aws_iam_account_alias" "current" {}

resource "aws_wafregional_ipset" "main" {
  name = "${local.account_alias}-blacklist_ipset"
  dynamic "ip_set_descriptor" {
    for_each = [for ip_set in var.ip_set : {
      type  = ip_set.type
      value = ip_set.value
    }]
    content {
      type  = ip_set_descriptor.value.type
      value = ip_set_descriptor.value.value
    }
  }
}

resource "aws_wafregional_rule" "main" {
  depends_on  = [aws_wafregional_ipset.main]
  name        = "${local.account_alias}-restrict-access-by-ip"
  metric_name = "WafRuleRestrictAccessByIp"

  predicate {
    data_id = aws_wafregional_ipset.main.id
    negated = false
    type    = "IPMatch"
  }
}

resource "aws_wafregional_web_acl" "main" {
  depends_on  = [aws_wafregional_ipset.main, aws_wafregional_rule.main]
  name        = "${local.account_alias}-restrict-access-by-ip"
  metric_name = "WafAclRestrictAccessByIp"

  default_action {
    type = var.default_action
  }

  rule {
    action {
      type = var.rules_action
    }

    priority = 1
    rule_id  = aws_wafregional_rule.main.id
    type     = "REGULAR"
  }
}