Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

azure - front-door.filters.web-application-firewall-policies #9038

Merged
merged 27 commits into from Feb 6, 2024
Merged

azure - front-door.filters.web-application-firewall-policies #9038

merged 27 commits into from Feb 6, 2024

Conversation

dmytro-afanasiev
Copy link
Collaborator

@dmytro-afanasiev dmytro-afanasiev commented Oct 6, 2023 •
edited

Use case:

policies:
  - name: front-door
    resource: azure.front-door
    filters:
      - type: firewall-policy
        attrs:
          - type: value
            key: properties.managedRules.managedRuleSets[].ruleSetType
            value: DefaultRuleSet
            op: contains

@dmytro-afanasiev dmytro-afanasiev marked this pull request as draft October 6, 2023 10:39
@dmytro-afanasiev dmytro-afanasiev marked this pull request as ready for review October 6, 2023 11:02
kapilt
kapilt reviewed Oct 31, 2023
View reviewed changes
tools/c7n_azure/c7n_azure/resources/front_door.py Outdated
@@ -72,3 +73,22 @@ def process(self, resources, event=None):
if self.check_state(front_endpoint.web_application_firewall_policy_link):
matched.append(front_door)
return matched


@FrontDoor.filter_registry.register('web-application-firewall-policies')
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rename to firewall-policy, this would be better to derive as a list item filter afaics.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renamed

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as i understood one Front Door resource can have multiple frontend endpoints whereas each individual endpoint can optionally have one WAF Policy. So, in general, one Front Door can have multiple different WAF policies (if it has multiple frontend endpoints). I rewrote this filter deriving from list-item filter. But this implementation neglects the connection between each policy and its frontend endpoint. Not sure whether it's okey..

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, regarding front-door.waf filter, seems like the list returned from process() method can contain duplicated Front Door resources in case some Front Door have multiple enabled frontend endpoints.

@dmytro-afanasiev dmytro-afanasiev mentioned this pull request Nov 17, 2023
Open
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
6e03bf4 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
bdc5515 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
88961a0 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
566fa98 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
22e8d6f 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
250db9a 
…b-application-firewall-policies
@dmytro-afanasiev
Merge remote-tracking branch 'origin/main' into front-door.filters.we…
913941e 
…b-application-firewall-policies
@dmytro-afanasiev
Rewrite frontdoor
3ebc96f
@dmytro-afanasiev
Fix linter
008ad2a
kapilt
kapilt reviewed Jan 30, 2024
View reviewed changes
tools/c7n_azure/c7n_azure/resources/front_door.py Outdated
@@ -70,5 +71,58 @@ def process(self, resources, event=None):
front_endpoint = client.frontend_endpoints.get(
front_door['resourceGroup'], front_door['name'],front_endpoints['name'])
if self.check_state(front_endpoint.web_application_firewall_policy_link):
# what if one front_door has multiple endpoints that match?
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

if front_door not in matched:
    matched.append(front_door)

for small cardinalities this works fine.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can dispense with additional GET requests because front door's json contains information about each endpoint's link:

Disabled:

{
  "frontendEndpoints": [
    {
      "id": "/subscriptions/dd3ce4b8-093a-40da-8369-d50149d0f84a/resourcegroups/FrontDoorExampleResourceGroup/providers/Microsoft.Network/Frontdoors/42342342-FrontDoor/FrontendEndpoints/exampleFrontendEndpoint1",
      "name": "exampleFrontendEndpoint1",
      "type": "Microsoft.Network/Frontdoors/FrontendEndpoints",
      "properties": {
        "hostName": "42342342-FrontDoor.azurefd.net",
        "sessionAffinityEnabledState": "Disabled",
        "sessionAffinityTtlSeconds": 0,
        "resourceState": "Enabled"
      }
    }
  ]
}

Enabled:

{
  "frontendEndpoints": [
    {
      "id": "/subscriptions/dd3ce4b8-093a-40da-8369-d50149d0f84a/resourcegroups/FrontDoorExampleResourceGroup/providers/Microsoft.Network/Frontdoors/42342342-FrontDoor/FrontendEndpoints/exampleFrontendEndpoint1",
      "name": "exampleFrontendEndpoint1",
      "type": "Microsoft.Network/Frontdoors/FrontendEndpoints",
      "properties": {
        "hostName": "42342342-FrontDoor.azurefd.net",
        "sessionAffinityEnabledState": "Disabled",
        "sessionAffinityTtlSeconds": 0,
        "webApplicationFirewallPolicyLink": {
          "id": "/subscriptions/dd3ce4b8-093a-40da-8369-d50149d0f84a/resourceGroups/FrontDoorExampleResourceGroup/providers/Microsoft.Network/frontdoorWebApplicationFirewallPolicies/examplefdwafpolicy"
        },
        "resourceState": "Enabled"
      }
    }
  ]
}
image

I pushed some fixes, review pls !

kapilt
kapilt approved these changes Feb 6, 2024
View reviewed changes
Copy link
Collaborator

@kapilt kapilt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks

@kapilt kapilt merged commit 31e22b2 into cloud-custodian:main Feb 6, 2024
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kapilt kapilt kapilt approved these changes

Assignees
No one assigned
Labels
provider/azure
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@dmytro-afanasiev @kapilt