Merge pull request #145 from kloia/adjust-waf-ip-set-to-create-generi…

…c-groups

adjust dynamic waf ip set creation

aws-waf-ip-set/main.tf

@@ -1,7 +1,7 @@
 resource "aws_wafv2_ip_set" "blacklist_ip_set" {
 
   ip_address_version = "IPV4"
-  scope              = "${var.blacklist_scope}"
+  scope              = var.blacklist_scope
   description        = var.blacklist_ip_set_description
   name               = var.blacklist_ip_set_name
   addresses          = var.blacklist_ip_addresses
@@ -11,9 +11,19 @@ resource "aws_wafv2_ip_set" "blacklist_ip_set" {
 
 resource "aws_wafv2_ip_set" "whitelist_ip_set" {
   ip_address_version = "IPV4"
-  scope              = "${var.whitelist_scope}"
+  scope              = var.whitelist_scope
   description        = var.ip_set_description
   name               = var.ip_set_name
   addresses          = var.ip_set_addresses
 
-}
+}
+
+
+resource "aws_wafv2_ip_set" "ip_addresses" {
+  for_each           = var.ip_address_groups
+  ip_address_version = each.value.ip_address_version
+  scope              = each.value.whitelist_scope
+  description        = each.value.ip_set_description
+  name               = each.value.ip_set_name
+  addresses          = each.value.ip_set_addresses
+}

aws-waf-ip-set/output.tf

@@ -1,9 +1,15 @@
 output "blacklist_ip_set_arn" {
-    value = aws_wafv2_ip_set.blacklist_ip_set.arn
-    description = "arn of blacklist ip set"
+  value       = aws_wafv2_ip_set.blacklist_ip_set.arn
+  description = "arn of blacklist ip set"
 }
 
 output "whitelist_ip_set_arn" {
-    value = aws_wafv2_ip_set.whitelist_ip_set.arn
-    description = "arn of whitelist ip set"
-}
+  value       = aws_wafv2_ip_set.whitelist_ip_set.arn
+  description = "arn of whitelist ip set"
+}
+
+output "dynamic_waf_ip_set_arns" {
+  value       = { for key, ip_set in aws_wafv2_ip_set.ip_addresses : key => ip_set.arn }
+  description = "Map of ARNs for dynamically created IP address groups"
+}
+

aws-waf-ip-set/variables.tf

@@ -1,43 +1,58 @@
 variable "ip_set_addresses" {
-    description = "IP addresses"
-    type = list(string)
-    default = []
+  description = "IP addresses"
+  type        = list(string)
+  default     = []
 }
 
 variable "ip_set_name" {
-    description = "IP Set Name"
-    default = ""
+  description = "IP Set Name"
+  default     = ""
 }
 
 variable "ip_set_description" {
-    description = "Description of the IP set"
-    default = ""
-  
+  description = "Description of the IP set"
+  default     = ""
+
 }
 
 variable "whitelist_scope" {
   description = ""
-  default = "REGIONAL"
+  default     = "REGIONAL"
 }
 
 variable "blacklist_ip_addresses" {
-    description = "Blacklist IP addresses"
-    type = list(string)
-    default = []
+  description = "Blacklist IP addresses"
+  type        = list(string)
+  default     = []
 }
 
 variable "blacklist_ip_set_name" {
-    description = "IP Set Name"
-    default = ""
+  description = "IP Set Name"
+  default     = ""
 }
 
 variable "blacklist_ip_set_description" {
-    description = "Description of the IP set"
-    default = ""
-  
+  description = "Description of the IP set"
+  default     = ""
+
 }
 
 variable "blacklist_scope" {
   description = ""
-  default = "REGIONAL"
-}
+  default     = "REGIONAL"
+}
+
+
+
+
+variable "ip_address_groups" {
+  description = "Map of IP address groups for creating multiple AWS WAFv2 IP Sets"
+  type = map(object({
+    ip_address_version = string
+    whitelist_scope    = string
+    ip_set_description = string
+    ip_set_name        = string
+    ip_set_addresses   = list(string)
+  }))
+  default = {}
+}