WAF policy resource, managed WAF rulesets data source, and waf_policy_id in build settings #77
Conversation
docs/resources/waf_policy.md
Outdated
| name = "Terraform Ruleset" | ||
| description = "This is a test ruleset through Terraform" |
There was a problem hiding this comment.
nit: this is the policy not the rule set. A policy contains a set of rule sets that each in turn contain a set of rules
There was a problem hiding this comment.
You're not wrong, but this is what netlify-react-ui sets for all its policies:
"name": "Baseline Ruleset",
"description": "Netlify maintained ruleset",
I copied this very early in the development and didn't think about it. I'll change it to say policy.
| description = "This is a test ruleset through Terraform" | ||
| rule_sets = [ | ||
| { | ||
| managed_id = "crs-basic", |
There was a problem hiding this comment.
is there some const that we can export? I don't know if terraform has those in general
There was a problem hiding this comment.
I will think about that. Worst-case, maybe a hard-coded data source? I'll let you know what I find.
There was a problem hiding this comment.
I don't see something in the docs, and ChatGPT also recommended a hard-coded data source - which I don't love. I haven't seen other people doing that.
I will note that there is a static validation on this: https://github.com/netlify/terraform-provider-netlify/pull/77/files#diff-020ba6260ff9fbb79426060f367c74580fbcd04ff8b20c35bbd6345d1acb9157R116
It will fail the .tf file before trying to apply, and I think smart IDEs might do a red squiggly if you enter an invalid value.
| @@ -0,0 +1,2 @@ | |||
| # Import a WAF policy by its team ID and the policy ID | |||
| terraform import netlify_log_drain.http 6600abcdef1234567890abcd:6600abcdef1234567890abcd | |||
There was a problem hiding this comment.
It should say netlify_waf_policy 🙂 It's an example of how you import it through the CLI. It goes into the generated Markdown docs.
|
Merging of this PR is waiting on an API change around plan capabilities, coming up in the next few days. The change might require logic change when connecting sites to policies, so I'm waiting for that to be done to test the two together. |
…_id in build settings
WAF policy resource
Managed WAF rules data source