feat: add web application firewall

README.md

@@ -12,6 +12,7 @@ This module provisions an IBM Cloud Internet Services (CIS) instance and configu
 * Domain
 * DNS records
 * Global load balancer (GLB) including load balancers, origin pools and health checks
+* Web Application Firewall (WAF)
 
 For more information see, [Getting started with IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-getting-started).
 
@@ -22,6 +23,7 @@ For more information see, [Getting started with IBM Cloud Internet Services](htt
     * [dns](./modules/dns)
     * [domain](./modules/domain)
     * [glb](./modules/glb)
+    * [waf](./modules/waf)
 * [Examples](./examples)
     * [End-to-end example](./examples/complete)
 * [Contributing](#contributing)

examples/complete/main.tf

@@ -88,3 +88,14 @@ module "cis_glb" {
     }
   ]
 }
+
+##############################################################################
+# Enables web application firewall(WAF) to CIS instance
+##############################################################################
+
+module "cis_domain_settings" {
+  source          = "../../modules/waf"
+  cis_instance_id = module.cis_instance.cis_instance_id
+  domain_id       = module.cis_instance.cis_domain.domain_id
+  waf             = "on"
+}

examples/complete/outputs.tf

@@ -16,3 +16,8 @@ output "cis_glb" {
   description = "CIS Global Load Balancer"
   value       = module.cis_glb
 }
+
+output "cis_domain_settings" {
+  description = "CIS domain settings"
+  value       = module.cis_domain_settings
+}

modules/waf/README.md

@@ -0,0 +1,38 @@
+# CIS web application firewall (WAF) module
+
+This module enables/disables the web application firewall (WAF) of the domain.
+
+> When the `waf` is enabled then the `min_tls_version` is automatically modified to `1.1`.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+### Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, <1.6.0 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.49.0 |
+
+### Modules
+
+No modules.
+
+### Resources
+
+| Name | Type |
+|------|------|
+| [ibm_cis_domain_settings.domain_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cis_domain_settings) | resource |
+
+### Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_cis_instance_id"></a> [cis\_instance\_id](#input\_cis\_instance\_id) | CRN of the existing CIS instance. | `string` | n/a | yes |
+| <a name="input_domain_id"></a> [domain\_id](#input\_domain\_id) | ID of the existing domain to add a DNS record to the CIS instance. | `string` | n/a | yes |
+| <a name="input_waf"></a> [waf](#input\_waf) | Enables/disables a web application firewall (WAF). Supported values are off and on. | `string` | n/a | yes |
+
+### Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_cis_domain_settings_details"></a> [cis\_domain\_settings\_details](#output\_cis\_domain\_settings\_details) | CIS Domain settings details |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

modules/waf/main.tf

@@ -0,0 +1,10 @@
+##############################################################################
+# To enable/disable Web Application Firewall(WAF) for a domain
+##############################################################################
+
+resource "ibm_cis_domain_settings" "domain_settings" {
+  cis_id          = var.cis_instance_id
+  domain_id       = var.domain_id
+  waf             = var.waf
+  min_tls_version = "1.2" # The min_tls_version default value was getting modified to 1.1 while terraform apply. Provider issue is open here: https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4937
+}

modules/waf/outputs.tf

@@ -0,0 +1,5 @@
+
+output "cis_domain_settings_details" {
+  description = "CIS Domain settings details"
+  value       = ibm_cis_domain_settings.domain_settings
+}

modules/waf/variables.tf

@@ -0,0 +1,19 @@
+
+variable "cis_instance_id" {
+  type        = string
+  description = "CRN of the existing CIS instance."
+}
+
+variable "domain_id" {
+  type        = string
+  description = "ID of the existing domain to add a DNS record to the CIS instance."
+}
+
+variable "waf" {
+  type        = string
+  description = "Enables/disables a web application firewall (WAF). Supported values are off and on."
+  validation {
+    condition     = contains(["on", "off"], var.waf)
+    error_message = "Provided value of waf is not allowed. Supported values are off and on."
+  }
+}

modules/waf/version.tf

@@ -0,0 +1,10 @@
+
+terraform {
+  required_version = ">= 1.3.0, <1.6.0"
+  required_providers {
+    ibm = {
+      source  = "IBM-Cloud/ibm"
+      version = ">= 1.49.0"
+    }
+  }
+}