Adding GSA ipv6 cidr range to waf

Author: cweibel

ci/pipeline.yml

@@ -736,6 +736,7 @@ jobs:
           TF_VAR_waf_drop_logs_hostnames: ((waf_drop_logs_hostnames))
           TF_VAR_logstash_hosts: ((development_logstash_hosts))
           TF_VAR_gsa_ip_range_ip_set_arn: ((gsa_ip_range_ip_set_arn))
+          TF_VAR_gsa_ipv6_range_ip_set_arn: ((gsa_ipv6_range_ip_set_arn))
           TF_VAR_malicious_ja3_fingerprint_ids: ((malicious_ja3_fingerprint_ids))
           TF_VAR_api_data_gov_hosts_regex_pattern_arn: ((api_data_gov_hosts_regex_pattern_arn))
           TF_VAR_customer_whitelist_ip_ranges_set_arn: ((customer_whitelist_ip_ranges_set_arn))
@@ -984,6 +985,7 @@ jobs:
           TF_VAR_waf_drop_logs_hostnames: ((waf_drop_logs_hostnames))
           TF_VAR_logstash_hosts: ((staging_logstash_hosts))
           TF_VAR_gsa_ip_range_ip_set_arn: ((gsa_ip_range_ip_set_arn))
+          TF_VAR_gsa_ipv6_range_ip_set_arn: ((gsa_ipv6_range_ip_set_arn))
           TF_VAR_malicious_ja3_fingerprint_ids: ((malicious_ja3_fingerprint_ids))
           TF_VAR_api_data_gov_hosts_regex_pattern_arn: ((api_data_gov_hosts_regex_pattern_arn))
           TF_VAR_customer_whitelist_ip_ranges_set_arn: ((customer_whitelist_ip_ranges_set_arn))
@@ -1231,6 +1233,7 @@ jobs:
           TF_VAR_waf_drop_logs_hostnames: ((waf_drop_logs_hostnames))
           TF_VAR_logstash_hosts: ((production_logstash_hosts))
           TF_VAR_gsa_ip_range_ip_set_arn: ((gsa_ip_range_ip_set_arn))
+          TF_VAR_gsa_ipv6_range_ip_set_arn: ((gsa_ipv6_range_ip_set_arn))
           TF_VAR_malicious_ja3_fingerprint_ids: ((malicious_ja3_fingerprint_ids))
           TF_VAR_api_data_gov_hosts_regex_pattern_arn: ((api_data_gov_hosts_regex_pattern_arn))
           TF_VAR_customer_whitelist_ip_ranges_set_arn: ((customer_whitelist_ip_ranges_set_arn))

terraform/modules/cloudfoundry/variables.tf

@@ -194,7 +194,12 @@ variable "non_cdn_traffic_rate_limit_block_by_source_ip" {
 
 variable "gsa_ip_range_ip_set_arn" {
   type        = string
-  description = "ARN of IP set identifying GSA IP CIDR ranges"
+  description = "ARN of IP v4 set identifying GSA IP CIDR ranges"
+}
+
+variable "gsa_ipv6_range_ip_set_arn" {
+  type        = string
+  description = "ARN of IP v6 set identifying GSA IP CIDR ranges"
 }
 
 variable "malicious_ja3_fingerprint_ids" {

terraform/modules/cloudfoundry/waf.tf

@@ -415,6 +415,12 @@ resource "aws_wafv2_web_acl" "cf_uaa_waf_core" {
           }
         }
 
+        statement {
+          ip_set_reference_statement {
+            arn = var.gsa_ipv6_range_ip_set_arn
+          }
+        }
+
         statement {
           ip_set_reference_statement {
             arn = var.customer_whitelist_source_ip_ranges_set_arn
@@ -445,6 +451,18 @@ resource "aws_wafv2_web_acl" "cf_uaa_waf_core" {
           }
         }
 
+        statement {
+          ip_set_reference_statement {
+            arn = var.gsa_ipv6_range_ip_set_arn
+
+            ip_set_forwarded_ip_config {
+              header_name       = var.forwarded_ip_header_name
+              fallback_behavior = "NO_MATCH"
+              position          = "FIRST"
+            }
+          }
+        }
+
         statement {
           ip_set_reference_statement {
             arn = var.internal_vpc_cidrs_set_arn

terraform/stacks/main/stack.tf

@@ -294,6 +294,7 @@ module "cf" {
 
   ## TODO: manage these IP sets in Terraform somewhere
   gsa_ip_range_ip_set_arn                     = var.gsa_ip_range_ip_set_arn
+  gsa_ipv6_range_ip_set_arn                   = var.gsa_ipv6_range_ip_set_arn
   api_data_gov_hosts_regex_pattern_arn        = var.api_data_gov_hosts_regex_pattern_arn
   customer_whitelist_ip_ranges_set_arn        = var.customer_whitelist_ip_ranges_set_arn
   customer_whitelist_source_ip_ranges_set_arn = var.customer_whitelist_source_ip_ranges_set_arn

terraform/stacks/main/variables.tf

@@ -220,7 +220,12 @@ variable "logstash_hosts" {
 
 variable "gsa_ip_range_ip_set_arn" {
   type        = string
-  description = "ARN of IP set identifying GSA IP CIDR ranges"
+  description = "ARN of IP v4 set identifying GSA IP CIDR ranges"
+}
+
+variable "gsa_ipv6_range_ip_set_arn" {
+  type        = string
+  description = "ARN of IP v6 set identifying GSA IP CIDR ranges"
 }
 
 variable "malicious_ja3_fingerprint_ids" {