Updates Github Access to just Trusted; WAF Fixes

To be tagged v3.3.1

base/github/securitygroups-load-balancers.tf

@@ -18,11 +18,17 @@ locals {
     "136.226.16.0/23",
     "136.226.20.0/23",
   ]
+  salt_masters = [
+    "18.253.198.129/32", # Salt Master Prod - proxy
+    "18.253.73.251/32", # salt master prod
+    "18.252.61.81/32", # Salt master dev - proxy
+    "18.253.226.199/32", # salt aster dev
+  ]
   # Locking down sources on 2021-12-10 due to log4j vulnerability
   #allowed_sources = local.zscalar_cidrs
   #allowed_sources = concat(var.trusted_ips, local.zscalar_cidrs)
   # salt masters only for the weekend
-  allowed_sources = [ "18.253.198.129/32" ]
+  allowed_sources = concat(var.trusted_ips, local.salt_masters)
   #allowed_sources = [ "0.0.0.0/0" ]
 }
 

submodules/wafv2/waf.tf

@@ -42,7 +42,7 @@ resource "aws_wafv2_ip_set" "allowed" {
 resource "aws_wafv2_rule_group" "xdr_custom_rules" {
   name = "${local.waf_name}_xdr_custom_rules_rev3" # update name when updating
   scope    = "REGIONAL"
-  capacity = 50
+  capacity = 60
 
   # Note, there is visibilty config for the group and for the rule
   visibility_config {
@@ -110,7 +110,7 @@ resource "aws_wafv2_rule_group" "xdr_custom_rules" {
                 name = "user-agent"
               }
             }
-            positional_constraint = "CONTAINS"
+            positional_constraint = "STARTS_WITH"
             search_string = "$${jndi:" # ldap://"
 
             text_transformation {
@@ -118,10 +118,10 @@ resource "aws_wafv2_rule_group" "xdr_custom_rules" {
               type     = "BASE64_DECODE"
             }
 
-            text_transformation {
-              priority = 3
-              type     = "HEX_DECODE"
-            }
+            #text_transformation {
+            #  priority = 3
+            #  type     = "HEX_DECODE"
+            #}
 
             text_transformation {
               priority = 5
@@ -130,55 +130,55 @@ resource "aws_wafv2_rule_group" "xdr_custom_rules" {
           }
         }
 
-        statement {
-          byte_match_statement {
-            field_to_match {
-              method {}
-            }
-            positional_constraint = "CONTAINS"
-            search_string = "$${jndi:" # ldap://"
-
-            text_transformation {
-              priority = 1
-              type     = "BASE64_DECODE"
-            }
-
-            text_transformation {
-              priority = 3
-              type     = "HEX_DECODE"
-            }
-
-            text_transformation {
-              priority = 5
-              type     = "LOWERCASE"
-            }
-          }
-        }
-
-        statement {
-          byte_match_statement {
-            field_to_match {
-              query_string {}
-            }
-            positional_constraint = "CONTAINS"
-            search_string = "$${jndi:" # ldap://"
-
-            text_transformation {
-              priority = 1
-              type     = "BASE64_DECODE"
-            }
-
-            text_transformation {
-              priority = 3
-              type     = "HEX_DECODE"
-            }
-
-            text_transformation {
-              priority = 5
-              type     = "LOWERCASE"
-            }
-          }
-        }
+#        statement {
+#          byte_match_statement {
+#            field_to_match {
+#              method {}
+#            }
+#            positional_constraint = "STARTS_WITH"
+#            search_string = "$${jndi:" # ldap://"
+#
+#            text_transformation {
+#              priority = 1
+#              type     = "BASE64_DECODE"
+#            }
+#
+#            text_transformation {
+#              priority = 3
+#              type     = "HEX_DECODE"
+#            }
+#
+#            text_transformation {
+#              priority = 5
+#              type     = "LOWERCASE"
+#            }
+#          }
+#        }
+#
+#        statement {
+#          byte_match_statement {
+#            field_to_match {
+#              query_string {}
+#            }
+#            positional_constraint = "CONTAINS"
+#            search_string = "$${jndi:" # ldap://"
+#
+#            text_transformation {
+#              priority = 1
+#              type     = "BASE64_DECODE"
+#            }
+#
+#            #text_transformation {
+#            #  priority = 3
+#            #  type     = "HEX_DECODE"
+#            #}
+#
+#            text_transformation {
+#              priority = 5
+#              type     = "LOWERCASE"
+#            }
+#          }
+#        }
 
         statement {
           byte_match_statement {
@@ -193,10 +193,10 @@ resource "aws_wafv2_rule_group" "xdr_custom_rules" {
               type     = "BASE64_DECODE"
             }
 
-            text_transformation {
-              priority = 3
-              type     = "HEX_DECODE"
-            }
+            #text_transformation {
+            #  priority = 3
+            #  type     = "HEX_DECODE"
+            #}
 
             text_transformation {
               priority = 5