{% set config = merged_configs.get('aws_wafv2_web_acl', {}) %}
{% set comments = compliance_comments.get('aws_wafv2_web_acl', []) %}
# ------------------------------------------------------------------------------
# WAFv2 Web ACL
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_wafv2_web_acl" "this" {
  name        = "{{ config.get('name', project_id ~ '-waf') }}"
  description = "{{ config.get('description', 'Managed by ComplyForm') }}"
  scope       = "{{ config.get('scope', 'REGIONAL') }}"

  default_action {
    {{ config.get('default_action', 'allow') }} {}
  }

  # AWS Managed Rules - Common Rule Set
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesCommonRuleSet"
    }
  }

  # AWS Managed Rules - Known Bad Inputs
  rule {
    name     = "AWSManagedRulesKnownBadInputsRuleSet"
    priority = 2

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesKnownBadInputsRuleSet"
    }
  }

  # AWS Managed Rules - SQL Injection
  rule {
    name     = "AWSManagedRulesSQLiRuleSet"
    priority = 3

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesSQLiRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedRulesSQLiRuleSet"
    }
  }

  visibility_config {
    sampled_requests_enabled   = {{ config.get('sampled_requests_enabled', true) | lower }}
    cloudwatch_metrics_enabled = {{ config.get('cloudwatch_metrics_enabled', true) | lower }}
    metric_name                = "{{ config.get('metric_name', project_id ~ '-waf') }}"
  }

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-waf') }}"
    ManagedBy = "complyform"
  }
}

{% if config.get('enable_logging', true) %}
resource "aws_wafv2_web_acl_logging_configuration" "this" {
  log_destination_configs = [aws_cloudwatch_log_group.waf.arn]
  resource_arn            = aws_wafv2_web_acl.this.arn
}

resource "aws_cloudwatch_log_group" "waf" {
  name              = "aws-waf-logs-{{ config.get('name', project_id ~ '-waf') }}"
  retention_in_days = {{ config.get('log_retention_days', 90) }}
  kms_key_id        = {{ config.get('log_kms_key_id', 'null') }}

  tags = {
    Name      = "{{ project_id }}-waf-logs"
    ManagedBy = "complyform"
  }
}
{% endif %}
