AWS Control Plane Setup

tags = {
  environment = "production"
  team        = "ml-platform"
  cost-center = "1234"
}

disable_default_tags = true

helm upgrade --install truefoundry oci://tfy.jfrog.io/tfy-helm/truefoundry \
  -n truefoundry --create-namespace \
  -f truefoundry-values.yaml

https://<your-truefoundry-control-plane-url>/admin/grafana/

resource "aws_wafv2_ip_set" "allowlist" {
  count              = var.enable_waf && length(var.waf_ip_allowlist) > 0 ? 1 : 0
  name               = "${local.waf_name_effective}-allowlist"
  description        = "Trusted IPs that bypass WAF managed rules"
  scope              = var.waf_scope
  ip_address_version = "IPV4"
  addresses          = var.waf_ip_allowlist
  tags               = local.waf_required_tags
}

resource "aws_wafv2_web_acl" "this" {
  count       = var.enable_waf ? 1 : 0
  name        = local.waf_name_effective
  description = "WAFv2 Web ACL for ${var.cluster_name}"
  scope       = var.waf_scope
  tags        = local.waf_required_tags

  # WAF-016 (Info): default action kept as `allow`. See note above for the
  # deny-by-default alternative.
  default_action {
    allow {}
  }

  # ... insert rule blocks here (see sections below) ...

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "WebAclMetrics"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesKnownBadInputsRuleSet"
  priority = 0

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesKnownBadInputsRuleSet"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesKnownBadInputsRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesSQLiRuleSet"
  priority = 1

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesSQLiRuleSet"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesSQLiRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWSManagedRulesAmazonIpReputationList"
  priority = 2

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesAmazonIpReputationList"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesAmazonIpReputationList"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "AWS-AWSManagedRulesCommonRuleSet"
  priority = 3

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesCommonRuleSet"
      vendor_name = "AWS"

      rule_action_override {
        name = "SizeRestrictions_BODY"

        action_to_use {
          allow {}
        }
      }

      rule_action_override {
        name = "NoUserAgent_HEADER"

        action_to_use {
          count {}
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "Rate_limit_by_IP_Address_to_manage_DDoS_attacks"
  priority = 4

  action {
    block {}
  }

  statement {
    rate_based_statement {
      limit                 = var.waf_rate_limit
      aggregate_key_type    = "IP"
      evaluation_window_sec = var.waf_evaluation_window_sec

      scope_down_statement {
        byte_match_statement {
          search_string         = "/api/"
          positional_constraint = "STARTS_WITH"

          field_to_match {
            uri_path {}
          }

          text_transformation {
            priority = 0
            type     = "LOWERCASE"
          }
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "LimitRequests100"
    sampled_requests_enabled   = true
  }
}

dynamic "rule" {
  for_each = length(aws_wafv2_ip_set.allowlist) > 0 ? [1] : []

  content {
    name     = "cargill_whitelist_ips"
    priority = 5

    action {
      allow {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.allowlist[0].arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "cargill_whitelist_ips"
      sampled_requests_enabled   = true
    }
  }
}

rule {
  name     = "AWSManagedRulesAnonymousIpList"
  priority = 6

  override_action {
    none {}
  }

  statement {
    managed_rule_group_statement {
      name        = "AWSManagedRulesAnonymousIpList"
      vendor_name = "AWS"
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "AWSManagedRulesAnonymousIpList"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "BlockSQLiAttacks"
  priority = 7

  action {
    count {} # TODO: switch to `block {}` after validating no false positives
  }

  statement {
    sqli_match_statement {
      field_to_match {
        body {}
      }

      text_transformation {
        priority = 0
        type     = "URL_DECODE"
      }

      text_transformation {
        priority = 1
        type     = "HTML_ENTITY_DECODE"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "BlockSQLiAttacks"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "BlockXSSAttacks"
  priority = 8

  action {
    count {} # TODO: switch to `block {}` after validating no false positives
  }

  statement {
    xss_match_statement {
      field_to_match {
        all_query_arguments {}
      }

      text_transformation {
        priority = 0
        type     = "URL_DECODE"
      }

      text_transformation {
        priority = 1
        type     = "HTML_ENTITY_DECODE"
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "BlockXSSAttacks"
    sampled_requests_enabled   = true
  }
}

rule {
  name     = "GeoBlockRule"
  priority = 9

  action {
    block {}
  }

  statement {
    not_statement {
      statement {
        geo_match_statement {
          country_codes = var.waf_geo_allowed_country_codes
        }
      }
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "GeoBlockRule"
    sampled_requests_enabled   = true
  }
}

data_protection_config {
  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["authorization"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["cookie"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["x-api-key"]
    }
  }

  data_protection {
    action = "SUBSTITUTION"
    field {
      field_type = "SINGLE_HEADER"
      field_keys = ["x-auth-token"]
    }
  }
}

resource "aws_cloudwatch_log_group" "waf" {
  count             = var.enable_waf ? 1 : 0
  name              = "aws-waf-logs-${local.waf_name_effective}"
  retention_in_days = var.waf_log_retention_days
  tags              = local.waf_required_tags
}

resource "aws_wafv2_web_acl_logging_configuration" "this" {
  count                   = var.enable_waf ? 1 : 0
  log_destination_configs = [aws_cloudwatch_log_group.waf[0].arn]
  resource_arn            = aws_wafv2_web_acl.this[0].arn

  redacted_fields {
    single_header {
      name = "authorization"
    }
  }

  redacted_fields {
    single_header {
      name = "cookie"
    }
  }
}

resource "aws_wafv2_web_acl_association" "alb" {
  count        = var.enable_waf && var.waf_associate_alb_arn != "" ? 1 : 0
  resource_arn = var.waf_associate_alb_arn
  web_acl_arn  = aws_wafv2_web_acl.this[0].arn
}