why

To have most recent changes of README.md and doc from origin templates

Release Notes

AND_STATEMENT {
     LABEL_STATEMENT{     
      ...
     }
     NOT_STATEMENT{
          BYTE_MATCH_STATEMENT{
          ...
          }
     NOT_STATEMENT{
          BYTE_MATCH_STATEMENT{
          ...
          }
     }
}

 nested_statement_rules = [
  {
    name     = "complex-and-with-not-statements"
    priority = 100
    action   = "block"
    
    statement = {
      and_statement = {
        statements = [
          {
            label_match_statement = {
              scope = "LABEL"
              key   = "internal"
            }
          },
          {
            not_statement = {
              statement = {
                byte_match_statement = {
                  positional_constraint = "EXACTLY"
                  search_string        = "/authorized"
                  field_to_match = { uri_path = true }
                  text_transformation = [{ priority = 0, type = "NONE" }]
                }
              }
            }
          },
          {
            not_statement = {
              statement = {
                byte_match_statement = {
                  positional_constraint = "CONTAINS"
                  search_string        = "AuthorizedBot"
                  field_to_match = { single_header = { name = "user-agent" } }
                  text_transformation = [{ priority = 0, type = "LOWERCASE" }]
                }
              }
            }
          }
        ]
      }
    }
    
    visibility_config = {
      metric_name = "complex-and-with-not-statements"
    }
  }
]

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Release Notes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

• Add a scope_down_not_statement_enabled to allow not_statements

• AWS recommends bypassing bot control rules via the following method, which adds a not_statement to the scope_down_statement for managed rules. The current implementation does not allow for this, but this addition will allow the following:

{
  "Name": "AWS-AWSBotControl-Example",
  "Priority": 5,
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AWSManagedRulesBotControlRuleSet",
      "ManagedRuleGroupConfigs": [
        {
          "AWSManagedRulesBotControlRuleSet": {
            "InspectionLevel": "COMMON"
          }
        }
      ],
      "RuleActionOverrides": [],
      "ExcludedRules": []
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "AWS-AWSBotControl-Example"
    },
    "ScopeDownStatement": {
      "NotStatement": {
        "Statement": {
          "ByteMatchStatement": {
            "SearchString": "YSBzZWNyZXQ=",
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "x-bypass-secret"
              }
            },
            "TextTransformations": [
              {
                "Priority": 0,
                "Type": "NONE"
              }
            ],
            "PositionalConstraint": "EXACTLY"
          }
        }
      }
    }
  }
}

testing

• Successfully ran the following:

atmos validate stacks
atmos terraform apply waf -s <stack>

Summary by CodeRabbit

• New Features

  • Added optional scope-down configuration for managed rule group statements, including:
    • Ability to wrap scope-down logic in a NOT condition.
    • Byte match criteria (positional constraint, search string).
    • Target selection across headers, query, path, body, and method.
    • Support for text transformations with priority and type.

• Documentation

  • Updated variable descriptions to cover the new scope-down options and configuration details.

why

To have most recent changes of README.md and doc from origin templates

why

To have most recent changes of README.md and doc from origin templates

Release Notes

{
  "Name": "AWS-AWSBotControl-Example",
  "Priority": 5,
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AWSManagedRulesBotControlRuleSet",
      "ManagedRuleGroupConfigs": [
        {
          "AWSManagedRulesBotControlRuleSet": {
            "InspectionLevel": "COMMON"
          }
        }
      ],
      "RuleActionOverrides": [],
      "ExcludedRules": []
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "AWS-AWSBotControl-Example"
    },
    "ScopeDownStatement": {
      "NotStatement": {
        "Statement": {
          "ByteMatchStatement": {
            "SearchString": "YSBzZWNyZXQ=",
            "FieldToMatch": {
              "SingleHeader": {
                "Name": "x-bypass-secret"
              }
            },
            "TextTransformations": [
              {
                "Priority": 0,
                "Type": "NONE"
              }
            ],
            "PositionalConstraint": "EXACTLY"
          }
        }
      }
    }
  }
}

atmos validate stacks
atmos terraform apply waf -s <stack>

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

why

To have most recent changes of README.md and doc from origin templates

Release Notes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Release Notes

• src/versions.tf: Updated the version constraint for the aws provider to >= 4.9.0, < 6.0.0 to ensure compatibility with future versions while avoiding potential breaking changes in version 6.0.0.

why

• Support auto merge PRs
• Create merge queue
• Implement new CodeOwners policy

why

• Support auto merge PRs
• Create merge queue
• Implement new CodeOwners policy

You can trigger a rebase of this PR by commenting @dependabot rebase.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Release Notes

Summary by CodeRabbit

• New Features

  • Added comprehensive testing framework for AWS WAFv2 components.
  • Introduced Atmos CLI configuration for managing infrastructure components.
  • Created new Terraform configurations for VPC, DNS, ACM, ALB, and WAF.
  • Added new configurations for managing account mapping and DNS settings.

• Configuration Updates

  • Updated remote state module versions.
  • Added new stack and vendor configurations for infrastructure management.
  • Introduced new configurations for WAF rules based on various criteria (by name, by tags, disabled).

• Testing Improvements

  • Developed Go-based test suite for AWS security and networking components.
  • Added detailed test cases for WAF rules, IP restrictions, and security configurations.

• Chores

  • Updated .gitignore to exclude specific test and state directories.
  • Removed obsolete test script.

why

To have most recent changes of README.md and doc from origin templates

• Runs pre-commit hooks on all files
• Removes duplicate variable declarations for logging configurations

why

• After vendoring the waf component, I was met with the following error when running a terraform plan

Error:

Initializing modules...
╷
│ Error: Duplicate variable declaration
│
│   on variables.tf line 1151:
│ 1151: variable "log_destination_configs" {
│
│ A variable named "log_destination_configs" was already declared at variables.tf:112,1-35. Variable
│ names must be unique within a module.
╵
╷
│ Error: Duplicate variable declaration
│
│   on variables.tf line 1161:
│ 1161: variable "redacted_fields" {
│
│ A variable named "redacted_fields" was already declared at variables.tf:118,1-27. Variable names must
│ be unique within a module.
╵
╷
│ Error: Duplicate variable declaration
│
│   on variables.tf line 1188:
│ 1188: variable "logging_filter" {
│
│ A variable named "logging_filter" was already declared at variables.tf:145,1-26. Variable names must be
│ unique within a module.
╵
╷
│ Error: Duplicate variable declaration
│
│   on variables.tf line 1239:
│ 1239: variable "association_resource_arns" {
│
│ A variable named "association_resource_arns" was already declared at variables.tf:169,1-37. Variable
│ names must be unique within a module.
╵
╷
│ Error: Duplicate variable declaration
│
│   on variables.tf line 1253:
│ 1253: variable "association_resource_component_selectors" {
│
│ A variable named "association_resource_component_selectors" was already declared at
│ variables.tf:197,1-52. Variable names must be unique within a module.

Summary by CodeRabbit

• Chores

  • Updated .github/renovate.json with a minor formatting change
  • Removed .gitkeep file from docs directory

• Configuration

  • Removed several logging and resource association variables from Terraform configuration