variable "aws_region" {
  default = "us-east-1"
}

variable "acl_scope" {
  description = "Scope for ACL: options are CLOUDFRONT or REGIONAL (everything else)"
  default     = "REGIONAL"
}

variable "environment" {
  default     = "dev"
  description = "One of dev, qa, or prod"
}

variable "count_only_rules" {
  description = "The default rules applied to the count-only waf"
  default = [
    {
      name                                     = "common-rule-set"
      managed_rule_group_statement_name        = "AWSManagedRulesCommonRuleSet"
      managed_rule_group_statement_vendor_name = "AWS"
      priority                                 = 1
    },
    {
      name                                     = "known-bad-inputs"
      managed_rule_group_statement_name        = "AWSManagedRulesKnownBadInputsRuleSet"
      managed_rule_group_statement_vendor_name = "AWS"
      priority                                 = 10
    },
  ]
}

variable "block_rules" {
  description = "The default rules applied to the blocking waf"
  default = [
    {
      name                                     = "common-rule-set"
      managed_rule_group_statement_name        = "AWSManagedRulesCommonRuleSet"
      managed_rule_group_statement_vendor_name = "AWS"
      priority                                 = 1
    },
    {
      name                                     = "known-bad-inputs"
      managed_rule_group_statement_name        = "AWSManagedRulesKnownBadInputsRuleSet"
      managed_rule_group_statement_vendor_name = "AWS"
      priority                                 = 10
    },
  ]
}

variable "count_only_rule_cloudwatch_metrics_enabled" {
  description = "Collect CloudWatch metrics for the count-only WAF rules."
  default     = true
}

variable "count_only_rule_metric_name" {
  description = "CloudWatch metric name for the count-only WAF rules."
  default     = "waf-count-acl"
}

variable "count_only_rule_sampled_requests_enabled" {
  description = "Collect samplings of the web requests that match the count-only WAF rules."
  default     = true
}

variable "block_rule_cloudwatch_metrics_enabled" {
  description = "Collect CloudWatch metrics for the blocking WAF rules."
  default     = true
}

variable "block_rule_metric_name" {
  description = "CloudWatch metric name for the blocking WAF rules."
  default     = "waf-block-acl"
}

variable "block_rule_sampled_requests_enabled" {
  description = "Collect samplings of the web requests that match the blocking WAF rules."
  default     = true
}

variable "custom_rules" {
  type = list(object({
    name           = string
    priority       = number
    rule_group_arn = string
    metric_name    = optional(string)
  }))
  default     = []
  description = "A list of custom rule objects. Intended to be used with aws_wafv2_rule_group resources"
}

variable "gsirt_ip_block_rule_group_priority" {
  type        = number
  description = "Priority of the GSIRT IP block rule group"
  default     = 2
}

variable "gsirt_ip_block_rule_group_enabled" {
  type        = bool
  description = "Enable or disable the GSIRT IP block rule group"
  default     = true
}

variable "custom_gsirt_ip_block_rule_group_name" {
  description = "Custom name of the GSIRT IP block rule group. Only use for custom rule groups."
  default     = ""
}

variable "excluded_rules" {
  type        = list(string)
  default     = []
  description = "A list of rules to exclude from the managed rule group."
}

variable "service_name" {
  description = "The ability to create service-specific AWS WAFs for specific requirements"
  default     = "orcd"
}

variable "count_waf_enabled" {
  description = "Enable or disable alerting waf"
  default     = true
}

variable "block_waf_enabled" {
  description = "Enable or disable blocking waf"
  default     = true
}

variable "logging_config_enabled" {
  description = "Enable or disable creation of logging configurations for the created WAF ACLs"
  default     = true
}

variable "logging_config_default_destination" {
  type        = string
  description = "Arn of the default destination for the WAF logs. Set to the S3 bucket in the shared account."
  default     = "arn:aws:s3:::aws-waf-logs-shared-orcd"
}

variable "logging_config_additional_destinations" {
  type        = list(string)
  description = "Any additional arns of log destinations to use."
  default     = []
}

variable "logging_config_redacted_headers" {
  type        = list(string)
  description = "List of headers to redact when passing to logs"
  default = [
    "authorization",
    "session",
    "cookie",
  ]
}

variable "geoip_blocked_countries" {
  type    = list(string)
  default = []
  validation {
    condition     = alltrue([for countries in var.geoip_blocked_countries : length(countries) == 2])
    error_message = "Each country code must be a 2-letter ISO code."
  }
}

variable "geoip_block_rule_group_priority" {
  type        = number
  description = "Priority of the Geographical IP block rule group"
  default     = 3
}

locals {
  count_only_rule_metric_name = "${var.environment}-${var.service_name}-${var.count_only_rule_metric_name}"
  block_rule_metric_name      = "${var.environment}-${var.service_name}-${var.block_rule_metric_name}"

  tags = {
    terraformed  = "true"
    environment  = var.environment
    service_name = var.service_name
  }
}