Merge pull request #411 from mdr-engineering/feature/bp_MSOCI-2121_disable_waf_rule

Adds more WAF excludes

base/customer_portal/waf.tf

@@ -10,8 +10,13 @@ module "waf" {
 
   excluded_rules_AWSManagedRulesCommonRuleSet = [
     "SizeRestrictions_BODY",
-    "GenericRFI_BODY",             # Blocks portal lambda MSOCI-2060
-    "CrossSiteScripting_BODY",     # Blocks portal API MSOCI-2121
+    "GenericRFI_BODY",              # Blocks portal lambda MSOCI-2060
+    "CrossSiteScripting_BODY",      # Blocks portal API MSOCI-2121
+    "EC2MetaDataSSRF_BODY",         # Blocks portal API MSOCI-2121
+  ]
+
+  excluded_rules_AWSManagedRulesUnixRuleSet = [
+    "UNIXShellCommandsVariables_BODY", # Blocks portal API MSOCI-2121
   ]
 
   # These are passed through and should be the same for module