add additional waf features

modules/waf/README.md

@@ -67,13 +67,17 @@ components:
 | Name | Type |
 |------|------|
 | [aws_ssm_parameter.acl_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_alb.alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/alb) | data source |
+| [aws_lbs.alb_by_tags](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lbs) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_acl_name"></a> [acl\_name](#input\_acl\_name) | Friendly name of the ACL. The ACL ARN will be stored in SSM under {ssm\_path\_prefix}/{acl\_name}/arn | `string` | n/a | yes |
 | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br>This is for some rare cases where resources want additional configuration of tags<br>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
+| <a name="input_alb_names"></a> [alb\_names](#input\_alb\_names) | list of ALB names to associate with the web ACL. | `list(string)` | `[]` | no |
+| <a name="input_alb_tags"></a> [alb\_tags](#input\_alb\_tags) | list of tags to match one or more ALBs to associate with the web ACL. | `list(map(string))` | `[]` | no |
 | <a name="input_association_resource_arns"></a> [association\_resource\_arns](#input\_association\_resource\_arns) | A list of ARNs of the resources to associate with the web ACL.<br>This must be an ARN of an Application Load Balancer, Amazon API Gateway stage, or AWS AppSync.<br><br>Do not use this variable to associate a Cloudfront Distribution.<br>Instead, you should use the `web_acl_id` property on the `cloudfront_distribution` resource.<br>For more details, refer to https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html | `list(string)` | `[]` | no |
 | <a name="input_association_resource_component_selectors"></a> [association\_resource\_component\_selectors](#input\_association\_resource\_component\_selectors) | A list of Atmos component selectors to get from the remote state and associate their ARNs with the web ACL.<br>The components must be Application Load Balancers, Amazon API Gateway stages, or AWS AppSync.<br><br>component:<br>  Atmos component name<br>component\_arn\_output:<br>  The component output that defines the component ARN<br><br>Do not use this variable to select a Cloudfront Distribution component.<br>Instead, you should use the `web_acl_id` property on the `cloudfront_distribution` resource.<br>For more details, refer to https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html | <pre>list(object({<br>    component            = string<br>    namespace            = optional(string, null)<br>    tenant               = optional(string, null)<br>    environment          = optional(string, null)<br>    stage                = optional(string, null)<br>    component_arn_output = string<br>  }))</pre> | `[]` | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |

modules/waf/alb.tf

@@ -0,0 +1,15 @@
+locals {
+  alb_arns      = concat(local.alb_name_arns, local.alb_tag_arns)
+  alb_name_arns = [for alb_instance in data.aws_alb.alb : alb_instance.arn]
+  alb_tag_arns  = flatten([for alb_instance in data.aws_lbs.alb_by_tags : alb_instance.arns])
+}
+
+data "aws_alb" "alb" {
+  for_each = toset(var.alb_names)
+  name     = each.key
+}
+
+data "aws_lbs" "alb_by_tags" {
+  for_each = { for i, v in var.alb_tags : i => v }
+  tags     = each.value
+}

modules/waf/main.tf

@@ -6,7 +6,7 @@ locals {
     if local.enabled
   ]
 
-  association_resource_arns = concat(var.association_resource_arns, local.association_resource_component_selectors_arns)
+  association_resource_arns = toset(concat(var.association_resource_arns, local.association_resource_component_selectors_arns, local.alb_arns))
 }
 
 module "aws_waf" {

modules/waf/variables.tf

@@ -171,6 +171,20 @@ variable "association_resource_arns" {
   nullable    = false
 }
 
+variable "alb_names" {
+  description = "list of ALB names to associate with the web ACL."
+  type        = list(string)
+  default     = []
+  nullable    = false
+}
+
+variable "alb_tags" {
+  description = "list of tags to match one or more ALBs to associate with the web ACL."
+  type        = list(map(string))
+  default     = []
+  nullable    = false
+}
+
 variable "association_resource_component_selectors" {
   type = list(object({
     component            = string