有没有什么方法我使用terraform将aws ELB / ALB与WAF ACL相关联？

Question

我创建了以下AWS WAF ACL，并且我希望使用terraform将其与我的ALB相关联。有什么方法可以用terraform做到吗？我想阻止除使用亚马逊网络服务Web应用程序防火墙，aws waf的秘密密钥之外的所有请求。为此，我创建了byte_set，aws规则和访问控制列表ACL

    resource "aws_alb" "app" {
    ............
  }


#waf
resource "aws_waf_byte_match_set" "byte_set" {
  name = "tf_waf_byte_match_set"

  byte_match_tuples {
    text_transformation   = "NONE"
    target_string         = "${var.secret_key}"
    positional_constraint = "EXACTLY"

    field_to_match {
      type = "HEADER"
      data = "referer"
    }
  }
}

resource "aws_waf_rule" "wafrule" {
  depends_on  = ["aws_waf_byte_match_set.byte_set"]
  name        = "tfWAFRule"
  metric_name = "tfWAFRule"

  predicates {
    data_id = "${aws_waf_byte_match_set.byte_set.id}"
    negated = false
    type    = "ByteMatch"
  }
}

resource "aws_waf_web_acl" "waf_acl" {
  depends_on  = ["aws_waf_byte_match_set.byte_set", "aws_waf_rule.wafrule"]
  name        = "tfWebACL"
  metric_name = "tfWebACL"

  default_action {
    type = "BLOCK"
  }

  rules {
    action {
      type = "ALLOW"
    }

    priority = 1
    rule_id  = "${aws_waf_rule.wafrule.id}"
  }
}

Answer 1

此功能已提出但尚未合并。

• https://github.com/hashicorp/terraform/issues/10713
• https://github.com/hashicorp/terraform/pull/11263

Answer 2

您可以将WAF与ALB（应用程序负载均衡器）和CloudFront关联，但不能与ELB（经典弹性负载均衡器）关联。

要与ALB关联，这是一段代码

resource "aws_wafregional_web_acl_association" "foo" {
  resource_arn = "${aws_alb.foo.arn}"
  web_acl_id = "${aws_wafregional_web_acl.foo.id}"
}

取自official documentation