Skip to content

Commit 1e20964

Browse files
authored
Added module for WAF logs (#9)
* Updated Change log * module for WAF servicelog * updated docs and CHANGELOG
1 parent e20f2b7 commit 1e20964

9 files changed

+106
-0
lines changed

CHANGELOG.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ All notable changes to this project are documented in this file.
77

88
The format is based on {uri-changelog}[Keep a Changelog].
99

10+
== 0.3.0 - Unreleased
11+
12+
=== Added
13+
* Module for Web Application Firewall service logs
14+
1015
== 0.2.0 (Oct 18, 2021)
1116

1217
=== Added

docs/terraformoptions.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ loggroup_tags = {
9696
#vpnlog ={loggroup="vpnloggroup",service="vpn",resource="<ipsecname>"}
9797
#devopslog = {loggroup="devopsloggroup",service="devops",resource="<projectname>"}
9898
#emaillog = {loggroup="emailloggroup",service="email",resource="<emaildomain>"}
99+
#intlog = {loggroup="intloggroup",service="integration",resource="<integrationinstance>"}
100+
#waflog = {loggroup="wafloggroup",service="waf",resource="<firewallname>"}
99101
}
100102
----
101103
|

locals.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ locals {
2828

2929
vpnlogdef = { for k, v in var.service_logdef : k => v if v.service == "vpn" }
3030
vpnloggroup = [for k, v in var.service_logdef : v.loggroup if v.service == "vpn"]
31+
32+
waflogdef = { for k, v in var.service_logdef : k => v if v.service == "waf" }
33+
wafloggroup = [for k, v in var.service_logdef : v.loggroup if v.service == "waf"]
3134
}
3235

3336
locals {

main.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,18 @@ resource "oci_logging_log_group" "vpnloggroup" {
118118

119119
}
120120

121+
#WAF loggroup resource
122+
resource "oci_logging_log_group" "wafloggroup" {
123+
124+
for_each = toset(local.wafloggroup)
125+
126+
compartment_id = var.compartment_id
127+
description = "WAF Loggroup"
128+
display_name = var.label_prefix == "none" ? each.value : format("%s-%s", var.label_prefix, each.value)
129+
freeform_tags = var.loggroup_tags
130+
131+
}
132+
121133
#Custom Linux loggroup resource
122134
resource "oci_logging_log_group" "linuxloggroup" {
123135

@@ -277,3 +289,15 @@ module "vpnlog" {
277289
count = length(local.vpnlogdef) >= 1 ? 1 : 0
278290

279291
}
292+
293+
module "waflog" {
294+
source = "./modules/waf"
295+
compartment_id = var.compartment_id
296+
label_prefix = var.label_prefix
297+
logdefinition = local.waflogdef
298+
log_retention_duration = var.log_retention_duration
299+
loggroup = oci_logging_log_group.wafloggroup
300+
301+
count = length(local.waflogdef) >= 1 ? 1 : 0
302+
303+
}

modules/waf/outputs.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "waf_logid" {
2+
value = { for v in oci_logging_log.waf_log : v.display_name => v.id }
3+
}
4+
5+
output "waf_loggroupid" {
6+
value = { for k, v in var.loggroup : v.display_name => v.id }
7+
}

modules/waf/variables.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
variable "label_prefix" {
2+
default = "none"
3+
description = "A string that will be prepended to log resources."
4+
type = string
5+
}
6+
variable "logdefinition" {
7+
type = map(any)
8+
description = "Log definition"
9+
}
10+
variable "log_retention_duration" {
11+
type = string
12+
description = "Duration to retain logs"
13+
}
14+
15+
variable "compartment_id" {
16+
type = string
17+
description = "Compartment ID where the resources will be created"
18+
}
19+
20+
variable "loggroup" {
21+
type = map(any)
22+
description = "Log Group"
23+
}

modules/waf/waflogs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
data "oci_waf_web_app_firewalls" "web_app_firewalls" {
2+
for_each = var.logdefinition
3+
compartment_id = var.compartment_id
4+
5+
display_name = each.value.resource
6+
state = ["ACTIVE"]
7+
}
8+
9+
resource "oci_logging_log" "waf_log" {
10+
11+
12+
for_each = var.logdefinition
13+
14+
display_name = var.label_prefix == "none" ? each.key : format("%s-%s", var.label_prefix, each.key)
15+
log_group_id = var.loggroup[each.value.loggroup].id
16+
log_type = "SERVICE"
17+
configuration {
18+
source {
19+
category = "all"
20+
resource = data.oci_waf_web_app_firewalls.web_app_firewalls[each.key].web_app_firewall_collection[0]["items"].0.id
21+
service = "waf"
22+
source_type = "OCISERVICE"
23+
}
24+
}
25+
26+
is_enabled = lookup(each.value, "enable", true)
27+
retention_duration = var.log_retention_duration
28+
29+
}

outputs.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,18 @@ output "vpn_loggroupid" {
143143

144144
}
145145

146+
#WAF log and loggroup id
147+
output "waf_logid" {
148+
value = try(module.waflog[0].waf_logid, "")
149+
description = "WAF logs id"
150+
}
151+
152+
output "waf_loggroupid" {
153+
value = try(module.waflog[0].waf_loggroupid, "")
154+
description = "WAF loggroup id"
155+
156+
}
157+
146158
#Windows custom log and loggroup id
147159
output "windows_logid" {
148160
value = try(module.customlog[0].windowslogid, "")

terraform.tfvars.example

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ service_logdef = {
2929
#devopslog = {loggroup="devopsloggroup",service="devops",resource="<projectname>"}
3030
#emaillog = {loggroup="emailloggroup",service="email",resource="<emaildomain>"}
3131
#intlog = {loggroup="intloggroup",service="integration",resource="<integrationinstance>"}
32+
#waflog = {loggroup="wafloggroup",service="waf",resource="<firewallname>"}
3233

3334
}
3435

0 commit comments

Comments
 (0)