data "aws_region" "current" {}

resource "aws_wafv2_rule_group" "regional_ip_block_rule_group" {
  for_each    = local.aws_regions
  name        = "${var.environment}-${var.rule_group_name}"
  description = "An rule group for IP block rules"
  scope       = "REGIONAL"
  capacity    = var.rule_group_capacity
  region      = each.value

  rule {
    name     = "${var.environment}-${var.ip_set_prefix}-ipv4-block-rule"
    priority = 1

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = (
          var.reuse_existing_ip_sets ?
          data.aws_wafv2_ip_set.regional_gsirt_ioc_ipv4_set[each.value].arn :
          aws_wafv2_ip_set.regional_gsirt_ioc_ipv4_set[each.value].arn
        )
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "${var.environment}-${var.ip_set_prefix}-ipv4-block-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "${var.environment}-${var.ip_set_prefix}-ipv6-block-rule"
    priority = 2

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = (
          var.reuse_existing_ip_sets ?
          data.aws_wafv2_ip_set.regional_gsirt_ioc_ipv6_set[each.value].arn :
          aws_wafv2_ip_set.regional_gsirt_ioc_ipv6_set[each.value].arn
        )
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "${var.environment}-${var.ip_set_prefix}-ipv6-block-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
  name     = "${var.environment}-${var.ip_set_prefix}-cloudflare-connecting-ip-block-rule"
  priority = 3

  action {
    block {}
  }

  statement {
    ip_set_reference_statement {
      arn = (
        var.reuse_existing_ip_sets ?
        data.aws_wafv2_ip_set.regional_gsirt_ioc_ipv4_set[each.value].arn :
        aws_wafv2_ip_set.regional_gsirt_ioc_ipv4_set[each.value].arn
      )

      ip_set_forwarded_ip_config {
        header_name       = "CF-Connecting-IP"
        fallback_behavior = "NO_MATCH"
        position          = "FIRST"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-${var.ip_set_prefix}-cloudflare-connecting-ip-block-rule"
    sampled_requests_enabled   = true
  }
}

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-${var.rule_group_name}"
    sampled_requests_enabled   = true
  }
}

resource "aws_wafv2_rule_group" "cloudfront_ip_block_rule_group" {
  region      = "us-east-1"
  name        = "${var.environment}-${var.rule_group_name}"
  description = "An rule group for IP block rules"
  scope       = "CLOUDFRONT"
  capacity    = var.rule_group_capacity

  rule {
    name     = "${var.environment}-${var.ip_set_prefix}-ipv4-block-rule"
    priority = 1

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = (
          var.reuse_existing_ip_sets ?
          data.aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv4_set[0].arn :
          aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv4_set[0].arn
        )
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "${var.environment}-${var.ip_set_prefix}-ipv4-block-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "${var.environment}-${var.ip_set_prefix}-ipv6-block-rule"
    priority = 2

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = (
          var.reuse_existing_ip_sets ?
          data.aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv6_set[0].arn :
          aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv6_set[0].arn
        )
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "${var.environment}-${var.ip_set_prefix}-ipv6-block-rule"
      sampled_requests_enabled   = true
    }
  }

  rule {
  name     = "${var.environment}-${var.ip_set_prefix}-cloudflare-connecting-ip-block-rule"
  priority = 3

  action {
    block {}
  }

  statement {
    ip_set_reference_statement {
      arn = (
        var.reuse_existing_ip_sets ?
        data.aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv4_set[0].arn :
        aws_wafv2_ip_set.cloudfront_gsirt_ioc_ipv4_set[0].arn
      )

      ip_set_forwarded_ip_config {
        header_name       = "CF-Connecting-IP"
        fallback_behavior = "NO_MATCH"
        position          = "FIRST"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-${var.ip_set_prefix}-cloudflare-connecting-ip-block-rule"
    sampled_requests_enabled   = true
  }
}

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.environment}-${var.rule_group_name}"
    sampled_requests_enabled   = true
  }
}