Updating-aws-acl-role

roles/aws/aws_acl/README.md

@@ -12,9 +12,11 @@ rate_limit: 0 # set to 0 to skip rate limit rule, set to a value to set how many
 aws_acl:
   name: example_master_acl
   scope: CLOUDFRONT # Can be REGIONAL for ALBs
-  region: us-east-1 # If scope is set to CLOUDFRONT, region must be us-east-1, even though docs say it will be skipped
   tags: {}
 
+  botControl: true
+  inspection: "COMMON" # or set to TARGETED inspection level
+
   ip_allow:
     name: "Allowed-ips"
     list: []

roles/aws/aws_acl/defaults/main.yml

@@ -3,9 +3,11 @@ rate_limit: 0 # set to 0 to skip rate limit rule, set to a value to set how many
 aws_acl:
   name: example_master_acl
   scope: CLOUDFRONT # Can be REGIONAL for ALBs
-  region: us-east-1 # If scope is set to CLOUDFRONT, region must be us-east-1, even though docs say it will be skipped
   tags: {}
 
+  botControl: true
+  inspection: "COMMON" # or set to TARGETED inspection level
+
   ip_allow:
     name: "Allowed-ips"
     list: []
@@ -24,4 +26,4 @@ aws_acl:
     #- BY # Belarus
     #- CN # China
     #- IR # Iran
-    #- SA # Saudi Arabia
+    #- SA # Saudi Arabia

roles/aws/aws_acl/tasks/bot_control.yml

@@ -0,0 +1,133 @@
+- name: Define empty action rule list
+  ansible.builtin.set_fact:
+    _action_rules: []
+
+- name: Define variables for COMMON inspection.
+  block:
+  - name: Set action rule common.
+    ansible.builtin.set_fact:
+      _action_rules_common:
+        - name: "CategoryAdvertising"
+          action_to_use:
+            block: {}
+        - name: "CategoryArchiver"
+          action_to_use:
+            block: {}
+        - name: "CategoryContentFetcher"
+          action_to_use:
+            block: {}
+        - name: "CategoryEmailClient"
+          action_to_use:
+            block: {}
+        - name: "CategoryHttpLibrary"
+          action_to_use:
+            block: {}
+        - name: "CategoryLinkChecker"
+          action_to_use:
+            block: {}
+        - name: "CategoryMiscellaneous"
+          action_to_use:
+            block: {}
+        - name: "CategoryMonitoring"
+          action_to_use:
+            block: {}
+        - name: "CategoryScrapingFramework"
+          action_to_use:
+            block: {}
+        - name: "CategorySearchEngine"
+          action_to_use:
+            block: {}
+        - name: "CategorySecurity"
+          action_to_use:
+            block: {}
+        - name: "CategorySeo"
+          action_to_use:
+            block: {}
+        - name: "CategorySocialMedia"
+          action_to_use:
+            block: {}
+        - name: "CategoryAI"
+          action_to_use:
+            block: {}
+        - name: "SignalAutomatedBrowser"
+          action_to_use:
+            block: {}
+        - name: "SignalKnownBotDataCenter"
+          action_to_use:
+            block: {}
+        - name: "SignalNonBrowserUserAgent"
+          action_to_use:
+            block: {}
+
+  - name: Define empty action rule list
+    ansible.builtin.set_fact:
+      _action_rules: "{{ _action_rules | default([]) + _action_rules_common }}"
+
+  - name: Define common config
+    ansible.builtin.set_fact:
+      _rule_config:
+        - a_w_s_managed_rules_bot_control_rule_set:
+            inspection_level: "COMMON"
+
+- name: Define rule actions targeted
+  when: aws_acl.inspection == "TARGETED"
+  block:
+    - name: Define targeted actions
+      ansible.builtin.set_fact:
+        _action_rules_tgt:
+          - name: "TGT_VolumetricIpTokenAbsent"
+            action_to_use:
+              block: {}
+          - name: "TGT_VolumetricSession"
+            action_to_use:
+              block: {}
+          - name: "TGT_SignalAutomatedBrowser"
+            action_to_use:
+              block: {}
+          - name: "TGT_SignalBrowserInconsistency"
+            action_to_use:
+              block: {}
+          - name: "TGT_TokenReuseIp"
+            action_to_use:
+              block: {}
+          - name: "TGT_ML_CoordinatedActivityMedium"
+            action_to_use:
+              block: {}
+          - name: "TGT_ML_CoordinatedActivityHigh"
+            action_to_use:
+              block: {}
+
+    - name: Define empty action rule list
+      ansible.builtin.set_fact:
+        _action_rules: "{{ _action_rules | default([]) + _action_rules_tgt }}"
+
+    - name: Define targeted config
+      ansible.builtin.set_fact:
+        _rule_config:
+          - a_w_s_managed_rules_bot_control_rule_set:
+              inspection_level: "TARGETED"
+              enable_machine_learning: true
+
+- name: Define Bot Control rule.
+  ansible.builtin.set_fact:
+    bot_control:
+    - name: bot_control
+      priority: 4
+#          action:
+#            block: {}
+      override_action:
+        none: {}
+      visibility_config:
+        sampled_requests_enabled: true
+        cloud_watch_metrics_enabled: true
+        metric_name: bot_control
+      statement:
+        managed_rule_group_statement:
+          vendor_name: AWS
+          name: AWSManagedRulesBotControlRuleSet
+          managed_rule_group_configs: "{{ _rule_config }}"
+          rule_action_overrides: "{{ _action_rules }}"
+
+- name: Add rule to list.
+  ansible.builtin.set_fact:
+    _acl_rules: "{{ _acl_rules + bot_control}}"

roles/aws/aws_acl/tasks/main.yml

@@ -2,6 +2,16 @@
   ansible.builtin.set_fact:
     _acl_rules: []
 
+- name: Define region if scope is REGIONAL.
+  ansible.builtin.set_fact:
+    _acl_region: "{{ _aws_region }}"
+  when: aws_acl.scope == "REGIONAL"
+
+- name: Define region if scope is CLOUDFRONT.
+  ansible.builtin.set_fact:
+    _acl_region: "us-east-1"
+  when: aws_acl.scope == "CLOUDFRONT"
+
 - name: Set IP block rule.
   when:
     - aws_acl.ip_block is defined
@@ -13,7 +23,7 @@
         state: present
         description: Set of blocked IPs
         scope: "{{ aws_acl.scope }}"
-        region: "{{ aws_acl.region }}"
+        region: "{{ _acl_region }}"
         ip_address_version: IPV4
         addresses: "{{ aws_acl.ip_block.list }}"
       register: _ip_set_info
@@ -48,7 +58,7 @@
         state: present
         description: Set of allowed IPs
         scope: "{{ aws_acl.scope }}"
-        region: "{{ aws_acl.region }}"
+        region: "{{ _acl_region }}"
         ip_address_version: IPV4
         addresses: "{{ aws_acl.ip_allow.list }}"
       register: _ip_set_info
@@ -122,12 +132,19 @@
       ansible.builtin.set_fact:
         _acl_rules: "{{ _acl_rules + rate_rule}}"
 
+- name: Include task Bot Control.
+  when:
+    - aws_acl.botControl is defined
+    - aws_acl.botControl
+  ansible.builtin.include_tasks:
+        file: bot_control.yml
+
 - name: Create web acl.
   community.aws.wafv2_web_acl:
     name: "{{ aws_acl.name }}" # Member must satisfy regular expression pattern: ^[\\w\\-]+$
     description: "WAF protecting the {{ _domain_name }}"
     scope: "{{ aws_acl.scope }}"
-    region: "{{ aws_acl.region }}"
+    region: "{{ _acl_region }}"
     default_action: Allow # or "Block"
     sampled_requests: false
     cloudwatch_metrics: true # or "false" to disable metrics
@@ -143,6 +160,6 @@
     name: "{{ aws_acl.name }}"
     scope: REGIONAL
     state: present
-    region: "{{ aws_acl.region }}"
+    region: "{{ _acl_region }}"
     arn: "{{ _aws_ec2_elb.load_balancer_arn }}"
   when: _aws_ec2_elb is defined