resource "aws_waf_web_acl" "waf_acl" {
  depends_on  = ["aws_waf_ipset.vpn", "aws_waf_rule.vpn", "aws_waf_rate_based_rule.ratelimit"]
  name        = "${var.serviceName}APIWAF"
  metric_name = "${element(split("-", var.serviceName),0)}APIWAF"

  default_action {
    type = "ALLOW"
  }

  rules {
    action {
      type = "BLOCK"
    }
    
    priority = 1
    rule_id = "${aws_waf_rule.sqlinject.id}"
  }

  rules {
    action {
      type = "ALLOW"
    }

    priority = 2
    rule_id  = "${aws_waf_rule.vpn.id}"
    type     = "REGULAR"
  }

  rules {
    action {
      type = "BLOCK"
    }

    priority = 3
    rule_id = "${aws_waf_rate_based_rule.ratelimit.id}"
    type = "RATE_BASED"
  }
}

resource "aws_waf_ipset" "vpn" {
  name = "VPNIp"

  ip_set_descriptors {
    type  = "IPV4"
    value = "${data.terraform_remote_state.network.VPNPublicIP}/32"
  }
}

resource "aws_waf_rule" "vpn" {
  depends_on  = ["aws_waf_ipset.vpn"]
  name        = "${var.serviceName}VPNallow"
  metric_name = "${element(split("-", var.serviceName),0)}VPNallow"

  predicates {
    data_id = "${aws_waf_ipset.vpn.id}"
    negated = false
    type    = "IPMatch"
  }
}



resource "aws_waf_rate_based_rule" "ratelimit" {
  name        = "${var.serviceName}APIRateLimit"
  metric_name = "${element(split("-", var.serviceName),0)}APIRateLimit"

  rate_key = "IP"
  rate_limit = 10000

}

resource "aws_waf_rule" "sqlinject" {
  depends_on  = ["aws_waf_sql_injection_match_set.sql_injection_match_set"]
  name        = "${var.serviceName}-SQLInject"
  metric_name = "PangeaSQLInject"

  predicates {
    data_id = "${aws_waf_sql_injection_match_set.sql_injection_match_set.id}"
    negated = false
    type    = "SqlInjectionMatch"
  }
}

resource "aws_waf_sql_injection_match_set" "sql_injection_match_set" {
  name = "${var.serviceName}-sql_injection_match_set"

  sql_injection_match_tuples {
    text_transformation = "URL_DECODE"

    field_to_match {
      type = "BODY"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "HTML_ENTITY_DECODE"

    field_to_match {
      type = "BODY"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "HTML_ENTITY_DECODE"

    field_to_match {
      type = "URI"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "URL_DECODE"

    field_to_match {
      type = "URI"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "URL_DECODE"

    field_to_match {
      type = "QUERY_STRING"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "HTML_ENTITY_DECODE"

    field_to_match {
      type = "QUERY_STRING"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "HTML_ENTITY_DECODE"

    field_to_match {
      type = "HEADER"
      data = "cookie"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "URL_DECODE"

    field_to_match {
      type = "HEADER"
      data = "cookie"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "HTML_ENTITY_DECODE"

    field_to_match {
      type = "HEADER"
      data = "authorization"
    }
  }

  sql_injection_match_tuples {
    text_transformation = "URL_DECODE"

    field_to_match {
      type = "HEADER"
      data = "authorization"
    }
}

}