Skip to content

Commit

Permalink
Temporarily remove WAF configuration
Browse files Browse the repository at this point in the history
There are some complexities around defining regions on WAFs for CloudFront resources, and it's unclear from the docs where these apply to API gateways in the edge mode. Removing temporarily to get the API gateway deploying properly.
  • Loading branch information
sihugh committed Oct 17, 2024
1 parent eec2d6d commit e045e8d
Showing 1 changed file with 0 additions and 52 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -62,58 +62,6 @@ resource "aws_api_gateway_base_path_mapping" "search_api_mapping" {
api_id = aws_api_gateway_rest_api.search_rest_api.id
}

# WAF settings
resource "aws_wafv2_web_acl" "search_api_waf" {
name = "search-api-waf"
description = "WAF for Search API with rate limiting"
provider = aws.global_region
scope = "CLOUDFRONT"

default_action {
allow {}
}

rule {
name = "rate-limit-rule"
priority = 1
action {
block {}
}

statement {
rate_based_statement {
limit = 100 # Limit 100 requests per IP in 5 minutes
aggregate_key_type = "IP"
}
}

visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "search-api-rate-limit-rule"
sampled_requests_enabled = true
}
}

visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "search-api-waf"
sampled_requests_enabled = true
}
}

resource "aws_wafv2_web_acl_association" "waf_association" {
resource_arn = aws_api_gateway_domain_name.search_api_domain.arn
web_acl_arn = aws_wafv2_web_acl.search_api_waf.arn
provider = aws.global_region
}

resource "aws_shield_protection" "search_api_shield" {
name = "search-api-shield"
resource_arn = aws_api_gateway_rest_api.search_rest_api.execution_arn
provider = aws.global_region
}


output "api_gateway_cname" {
value = aws_api_gateway_domain_name.search_api_domain.cloudfront_domain_name
description = "CNAME to use in your DNS settings"
Expand Down

0 comments on commit e045e8d

Please sign in to comment.