// terraform-aws-waf

Executive Summary

This module creates and manages AWS WAFv2 Web ACLs with comprehensive protection capabilities. It supports AWS Managed Rule Groups (Common Rule Set, SQL injection, known bad inputs, admin protection, IP reputation, and more), AWS Bot Control with COMMON or TARGETED inspection, rate-based rules with IP aggregation and scope-down statements, IP set reference rules for allow/block lists, geo match rules for country-based blocking, and fully custom rules with byte match, geo match, and size constraint statements. Logging is supported to Kinesis Firehose, CloudWatch Logs, or S3 with field redaction. Web ACL associations attach to ALB, API Gateway, AppSync, and Cognito resources. Both REGIONAL and CLOUDFRONT scopes are supported.

Overview

Architecture Diagram

Component Breakdown

Data Flow

Rules are evaluated in priority order (lowest number first). The first matching rule determines the action (ALLOW, BLOCK, or COUNT). If no rule matches, the default action applies. All evaluations are logged to the configured destination with CloudWatch metrics enabled per-rule for visibility.

Security Controls

Industry Adaptation

Production Readiness Checklist

• Enable AWSManagedRulesCommonRuleSet as the baseline managed rule group
• Add AWSManagedRulesKnownBadInputsRuleSet for Log4j and known exploit protection
• Enable WAF logging with enable_logging = true
• Start managed rules in COUNT mode, then switch to NONE (enforce) after review
• Configure rate limiting for public-facing endpoints
• Add IP reputation rules (AmazonIpReputationList)
• Redact sensitive headers (authorization, cookies) from logs
• Associate Web ACL with all public-facing ALBs and API Gateways
• Set up CloudWatch dashboards for WAF metrics
• Monitor Web ACL capacity units to stay within 1,500 WCU limit
• Enable Bot Control for applications with bot traffic concerns
• Use geo-blocking for traffic from high-risk countries

Configuration Reference

Required Variables

Key Optional Variables

AWS Managed Rule Groups Reference

Deployment

module "waf" {
  source = "github.com/kogunlowo123/terraform-aws-waf"

  name  = "my-web-acl"
  scope = "REGIONAL"

  managed_rule_groups = [
    {
      name            = "AWSManagedRulesCommonRuleSet"
      priority        = 10
      override_action = "none"
      excluded_rules  = []
    },
    {
      name            = "AWSManagedRulesKnownBadInputsRuleSet"
      priority        = 20
      override_action = "none"
      excluded_rules  = []
    }
  ]

  rate_limit_rules = [
    {
      name     = "global-rate-limit"
      priority = 100
      rate     = 2000
      action   = "block"
    }
  ]

  resource_arns = [aws_lb.main.arn]

  tags = { Environment = "production" }
}

Links