TerraformでWAF v2（aws_wafv2_web_acl）をALBに適用する方法｜マネージドルールとカスタムルールの設計

この記事のポイント

・TerraformでWAF v2をALBに適用するにはaws_wafv2_web_aclとaws_wafv2_web_acl_associationを使う
・マネージドルール（AWSManagedRulesCommonRuleSet等）はoveride_actionで有効・無効を切り替えられる
・IPブロック・レートリミットのカスタムルールはstatementブロックで宣言的に記述できる
・CloudWatch Logsへのログ出力はaws_wafv2_web_acl_logging_configurationで設定する

# waf.tf
resource "aws_wafv2_web_acl" "main" {
  name  = "${var.app_name}-web-acl"
  scope = "REGIONAL"   # ALB/API Gateway用。CloudFront用はCLOUDFRONT

  default_action {
    allow {}  # マッチしないリクエストはすべて許可
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.app_name}-web-acl"
    sampled_requests_enabled   = true
  }
}

resource "aws_wafv2_web_acl" "main" {
  name  = "${var.app_name}-web-acl"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  # ルール1: AWSマネージドルール（共通ルールセット）
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 10

    override_action {
      none {}  # マネージドルールのアクションをそのまま使う
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  # ルール2: Log4j等の重大脆弱性の悪用を防ぐ
  rule {
    name     = "AWSManagedRulesKnownBadInputsRuleSet"
    priority = 20

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesKnownBadInputsRuleSet"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "${var.app_name}-web-acl"
    sampled_requests_enabled   = true
  }
}

# waf_ip_set.tf
resource "aws_wafv2_ip_set" "blocked" {
  name               = "${var.app_name}-blocked-ips"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"

  addresses = [
    "203.0.113.0/24",
    "198.51.100.128/25",
  ]
}

# WebACLにIPブロックルールを追加
resource "aws_wafv2_web_acl" "main" {
  # ... （前述の設定に以下のruleブロックを追加）

  rule {
    name     = "BlockedIPs"
    priority = 5  # マネージドルールより高い優先度（数値が小さいほど先に評価）

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.blocked.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "BlockedIPs"
      sampled_requests_enabled   = true
    }
  }
}

  rule {
    name     = "RateLimit"
    priority = 30

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit              = 2000  # 5分間で2000リクエストを超えたらブロック
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "RateLimit"
      sampled_requests_enabled   = true
    }
  }

# waf_association.tf
resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = aws_lb.main.arn
  web_acl_arn  = aws_wafv2_web_acl.main.arn
}

# waf_logging.tf
resource "aws_cloudwatch_log_group" "waf" {
  # WAFのログはロググループ名が "aws-waf-logs-" で始まる必要がある
  name              = "aws-waf-logs-${var.app_name}"
  retention_in_days = 90
}

resource "aws_wafv2_web_acl_logging_configuration" "main" {
  log_destination_configs = [aws_cloudwatch_log_group.waf.arn]
  resource_arn            = aws_wafv2_web_acl.main.arn
}

$ terraform plan

  # aws_cloudwatch_log_group.waf will be created
  # aws_wafv2_ip_set.blocked will be created
  # aws_wafv2_web_acl.main will be created
  # aws_wafv2_web_acl_association.alb will be created
  # aws_wafv2_web_acl_logging_configuration.main will be created

Plan: 5 to add, 0 to change, 0 to destroy.

$ terraform apply -auto-approve

aws_cloudwatch_log_group.waf: Creating...
aws_wafv2_ip_set.blocked: Creating...
aws_wafv2_web_acl.main: Creating...
aws_wafv2_web_acl.main: Creation complete after 3s
aws_wafv2_web_acl_association.alb: Creating...
aws_wafv2_web_acl_logging_configuration.main: Creating...
aws_wafv2_web_acl_association.alb: Creation complete after 1s
aws_wafv2_web_acl_logging_configuration.main: Creation complete after 1s

Apply complete! Resources: 5 added, 0 changed, 0 destroyed.

# SQLインジェクションパターンを含むリクエストでブロックを確認
$ curl -s -o /dev/null -w "%{http_code}
"   "http://myapp-alb-1234567890.ap-northeast-1.elb.amazonaws.com/?id=1%20OR%201%3D1"
403

Error: creating WAFv2 Web ACL Logging Configuration:
  InvalidParameterException: Firehose Arn not in allowed format

statement {
  managed_rule_group_statement {
    name        = "AWSManagedRulesCommonRuleSet"
    vendor_name = "AWS"

    # 特定ルールのみ除外する（誤検知対策）
    excluded_rule {
      name = "SizeRestrictions_BODY"
    }
  }
}