module "default_tags" {
  source             = "git@github.com:theorchard/terraform-default-tags.git//?ref=1.0.0"
  environment        = var.environment
  application_family = var.application_family
  service_name       = var.service_name
}

provider "aws" {
  region = var.aws_region

  default_tags {
    tags = module.default_tags.tags
  }
}

terraform {
  backend "s3" {
    bucket  = "shared-orcd-terraform-state"
    key     = "prod/dev-box/waf/terraform.tfstate"
    region  = "us-east-1"
    encrypt = "true"
  }
}

data "aws_s3_bucket" "logging_bucket_waf" {
  bucket = "aws-waf-logs-${var.environment}-orcd"
}

resource "aws_wafv2_rule_group" "custom_rule_group" {
  name        = "${var.environment}-${var.service_name}-custom-rule-group"
  description = "${var.environment}-${var.service_name}-custom-rule-group"
  scope       = "REGIONAL"
  capacity    = 500

  rule {
    name     = "query-string-length-rule"
    priority = 1

    action {
      block {}
    }

    statement {

      size_constraint_statement {

        comparison_operator = "GT"

        field_to_match {
          query_string {}
        }

        size = 20480

        text_transformation {
          priority = 1
          type     = "NONE"
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "query-string-length-rule"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "query-string-length-rule"
    sampled_requests_enabled   = true
  }
}

module "custom_waf" {
  source            = "git@github.com:theorchard/terraform-aws-waf.git//?ref=1.4.0"
  environment       = var.environment
  service_name      = var.service_name
  aws_region        = var.aws_region
  count_waf_enabled = false
  block_waf_enabled = true
  # See https://theorchard.atlassian.net/browse/DEVEX-392 and https://theorchard.atlassian.net/browse/DEVEX-393 for exclusion explanations
  excluded_rules = [
    "CrossSiteScripting_BODY",
    "EC2MetaDataSSRF_COOKIE",
    "EC2MetaDataSSRF_QUERYARGUMENTS",
    "NoUserAgent_HEADER",
    "SizeRestrictions_BODY",
    "SizeRestrictions_QUERYSTRING",
  ]
  custom_rules = [
    {
      name                       = "custom-query-string-length-group"
      rule_group_arn             = aws_wafv2_rule_group.custom_rule_group.arn
      priority                   = 2
      cloudwatch_metrics_enabled = true
      metric_name                = "waf-block-acl"
      sampled_requests_enabled   = true
    },
  ]
}

resource "aws_wafv2_web_acl_logging_configuration" "waf_block_web_acl_logging_configuration" {
  log_destination_configs = [data.aws_s3_bucket.logging_bucket_waf.arn]
  resource_arn            = module.custom_waf.waf_blocking_arn_output

  redacted_fields {
    single_header {
      name = "authorization"
    }
  }

  redacted_fields {
    single_header {
      name = "session"
    }
  }

  redacted_fields {
    single_header {
      name = "cookie"
    }
  }
}