[Enhancement]: Support CHALLENGE WAF actions and overrides on individual WAF Rule Group Rules

[captaintino]

Description

Terraform does not appear to support either the new CHALLENGE action on AWS WAF rules or allow the individual rule overwriting of existing rule groups into actions other than COUNT. I would like CHALLENGE to be a valid rule action and for AWS WAF rule group usage to allow for overwriting the actions of individual rules with all of the actions (COUNT, CAPTCHA, CHALLENGE, ALLOW, BLOCK)

Affected Resource(s) and/or Data Source(s)

aws_waf_rule
aws_waf_web_acl

Potential Terraform Configuration

statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"

        excluded_rule {
          name = "UserAgent_BadBots_HEADER"
          overwrite_action = "CHALLENGE"
        }

References

No response

Would you like to implement a fix?

No

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[lilHermit]

I'm running up against this currently for managed_rule_group_statement and it's manifesting itself in two ways.

1. Where on refresh it finds a rule override changed upstream to challenge the following error is emitted

Error: setting rule: Invalid address to set: []string{"rule", "0", "statement", "0", "managed_rule_group_statement", "0", "rule_action_override", "0", "action_to_use", "0", "challenge"}
│ 
│   with module.waf["my-waf"].aws_wafv2_web_acl.this,
│   on waf/waf.tf line 21, in resource "aws_wafv2_web_acl" "this":
│   21: resource "aws_wafv2_web_acl" "this" {

2. When adding a challenge block like this

resource "aws_wafv2_web_acl" "example" {
  name        = "managed-rule-example"
  description = "Example of a managed rule."
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "rule-1"
    priority = 1

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"

        rule_action_override {
          action_to_use {
            challenge {}
          }

          name = "SizeRestrictions_QUERYSTRING"
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = false
      metric_name                = "friendly-rule-metric-name"
      sampled_requests_enabled   = false
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = false
    metric_name                = "friendly-metric-name"
    sampled_requests_enabled   = false
  }
}

The following error is emitted

╷
│ Error: Unsupported block type
│ 
│   on waf/waf.tf line 128, in resource "aws_wafv2_web_acl" "example":
│  128:             challenge {}
│ 
│ Blocks of type "challenge" are not expected here.

Using hashicorp/aws provider 4.50.0

[nodomain]

+1

[pgcd]

+1

[bevel-zgates]

Tried on hashi/aws 5.1.0 issue and still having the same issue.

[bevel-zgates]

Clarifying from looking at the MR

Having an issue with rule_action_override within a managed_rule_group_statement.

[bevel-zgates]

Bumping this issue.

[akloss-terion]

We've also run into this; at least in our case, it seemed that the unreadable configuration gets pulled into terraform state, so even when removing the offending rule from the configuration and/or from WAF, the error persists until the resource is removed with terraform state rm. (!)