terruvim-core-test 0.0.1

package/dist/src/factories/wafFactory.js

@@ -0,0 +1,499 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WafFactory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+class WafFactory {
+    static createWaf(config, provider) {
+        const resourceName = config.name;
+        const providerOptions = provider ? { provider } : undefined;
+        const ipSets = WafFactory.createIpSets(config, provider);
+        const rules = WafFactory.buildWafRules(config, ipSets);
+        const webAcl = new aws.wafv2.WebAcl(resourceName, {
+            scope: config.scope,
+            description: config.description || `WAF for ${config.name}`,
+            defaultAction: config.defaultAction === "allow" ? { allow: {} } : { block: {} },
+            rules,
+            visibilityConfig: {
+                cloudwatchMetricsEnabled: config.visibilityConfig?.cloudwatchMetricsEnabled ?? true,
+                sampledRequestsEnabled: config.visibilityConfig?.sampledRequestsEnabled ?? true,
+                metricName: config.visibilityConfig?.metricName || `${config.name}-waf`,
+            },
+            tags: config.tags,
+        }, providerOptions);
+        if (config.logging?.enabled) {
+            WafFactory.setupWafLogging(config, webAcl, provider);
+        }
+        return webAcl;
+    }
+    static createIpSets(config, provider) {
+        const providerOptions = provider ? { provider } : undefined;
+        const ipSets = {};
+        if (config.ipRestrictions?.blockedIps?.length) {
+            ipSets.blockedIps = new aws.wafv2.IpSet(`${config.name}-blocked-ips`, {
+                scope: config.scope,
+                ipAddressVersion: "IPV4",
+                addresses: config.ipRestrictions.blockedIps,
+                description: "Blocked IP addresses",
+                tags: config.tags,
+            }, providerOptions);
+        }
+        if (config.ipRestrictions?.allowedIps?.length) {
+            ipSets.allowedIps = new aws.wafv2.IpSet(`${config.name}-allowed-ips`, {
+                scope: config.scope,
+                ipAddressVersion: "IPV4",
+                addresses: config.ipRestrictions.allowedIps,
+                description: "Allowed IP addresses",
+                tags: config.tags,
+            }, providerOptions);
+        }
+        return ipSets;
+    }
+    static buildWafRules(config, ipSets) {
+        const rules = [];
+        let priority = 1;
+        if (ipSets.allowedIps) {
+            rules.push({
+                name: "AllowedIPs",
+                priority: priority++,
+                action: { allow: {} },
+                statement: {
+                    ipSetReferenceStatement: {
+                        arn: ipSets.allowedIps.arn,
+                    },
+                },
+                visibilityConfig: {
+                    cloudwatchMetricsEnabled: true,
+                    sampledRequestsEnabled: true,
+                    metricName: `${config.name}-allowed-ips`,
+                },
+            });
+        }
+        if (ipSets.blockedIps) {
+            rules.push({
+                name: "BlockedIPs",
+                priority: priority++,
+                action: { block: {} },
+                statement: {
+                    ipSetReferenceStatement: {
+                        arn: ipSets.blockedIps.arn,
+                    },
+                },
+                visibilityConfig: {
+                    cloudwatchMetricsEnabled: true,
+                    sampledRequestsEnabled: true,
+                    metricName: `${config.name}-blocked-ips`,
+                },
+            });
+        }
+        if (config.geoRestrictions?.blockedCountries?.length) {
+            rules.push({
+                name: "GeoBlocking",
+                priority: priority++,
+                action: { block: {} },
+                statement: {
+                    geoMatchStatement: {
+                        countryCodes: config.geoRestrictions.blockedCountries,
+                    },
+                },
+                visibilityConfig: {
+                    cloudwatchMetricsEnabled: true,
+                    sampledRequestsEnabled: true,
+                    metricName: `${config.name}-geo-blocking`,
+                },
+            });
+        }
+        if (config.rateLimiting?.enabled) {
+            rules.push({
+                name: "RateLimiting",
+                priority: priority++,
+                action: config.rateLimiting.action === "block" ? { block: {} } : { count: {} },
+                statement: {
+                    rateBasedStatement: {
+                        limit: config.rateLimiting.limit,
+                        aggregateKeyType: "IP",
+                    },
+                },
+                visibilityConfig: {
+                    cloudwatchMetricsEnabled: true,
+                    sampledRequestsEnabled: true,
+                    metricName: `${config.name}-rate-limiting`,
+                },
+            });
+        }
+        if (config.managedRuleGroups?.length) {
+            for (const ruleGroup of config.managedRuleGroups) {
+                const excludedRules = ruleGroup.excludedRules?.map(rule => ({
+                    name: rule,
+                })) || [];
+                rules.push({
+                    name: `ManagedRuleGroup-${ruleGroup.name}`,
+                    priority: priority++,
+                    overrideAction: ruleGroup.overrideAction === "count" ? { count: {} } : undefined,
+                    statement: {
+                        managedRuleGroupStatement: {
+                            vendorName: ruleGroup.vendorName,
+                            name: ruleGroup.name,
+                            version: ruleGroup.version,
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-${ruleGroup.name.toLowerCase()}`,
+                    },
+                });
+            }
+        }
+        if (config.sqlInjectionProtection?.enabled) {
+            const fieldToMatch = config.sqlInjectionProtection.fieldToMatch || [
+                { type: "uri" },
+                { type: "query-string" },
+                { type: "body" },
+            ];
+            for (const field of fieldToMatch) {
+                rules.push({
+                    name: `SQLInjectionProtection-${field.type}`,
+                    priority: priority++,
+                    action: config.sqlInjectionProtection.action === "block" ? { block: {} } : { count: {} },
+                    statement: {
+                        sqliMatchStatement: {
+                            fieldToMatch: WafFactory.buildFieldToMatch(field),
+                            textTransformations: [
+                                { type: "URL_DECODE", priority: 1 },
+                                { type: "HTML_ENTITY_DECODE", priority: 2 },
+                            ],
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-sqli-${field.type}`,
+                    },
+                });
+            }
+        }
+        if (config.xssProtection?.enabled) {
+            const fieldToMatch = config.xssProtection.fieldToMatch || [
+                { type: "uri" },
+                { type: "query-string" },
+                { type: "body" },
+            ];
+            for (const field of fieldToMatch) {
+                rules.push({
+                    name: `XSSProtection-${field.type}`,
+                    priority: priority++,
+                    action: config.xssProtection.action === "block" ? { block: {} } : { count: {} },
+                    statement: {
+                        xssMatchStatement: {
+                            fieldToMatch: WafFactory.buildFieldToMatch(field),
+                            textTransformations: [
+                                { type: "URL_DECODE", priority: 1 },
+                                { type: "HTML_ENTITY_DECODE", priority: 2 },
+                            ],
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-xss-${field.type}`,
+                    },
+                });
+            }
+        }
+        if (config.sizeRestrictions?.enabled) {
+            if (config.sizeRestrictions.maxBodySize) {
+                rules.push({
+                    name: "BodySizeRestriction",
+                    priority: priority++,
+                    action: config.sizeRestrictions.action === "block" ? { block: {} } : { count: {} },
+                    statement: {
+                        sizeConstraintStatement: {
+                            fieldToMatch: { body: {} },
+                            comparisonOperator: "GT",
+                            size: config.sizeRestrictions.maxBodySize,
+                            textTransformations: [{ type: "NONE", priority: 0 }],
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-body-size`,
+                    },
+                });
+            }
+            if (config.sizeRestrictions.maxUriSize) {
+                rules.push({
+                    name: "URISizeRestriction",
+                    priority: priority++,
+                    action: config.sizeRestrictions.action === "block" ? { block: {} } : { count: {} },
+                    statement: {
+                        sizeConstraintStatement: {
+                            fieldToMatch: { uriPath: {} },
+                            comparisonOperator: "GT",
+                            size: config.sizeRestrictions.maxUriSize,
+                            textTransformations: [{ type: "NONE", priority: 0 }],
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-uri-size`,
+                    },
+                });
+            }
+        }
+        if (config.customRegexRules?.length) {
+            for (const regexRule of config.customRegexRules) {
+                rules.push({
+                    name: regexRule.name,
+                    priority: priority++,
+                    action: regexRule.action === "block" ? { block: {} } : { count: {} },
+                    statement: {
+                        regexMatchStatement: {
+                            regexString: regexRule.regex,
+                            fieldToMatch: WafFactory.buildFieldToMatch(regexRule.fieldToMatch),
+                            textTransformations: [
+                                { type: "URL_DECODE", priority: 1 },
+                                { type: "LOWERCASE", priority: 2 },
+                            ],
+                        },
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                        metricName: `${config.name}-${regexRule.name.toLowerCase()}`,
+                    },
+                });
+            }
+        }
+        if (config.rules?.length) {
+            for (const rule of config.rules) {
+                rules.push(WafFactory.buildCustomRule(config.name, rule));
+            }
+        }
+        return rules;
+    }
+    static buildFieldToMatch(field) {
+        switch (field.type) {
+            case "uri":
+                return { uriPath: {} };
+            case "query-string":
+                return { queryString: {} };
+            case "header":
+                return { singleHeader: { name: field.name.toLowerCase() } };
+            case "body":
+                return { body: {} };
+            case "method":
+                return { method: {} };
+            case "all-query-arguments":
+                return { allQueryArguments: {} };
+            default:
+                return { uriPath: {} };
+        }
+    }
+    static buildCustomRule(wafName, rule) {
+        const ruleConfig = {
+            name: rule.name,
+            priority: rule.priority,
+            statement: {},
+            visibilityConfig: {
+                cloudwatchMetricsEnabled: true,
+                sampledRequestsEnabled: true,
+                metricName: `${wafName}-${rule.name.toLowerCase()}`,
+            },
+        };
+        if (rule.overrideAction && rule.overrideAction === "count") {
+            ruleConfig.overrideAction = { count: {} };
+        }
+        else {
+            ruleConfig.action =
+                rule.action === "allow" ? { allow: {} } :
+                    rule.action === "block" ? { block: {} } : { count: {} };
+        }
+        switch (rule.statement.type) {
+            case "rate-limit":
+                ruleConfig.statement = {
+                    rateBasedStatement: {
+                        limit: rule.statement.limit || 2000,
+                        aggregateKeyType: "IP",
+                    },
+                };
+                break;
+            case "sql-injection":
+                ruleConfig.statement = {
+                    sqliMatchStatement: {
+                        fieldToMatch: rule.statement.fieldToMatch ?
+                            WafFactory.buildFieldToMatch(rule.statement.fieldToMatch) : { uriPath: {} },
+                        textTransformations: rule.statement.textTransformations?.map(t => ({
+                            type: t.type.toUpperCase().replace(/-/g, "_"),
+                            priority: t.priority,
+                        })) || [{ type: "URL_DECODE", priority: 1 }],
+                    },
+                };
+                break;
+            case "xss":
+                ruleConfig.statement = {
+                    xssMatchStatement: {
+                        fieldToMatch: rule.statement.fieldToMatch ?
+                            WafFactory.buildFieldToMatch(rule.statement.fieldToMatch) : { uriPath: {} },
+                        textTransformations: rule.statement.textTransformations?.map(t => ({
+                            type: t.type.toUpperCase().replace(/-/g, "_"),
+                            priority: t.priority,
+                        })) || [{ type: "URL_DECODE", priority: 1 }],
+                    },
+                };
+                break;
+            case "managed-rule-group":
+                if (rule.statement.managedRuleGroup) {
+                    ruleConfig.statement = {
+                        managedRuleGroupStatement: {
+                            vendorName: rule.statement.managedRuleGroup.vendorName,
+                            name: rule.statement.managedRuleGroup.name,
+                            version: rule.statement.managedRuleGroup.version,
+                        },
+                    };
+                }
+                break;
+        }
+        return ruleConfig;
+    }
+    static setupWafLogging(config, webAcl, provider) {
+        const providerOptions = provider ? { provider } : undefined;
+        const logGroup = new aws.cloudwatch.LogGroup(`${config.name}-waf-logs`, {
+            name: config.logging.logGroupName || `aws-waf-logs-${config.name}`,
+            retentionInDays: config.logging.retentionDays || 365,
+            tags: config.tags,
+        }, providerOptions);
+        const loggingConfig = new aws.wafv2.WebAclLoggingConfiguration(`${config.name}-waf-logging`, {
+            resourceArn: webAcl.arn,
+            logDestinationConfigs: [pulumi.interpolate `${logGroup.arn}:*`],
+        }, providerOptions);
+    }
+    static createSecureWafConfig(name, scope) {
+        return {
+            name,
+            scope,
+            description: `Enterprise-grade WAF security for ${name}`,
+            defaultAction: "allow",
+            rateLimiting: {
+                enabled: true,
+                limit: 2000,
+                action: "block",
+            },
+            sqlInjectionProtection: {
+                enabled: true,
+                action: "block",
+                fieldToMatch: [
+                    { type: "uri" },
+                    { type: "query-string" },
+                    { type: "body" },
+                    { type: "header", name: "authorization" },
+                ],
+            },
+            xssProtection: {
+                enabled: true,
+                action: "block",
+                fieldToMatch: [
+                    { type: "uri" },
+                    { type: "query-string" },
+                    { type: "body" },
+                ],
+            },
+            sizeRestrictions: {
+                enabled: true,
+                maxBodySize: 8192000,
+                maxUriSize: 8192,
+                action: "block",
+            },
+            managedRuleGroups: [
+                {
+                    name: "AWSManagedRulesCommonRuleSet",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+                {
+                    name: "AWSManagedRulesKnownBadInputsRuleSet",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+                {
+                    name: "AWSManagedRulesSQLiRuleSet",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+                {
+                    name: "AWSManagedRulesLinuxRuleSet",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+                {
+                    name: "AWSManagedRulesAmazonIpReputationList",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+                {
+                    name: "AWSManagedRulesAnonymousIpList",
+                    vendorName: "AWS",
+                    overrideAction: "count",
+                },
+            ],
+            customRegexRules: [
+                {
+                    name: "BlockScanningTools",
+                    regex: "(nikto|nmap|sqlmap|burp|acunetix|nessus|openvas|w3af|skipfish|sqlninja)",
+                    action: "block",
+                    fieldToMatch: { type: "header", name: "user-agent" },
+                },
+                {
+                    name: "BlockSuspiciousPatterns",
+                    regex: "(union.select|script.alert|javascript:|vbscript:|onload=|onerror=)",
+                    action: "block",
+                    fieldToMatch: { type: "uri" },
+                },
+            ],
+            logging: {
+                enabled: true,
+                retentionDays: 365,
+            },
+            visibilityConfig: {
+                cloudwatchMetricsEnabled: true,
+                sampledRequestsEnabled: true,
+            },
+        };
+    }
+}
+exports.WafFactory = WafFactory;

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "terruvim-core-test",
+  "version": "0.0.1",
+  "description": "Core logic for Terruvim framework TEST",
+  "private": false,
+  "main": "dist/src/core/entrypoint.js",
+  "types": "dist/src/core/entrypoint.d.ts",
+  "bin": {
+    "terruvim": "./scripts/copy-assets.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "up": "pulumi up",
+    "preview": "pulumi preview",
+    "destroy": "pulumi destroy"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "terruvim",
+    "core"
+  ],
+  "author": [
+    "Vlad Vorobei",
+    "Anton Kolvakh"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@aws-sdk/client-dynamodb": "^3.835.0",
+    "@aws-sdk/client-s3": "^3.837.0",
+    "@aws-sdk/client-sns": "^3.835.0",
+    "@aws-sdk/lib-dynamodb": "^3.835.0",
+    "@pulumi/aws": "^6.83.0",
+    "@pulumi/aws-apigateway": "^2.6.2",
+    "@pulumi/awsx": "^2.22.0",
+    "@pulumi/cloud-aws": "^0.40.2",
+    "@pulumi/command": "^1.1.0",
+    "@pulumi/digitalocean": "^4.48.0",
+    "@pulumi/docker": "^4.7.0",
+    "@pulumi/eks": "^3.9.1",
+    "@pulumi/kubernetes": "^4.23.0",
+    "@pulumi/pagerduty": "^4.26.2",
+    "@pulumi/postgresql": "^3.15.2",
+    "@pulumi/pulumi": "^3.0.0",
+    "@pulumi/pulumiservice": "^0.29.3",
+    "@pulumi/random": "^4.18.2",
+    "@pulumi/tls": "^5.2.0",
+    "@pulumiverse/time": "^0.1.1",
+    "@slack/webhook": "^7.0.5",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node-forge": "^1.3.11",
+    "@types/superagent": "^8.1.9",
+    "athena-client": "^2.5.1",
+    "js-yaml": "^4.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "jwks-rsa": "^3.2.0",
+    "moment-timezone": "^0.6.0",
+    "node-forge": "^1.3.1",
+    "pcloudinit": "^0.1.0",
+    "superagent": "^10.2.1"
+  },
+  "devDependencies": {
+    "@types/aws-lambda": "^8.10.150",
+    "@types/jest": "^30.0.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/mime-types": "^3.0.1",
+    "@types/mustache": "^4.2.6",
+    "typescript": "^5.3.0"
+  }
+}