update preconfig waf rules block to support path matches

[nhu-nguyen27]

This preconfig waf rule is being trigger whenever there's certain keywords in the URI. We have try the following to exclude the alert from being trigger using the preconfig waf exclusion parameter:

"methodenforcement-v33-stable_level_1" = {
      action            = "deny(403)"
      preview           = true
      priority          = 6
      description       = "Method enforcement Level 1"
      target_rule_set   = "methodenforcement-v33-stable"
      sensitivity_level = 1
      preconfigured_waf_config_exclusion = {
        target_rule_set = "methodenforcement-v33-stable"
        target_rule_ids = ["owasp-crs-v030301-id911100-methodenforcement"]
        request_uri = [
          {
            operator = "CONTAINS"
            value    = "/keyword/here/"
          },
        ]
      }

Whenever its not working and after talking to Google support rep, they suggest we try something like this

evaluatePreconfiguredWaf('methodenforcement-v33-stable', {'sensitivity': 1}) && !request.path.matches('/keyword/here/')

But from the current module, it doesnt look like we can pass in path matches etc?

[imrannayer]

@nhu-nguyen27 This can be done using custom_rule variable. Here is an example but custom rules currently dont have preconfigured_waf_config block support in this module. We will need to add preconfigured_waf_config block in custom rule to support this type of rule.

You code will look something like this:

custom_rules = {

  "methodenforcement-v33-stable_level_1" = {
    action            = "deny(403)"
    priority          = 6
    description       = "Method enforcement Level 1"
    preview           = true
    expression        = "evaluatePreconfiguredWaf('methodenforcement-v33-stable', {'sensitivity': 1}) && !request.path.matches('/keyword/here/')"
  }

}

Once we add support for preconfigured_waf_config_exclusion in custom_rules your code will be:

custom_rules = {

    "methodenforcement-v33-stable_level_1" = {
      action            = "deny(403)"
      priority          = 6
      description       = "Method enforcement Level 1"
      preview           = true
      expression        = "evaluatePreconfiguredWaf('methodenforcement-v33-stable', {'sensitivity': 1}) && !request.path.matches('/keyword/here/')"

      preconfigured_waf_config_exclusion = {
        target_rule_set = "methodenforcement-v33-stable"
        target_rule_ids = ["owasp-crs-v030301-id911100-methodenforcement"]
        request_uri = [
          {
            operator = "CONTAINS"
            value    = "/keyword/here/"
          },
        ]
      }
    }

  }

[imrannayer]

created issue #66 to support this using custom_rules

[nhu-nguyen27]

I see, I will move the rule out of pre_configured_rules block and add it under custom_rules block instead. Thank you for the suggestions.

[imrannayer]

@nhu-nguyen27 we dont have pre_configured_waf_exclusion block support in custom_rules variable. Do you need pre_configured_waf_exclusion block?

[nhu-nguyen27]

No, I dont need pre_configured_waf_exclusion because I try to use it to exclude alerts from being trigger when certain keywords is in the path for the URI like this:

"methodenforcement-v33-stable_level_1" = {
      action            = "deny(403)"
      preview           = true
      priority          = 6
      description       = "Method enforcement Level 1"
      target_rule_set   = "methodenforcement-v33-stable"
      sensitivity_level = 1
      preconfigured_waf_config_exclusion = {
        target_rule_set = "methodenforcement-v33-stable"
        target_rule_ids = ["owasp-crs-v030301-id911100-methodenforcement"]
        request_uri = [
          {
            operator = "CONTAINS"
            value    = "/keyword/here/"
          },
        ]
      }

But its not working so I want to try to exclude the path match like this instead of URI
expression = "evaluatePreconfiguredWaf('methodenforcement-v33-stable', {'sensitivity': 1}) && !request.path.matches('/keyword/here/')"