PLT-585: Add override to aws-common ruleset for XSS check (#121)

CMSgov · Sep 5, 2024 · 18642f1 · 18642f1
1 parent fd91d12
commit 18642f1
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 0 deletions.
diff --git a/.github/workflows/api-waf-apply.yml b/.github/workflows/api-waf-apply.yml
@@ -7,6 +7,7 @@ on:
     paths:
       - .github/workflows/api-waf-apply.yml
       - terraform/services/api-waf/**
+      - terraform/modules/firewall/**
   workflow_dispatch: # Allow manual trigger
 
 jobs:

diff --git a/.github/workflows/api-waf-plan.yml b/.github/workflows/api-waf-plan.yml
@@ -5,6 +5,7 @@ on:
     paths:
       - .github/workflows/api-waf-plan.yml
       - terraform/services/api-waf/**
+      - terraform/modules/firewall/**
   workflow_dispatch: # Allow manual trigger
 
 jobs:

diff --git a/terraform/modules/firewall/main.tf b/terraform/modules/firewall/main.tf
@@ -107,6 +107,14 @@ resource "aws_wafv2_web_acl" "this" {
       managed_rule_group_statement {
         name        = "AWSManagedRulesCommonRuleSet"
         vendor_name = "AWS"
+
+        # Override for XSS block on request body, DPC team sends HTML blocks in requests to certain endpoints
+        rule_action_override {
+          name = "CrossSiteScripting_BODY"
+          action_to_use {
+            count {}
+          }
+        }
       }
     }