Release/shared resources nine (#1047)

ajmu1 · mabe13 · nsindhu26 · web-flow · commit 5c61eee0c056 · 2025-03-14T15:11:07.000Z
# Release Branch Pull Request

## Description of Changes

- DI Pen test WAF and DynamoDB changes
- Integration test case optimization

---------

Signed-off-by: dependabot[bot] &lt;support@github.com&gt;
Co-authored-by: Matthew Begley &lt;60427904+mabe13@users.noreply.github.com&gt;
Co-authored-by: Sindhu Natarajan &lt;nsindhupriya@hotmail.co.uk&gt;
Co-authored-by: ThomasC-Kainos &lt;106971950+ThomasC-Kainos@users.noreply.github.com&gt;
Co-authored-by: ajmu1 &lt;ajmu1@hscic.gov.uk&gt;
Co-authored-by: ManithaSrinivasa &lt;142212846+ManithaSrinivasa@users.noreply.github.com&gt;
diff --git a/build/automation/var/profile/demo.mk b/build/automation/var/profile/demo.mk
@@ -40,6 +40,7 @@ SLACK_ALERT_CHANNEL := dos-integration-dev-status
 
 # WAF
 WAF_ENABLED := true
+DDB_DELETE_PROTECTION :=false
 
 # ==============================================================================
 # Performance variables
diff --git a/build/automation/var/profile/dev.mk b/build/automation/var/profile/dev.mk
@@ -39,6 +39,7 @@ SLACK_ALERT_CHANNEL := dos-integration-dev-status
 
 # WAF
 WAF_ENABLED := false
+DDB_DELETE_PROTECTION :=false
 
 # ==============================================================================
 # Performance variables
diff --git a/build/automation/var/profile/live.mk b/build/automation/var/profile/live.mk
@@ -41,6 +41,7 @@ SLACK_ALERT_CHANNEL := dos-integration-live-status
 
 # WAF
 WAF_ENABLED := true
+DDB_DELETE_PROTECTION :=true
 
 # ==============================================================================
 # Performance variables
diff --git a/build/automation/var/profile/pen.mk b/build/automation/var/profile/pen.mk
@@ -2,3 +2,4 @@
 
 # WAF
 WAF_ENABLED := true
+DDB_DELETE_PROTECTION :=false
diff --git a/build/automation/var/profile/perf.mk b/build/automation/var/profile/perf.mk
@@ -39,6 +39,7 @@ SLACK_ALERT_CHANNEL := dos-integration-dev-status
 
 # WAF
 WAF_ENABLED := true
+DDB_DELETE_PROTECTION :=false
 
 # ==============================================================================
 # Performance variables
diff --git a/build/automation/var/profile/perf2.mk b/build/automation/var/profile/perf2.mk
@@ -39,6 +39,7 @@ SLACK_ALERT_CHANNEL := dos-integration-dev-status
 
 # WAF
 WAF_ENABLED := true
+DDB_DELETE_PROTECTION :=false
 
 # ==============================================================================
 # Performance variables
diff --git a/build/automation/var/project.mk b/build/automation/var/project.mk
@@ -109,6 +109,7 @@ TF_VAR_change_event_dlq := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-change-event-dead
 # Dynamodb
 TF_VAR_change_events_table_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-change-events
 DYNAMO_DB_TABLE := $(TF_VAR_change_events_table_name)
+TF_VAR_ddb_delete_protection :=$(DDB_DELETE_PROTECTION)
 
 # Log Group Filters for Firehose
 TF_VAR_change_event_gateway_subscription_filter_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-change-event-api-gateway-cw-logs-firehose-subscription
@@ -140,6 +141,7 @@ TF_VAR_waf_ip_allow_list_rule_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-waf-ip
 TF_VAR_waf_rate_based_rule_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-waf-rate-based-rule
 TF_VAR_waf_aws_known_bad_inputs_rule_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-waf-aws-known-bad-inputs-rule
 TF_VAR_waf_aws_sqli_rule_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-waf-aws-sqli-rule
+TF_VAR_waf_custom_sqli_rule_name := $(PROJECT_ID)-$(SHARED_ENVIRONMENT)-waf-custom-sqli-rule
 
 # -------------------------------
 # BLUE/GREEN ENVIRONMENT VARIABLES
diff --git a/infrastructure/stacks/shared-resources/cloudwatch-waf-alarms.tf b/infrastructure/stacks/shared-resources/cloudwatch-waf-alarms.tf
@@ -118,6 +118,26 @@ resource "aws_cloudwatch_metric_alarm" "waf_aws_managed_sql_injection_blocked_re
   threshold          = "1"
 }
 
+resource "aws_cloudwatch_metric_alarm" "waf_custom_sql_injection_count_requests" {
+  count               = var.waf_enabled ? 1 : 0
+  alarm_actions       = [aws_sns_topic.shared_resources_sns_topic_app_alerts_for_slack_default_region.arn]
+  alarm_description   = "WAF Custom SQL Injection Count Requests"
+  alarm_name          = "${var.project_id} | ${var.shared_environment} | WAF Custom SQL Injection Count Requests"
+  comparison_operator = "GreaterThanThreshold"
+  datapoints_to_alarm = "1"
+  dimensions = {
+    Rule   = var.waf_custom_sqli_rule_name
+    WebACL = var.waf_acl_name,
+    Region = var.aws_region
+  }
+  evaluation_periods = "1"
+  metric_name        = "CountedRequests"
+  namespace          = "AWS/WAFV2"
+  period             = "60"
+  statistic          = "Sum"
+  threshold          = "1"
+}
+
 resource "aws_cloudwatch_metric_alarm" "waf_aws_managed_ip_reputation_list_blocked_requests" {
   count               = var.waf_enabled ? 1 : 0
   alarm_actions       = [aws_sns_topic.shared_resources_sns_topic_app_alerts_for_slack_default_region.arn]
diff --git a/infrastructure/stacks/shared-resources/dynamodb.tf b/infrastructure/stacks/shared-resources/dynamodb.tf
@@ -3,6 +3,7 @@ resource "aws_dynamodb_table" "message-history-table" {
   billing_mode = "PAY_PER_REQUEST"
   hash_key     = "Id"
   range_key    = "ODSCode"
+  deletion_protection_enabled = var.ddb_delete_protection
 
   server_side_encryption {
     enabled     = true
diff --git a/infrastructure/stacks/shared-resources/variables.tf b/infrastructure/stacks/shared-resources/variables.tf
@@ -158,6 +158,11 @@ variable "waf_enabled" {
   description = "Whether to enable WAF"
 }
 
+variable "ddb_delete_protection" {
+  type        = bool
+  description = "Whether to enable delete protection"
+}
+
 variable "waf_acl_name" {
   type        = string
   description = "Name of the WAF ACL"
@@ -211,3 +216,8 @@ variable "waf_aws_sqli_rule_name" {
   type        = string
   description = "WAF AWS SQLi rule name"
 }
+
+variable "waf_custom_sqli_rule_name" {
+  type        = string
+  description = "WAF custom SQLi rule name"
+}
diff --git a/infrastructure/stacks/shared-resources/waf.tf b/infrastructure/stacks/shared-resources/waf.tf
@@ -61,39 +61,29 @@ resource "aws_wafv2_web_acl" "di_endpoint_waf" {
   }
 
   rule {
-    name     = var.waf_aws_common_rule_name
+    name     = var.waf_custom_sqli_rule_name
     priority = 3
 
-    override_action {
-      none {}
+    action {
+      count {}
     }
-    statement {
-      managed_rule_group_statement {
-        name        = "AWSManagedRulesCommonRuleSet"
-        vendor_name = "AWS"
 
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "NoUserAgent_HEADER"
+    statement {
+      sqli_match_statement {
+        field_to_match {
+          body {}
         }
-
-        rule_action_override {
-          action_to_use {
-            count {}
-          }
-
-          name = "SizeRestrictions_BODY"
+        sensitivity_level = "HIGH"
+        text_transformation {
+          priority = 0
+          type = "NONE"
         }
       }
     }
-
     visibility_config {
+      sampled_requests_enabled = true
+      metric_name = var.waf_custom_sqli_rule_name
       cloudwatch_metrics_enabled = true
-      metric_name                = var.waf_aws_common_rule_name
-      sampled_requests_enabled   = true
     }
   }
 
@@ -186,6 +176,43 @@ resource "aws_wafv2_web_acl" "di_endpoint_waf" {
     }
   }
 
+  rule {
+    name     = var.waf_aws_common_rule_name
+    priority = 8
+
+    override_action {
+      none {}
+    }
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "NoUserAgent_HEADER"
+        }
+
+        rule_action_override {
+          action_to_use {
+            count {}
+          }
+
+          name = "SizeRestrictions_BODY"
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = var.waf_aws_common_rule_name
+      sampled_requests_enabled   = true
+    }
+  }
+
   visibility_config {
     cloudwatch_metrics_enabled = true
     metric_name                = var.waf_acl_name
diff --git a/test/integration/steps/functions/aws/cloudwatch.py b/test/integration/steps/functions/aws/cloudwatch.py
@@ -1,3 +1,4 @@
+import random
 from datetime import datetime
 from json import dumps
 from os import getenv
@@ -15,8 +16,8 @@ def get_logs(
     query: str,
     lambda_name: str,
     start_time: Timestamp | None = None,
-    retry_count: int = 32,
-    sleep_per_loop: int = 20,
+    retry_count: int = 32,  # Retry Count
+    sleep_per_loop: int = 20,  # Sleep time between retries.
 ) -> str:
     """Get logs from CloudWatch.
 
@@ -44,15 +45,19 @@ def get_logs(
             )
         except ClientError as error:
             if error.response["Error"]["Code"] == "LimitExceededException":
-                limit_exceeded_timeout += 30
+                limit_exceeded_timeout += random.uniform(30, 60) * (2**counter)  # Exponential backoff with jitter
+                print(f"Limit exceeded, retrying after {limit_exceeded_timeout} seconds.")
                 sleep(limit_exceeded_timeout)
                 continue
             raise
         query_id = start_query_response["queryId"]
         response = None
+
+        # Wait for the query to complete without a max timeout
         while response is None or response["status"] != "Complete":
             sleep(sleep_per_loop)
             response = LAMBDA_CLIENT_LOGS.get_query_results(queryId=query_id)
+
         counter += 1
         if response["results"] != []:
             logs_found = True
diff --git a/test/integration/steps/functions/utils.py b/test/integration/steps/functions/utils.py
@@ -1,3 +1,5 @@
+import secrets
+import string
 from json import dumps, loads
 from os import getenv
 from random import randint, randrange
@@ -274,3 +276,9 @@ def quality_checker_negative_log_check(
 | filter message="{reason}"
 | sort @timestamp asc"""
     return negative_log_check(query=query, event_lambda="quality-checker", start_time=start_time)
+
+
+def generate_unique_ods_code() -> str:
+    """Generate a unique 5-character uppercase alphanumeric ODSCode."""
+    chars = string.ascii_uppercase + string.digits  # A-Z, 0-9
+    return "".join(secrets.choice(chars) for _ in range(5))  # 5-character random string
diff --git a/test/integration/steps/test_steps.py b/test/integration/steps/test_steps.py
@@ -70,6 +70,7 @@
     create_pending_change_for_service,
     generate_correlation_id,
     generate_random_int,
+    generate_unique_ods_code,
     get_address_string,
     get_expected_data,
     quality_checker_log_check,
@@ -136,7 +137,7 @@ def a_service_table_entry_is_created(context: Context, ods_code: int = 0, servic
         Context: The context object.
     """
     if ods_code == 0:
-        ods_code = str(randint(10000, 99999))
+        ods_code = generate_unique_ods_code()
     query_values = {
         "uid": f"test{randint(10000, 99999)!s}",
         "service_type": service_type,

Original file line number	Diff line number	Diff line change
`@@ -2,3 +2,4 @@`
`2`	`2`
`3`	`3`	`# WAF`
`4`	`4`	`WAF_ENABLED := true`
	`5`	`+DDB_DELETE_PROTECTION :=false`