如何修改Terraform代码移除或禁用SizeRestrictions_BODY规则

问题背景 #

AWSManagedRulesCommonRuleSet规则组默认限制请求体大小为8KB，现有如下Terraform配置创建了关联ALB的WAF ACL，需要修改代码移除或禁用其中的SizeRestrictions_BODY规则：

resource "aws_wafv2_web_acl" "alb_waf_acl" {
  name        = "api-alb-waf-acl-${var.usage}"
  scope       = "REGIONAL"
  description = "WAF ACL for the Data Refinery ALB"

  default_action {
    allow {}
  }

  rule {
    name     = "base-rule"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = false
      metric_name                = "api-alb-waf-acl-base-rule-${var.usage}"
      sampled_requests_enabled   = false
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = false
    metric_name                = "api-alb-waf-acl-${var.usage}"
    sampled_requests_enabled   = false
  }

  tags = {
    Name = "api_alb_waf_acl_${var.usage}"
  }
}

resource "aws_wafv2_web_acl_association" "alb_waf_association" {
  resource_arn = aws_lb.alb.arn
  web_acl_arn  = aws_wafv2_web_acl.alb_waf_acl.arn

  timeouts {
    create = "10m"
  }
}

修改方案 #

在managed_rule_group_statement块中添加规则覆盖配置，通过动作覆盖或规则排除的方式禁用SizeRestrictions_BODY规则。

方式1：动作覆盖（推荐） #

将目标规则的动作设为allow，绕过其拦截逻辑：

resource "aws_wafv2_web_acl" "alb_waf_acl" {
  name        = "api-alb-waf-acl-${var.usage}"
  scope       = "REGIONAL"
  description = "WAF ACL for the Data Refinery ALB"

  default_action {
    allow {}
  }

  rule {
    name     = "base-rule"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
        
        # 添加规则动作覆盖，禁用SizeRestrictions_BODY规则
        rule_action_override {
          name = "SizeRestrictions_BODY"
          action_to_use {
            allow {}
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = false
      metric_name                = "api-alb-waf-acl-base-rule-${var.usage}"
      sampled_requests_enabled   = false
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = false
    metric_name                = "api-alb-waf-acl-${var.usage}"
    sampled_requests_enabled   = false
  }

  tags = {
    Name = "api_alb_waf_acl_${var.usage}"
  }
}

resource "aws_wafv2_web_acl_association" "alb_waf_association" {
  resource_arn = aws_lb.alb.arn
  web_acl_arn  = aws_wafv2_web_acl.alb_waf_acl.arn

  timeouts {
    create = "10m"
  }
}

方式2：规则排除 #

直接排除该规则，使其不参与请求评估：
将上述rule_action_override块替换为以下内容即可：

excluded_rule {
  name = "SizeRestrictions_BODY"
}

内容的提问来源于stack exchange，提问作者Aaroosh Pandoh