# Create WAF for Cloudfront distribution
module "custom_cloudfront_waf" {
  source            = "git@github.com:theorchard/terraform-aws-waf.git//?ref=2.0.1"
  environment       = var.environment
  service_name      = "${var.service_name}-awal-cloudfront"
  aws_region        = var.aws_region
  acl_scope         = "CLOUDFRONT"
  count_waf_enabled = false
  block_waf_enabled = true
  # See https://theorchard.atlassian.net/browse/DEVEX-393 for exclusion explanations
  excluded_rules = [
    "CrossSiteScripting_BODY",
    "EC2MetaDataSSRF_COOKIE",
    "EC2MetaDataSSRF_QUERYARGUMENTS",
    "NoUserAgent_HEADER",
    "SizeRestrictions_BODY",
    "SizeRestrictions_QUERYSTRING",
  ]
}