Skip to content

Commit ce821ab

Browse files
lsy1968shanye997
authored andcommitted
201-use-case-use-WAF-to-defend-against-UA-attacks
1 parent f9a0c83 commit ce821ab

File tree

3 files changed

+260
-0
lines changed

3 files changed

+260
-0
lines changed
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
## Introduction
2+
3+
<!-- DOCS_DESCRIPTION_CN -->
4+
本示例用于在阿里云上利用Web应用防火墙(Web Application Firewall,简称WAF)3.0的自定义防护功能来防御异常用户代理(UA)对源站的攻击。
5+
详情可查看[通过WAF自定义防护功能抵御异常UA攻击](http://help.aliyun.com/document_detail/2804234.htm)
6+
<!-- DOCS_DESCRIPTION_CN -->
7+
8+
<!-- DOCS_DESCRIPTION_EN -->
9+
This example is used to use the custom rule module of Web Application Firewall (WAF) 3.0 to defend against UA attacks.
10+
More details in [Use the custom rule module of WAF to defend against UA attacks](http://help.aliyun.com/document_detail/2804234.htm).
11+
<!-- DOCS_DESCRIPTION_EN -->
12+
13+
<!-- BEGIN_TF_DOCS -->
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_alicloud"></a> [alicloud](#provider\_alicloud) | n/a |
19+
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
20+
| <a name="provider_time"></a> [time](#provider\_time) | n/a |
21+
22+
## Modules
23+
24+
No modules.
25+
26+
## Resources
27+
28+
| Name | Type |
29+
|------|------|
30+
| [alicloud_instance.instance](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/instance) | resource |
31+
| [alicloud_security_group.example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group) | resource |
32+
| [alicloud_security_group_rule.allow_tcp_22](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
33+
| [alicloud_security_group_rule.allow_tcp_443](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
34+
| [alicloud_security_group_rule.allow_tcp_80](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/security_group_rule) | resource |
35+
| [alicloud_slb_listener.example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/slb_listener) | resource |
36+
| [alicloud_slb_load_balancer.example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/slb_load_balancer) | resource |
37+
| [alicloud_slb_server_group.example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/slb_server_group) | resource |
38+
| [alicloud_slb_server_group_server_attachment.default](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/slb_server_group_server_attachment) | resource |
39+
| [alicloud_vpc.vpc](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vpc) | resource |
40+
| [alicloud_vswitch.vswitch](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
41+
| [random_integer.example](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) | resource |
42+
| [time_sleep.example](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
43+
| [alicloud_zones.example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/data-sources/zones) | data source |
44+
45+
## Inputs
46+
47+
| Name | Description | Type | Default | Required |
48+
|------|-------------|------|---------|:--------:|
49+
| <a name="input_image_id"></a> [image\_id](#input\_image\_id) | Image of instance. | `string` | `"aliyun_3_x64_20G_alibase_20250117.vhd"` | no |
50+
| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | Instance type. | `string` | `"ecs.e-c1m1.large"` | no |
51+
| <a name="input_internet_bandwidth"></a> [internet\_bandwidth](#input\_internet\_bandwidth) | The maximum outbound public bandwidth. Unit: Mbit/s. Valid values: 0 to 100. | `string` | `"10"` | no |
52+
| <a name="input_password"></a> [password](#input\_password) | Server login password, length 8-30, must contain three (Capital letters, lowercase letters, numbers, `~!@#$%^&*_-+=|{}[]:;'<>?,./ Special symbol in)` | `string` | `"Terraform@Example"` | no |
53+
| <a name="input_region"></a> [region](#input\_region) | 资源将要创建的地域 | `string` | `"cn-beijing"` | no |
54+
| <a name="input_source_ip"></a> [source\_ip](#input\_source\_ip) | The IP address you used to access the ECS. | `string` | `"0.0.0.0/0"` | no |
55+
| <a name="input_system_disk_category"></a> [system\_disk\_category](#input\_system\_disk\_category) | The category of the system disk. | `string` | `"cloud_essd"` | no |
56+
| <a name="input_vpc_cidr_block"></a> [vpc\_cidr\_block](#input\_vpc\_cidr\_block) | 专有网络VPC网段 | `string` | `"172.16.0.0/16"` | no |
57+
| <a name="input_vswitch_cidr_block"></a> [vswitch\_cidr\_block](#input\_vswitch\_cidr\_block) | 交换机VSwitch网段 | `string` | `"172.16.0.0/24"` | no |
58+
<!-- END_TF_DOCS -->
59+
60+
## Documentation
61+
<!-- docs-link -->
62+
63+
The template is based on Aliyun document: [Use the custom rule module of WAF to defend against UA attacks](http://help.aliyun.com/document_detail/2804234.htm)
64+
65+
<!-- docs-link -->
Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
provider "alicloud" {
2+
region = var.region
3+
}
4+
5+
# 资源将要创建的地域
6+
variable "region" {
7+
default = "cn-beijing"
8+
}
9+
10+
# ECS登录密码
11+
variable "password" {
12+
description = "Server login password, length 8-30, must contain three (Capital letters, lowercase letters, numbers, `~!@#$%^&*_-+=|{}[]:;'<>?,./ Special symbol in)"
13+
type = string
14+
default = "Terraform@Example"
15+
}
16+
17+
# 云盘类型
18+
variable "system_disk_category" {
19+
description = "The category of the system disk."
20+
type = string
21+
default = "cloud_essd"
22+
}
23+
24+
# ECS系统镜像
25+
variable "image_id" {
26+
description = "Image of instance. "
27+
type = string
28+
default = "aliyun_3_x64_20G_alibase_20250117.vhd"
29+
}
30+
31+
# ECS实例规格
32+
variable "instance_type" {
33+
description = "Instance type."
34+
type = string
35+
default = "ecs.e-c1m1.large"
36+
}
37+
38+
# 专有网络VPC网段
39+
variable "vpc_cidr_block" {
40+
type = string
41+
default = "172.16.0.0/16"
42+
}
43+
44+
# 交换机VSwitch网段
45+
variable "vswitch_cidr_block" {
46+
type = string
47+
default = "172.16.0.0/24"
48+
}
49+
50+
# source_ip
51+
variable "source_ip" {
52+
description = "The IP address you used to access the ECS."
53+
type = string
54+
default = "0.0.0.0/0"
55+
}
56+
57+
# ECS公网带宽
58+
variable "internet_bandwidth" {
59+
description = "The maximum outbound public bandwidth. Unit: Mbit/s. Valid values: 0 to 100."
60+
default = "10"
61+
}
62+
63+
# 可用区
64+
data "alicloud_zones" "example" {
65+
available_resource_creation = "VSwitch"
66+
available_disk_category = var.system_disk_category
67+
available_instance_type = var.instance_type
68+
}
69+
70+
# 随机数,取值${random_integer.example.result}
71+
resource "random_integer" "example" {
72+
min = 10000
73+
max = 99999
74+
}
75+
76+
# 专有网络VPC
77+
resource "alicloud_vpc" "vpc" {
78+
vpc_name = "vpc_tf_${random_integer.example.result}"
79+
cidr_block = var.vpc_cidr_block
80+
}
81+
82+
# 交换机VSwitch
83+
resource "alicloud_vswitch" "vswitch" {
84+
vpc_id = alicloud_vpc.vpc.id
85+
cidr_block = var.vswitch_cidr_block
86+
zone_id = data.alicloud_zones.example.zones[0].id
87+
vswitch_name = "vswitch_tf_${random_integer.example.result}"
88+
}
89+
90+
# 安全组
91+
resource "alicloud_security_group" "example" {
92+
security_group_name = "security_group_name_${random_integer.example.result}"
93+
vpc_id = alicloud_vpc.vpc.id
94+
}
95+
96+
# 添加允许TCP 22端口入方向流量的规则
97+
resource "alicloud_security_group_rule" "allow_tcp_22" {
98+
type = "ingress"
99+
ip_protocol = "tcp"
100+
nic_type = "intranet"
101+
policy = "accept"
102+
port_range = "22/22"
103+
priority = 1
104+
security_group_id = alicloud_security_group.example.id
105+
cidr_ip = var.source_ip
106+
}
107+
108+
# 添加允许TCP 80端口入方向流量的规则
109+
resource "alicloud_security_group_rule" "allow_tcp_80" {
110+
type = "ingress"
111+
ip_protocol = "tcp"
112+
nic_type = "intranet"
113+
policy = "accept"
114+
port_range = "80/80"
115+
priority = 1
116+
security_group_id = alicloud_security_group.example.id
117+
cidr_ip = var.source_ip
118+
}
119+
120+
# 添加允许TCP 443端口入方向流量的规则
121+
resource "alicloud_security_group_rule" "allow_tcp_443" {
122+
type = "ingress"
123+
ip_protocol = "tcp"
124+
nic_type = "intranet"
125+
policy = "accept"
126+
port_range = "443/443"
127+
priority = 1
128+
security_group_id = alicloud_security_group.example.id
129+
cidr_ip = var.source_ip
130+
}
131+
132+
# ECS实例
133+
resource "alicloud_instance" "instance" {
134+
availability_zone = data.alicloud_zones.example.zones[0].id
135+
security_groups = alicloud_security_group.example.*.id
136+
instance_type = var.instance_type
137+
system_disk_category = var.system_disk_category
138+
image_id = var.image_id
139+
instance_name = "instance_tf_${random_integer.example.result}"
140+
vswitch_id = alicloud_vswitch.vswitch.id
141+
internet_max_bandwidth_out = var.internet_bandwidth
142+
password = var.password
143+
}
144+
145+
# clb 实例
146+
resource "alicloud_slb_load_balancer" "example" {
147+
load_balancer_name = "clb_tf_${random_integer.example.result}"
148+
load_balancer_spec = "slb.s2.small"
149+
address_type = "internet"
150+
address_ip_version = "ipv4"
151+
vswitch_id = alicloud_vswitch.vswitch.id
152+
instance_charge_type = "PayBySpec"
153+
}
154+
155+
resource "time_sleep" "example" {
156+
depends_on = [alicloud_slb_load_balancer.example]
157+
create_duration = "30s"
158+
}
159+
160+
# 创建监听
161+
resource "alicloud_slb_listener" "example" {
162+
load_balancer_id = alicloud_slb_load_balancer.example.id
163+
server_group_id = alicloud_slb_server_group.example.id
164+
backend_port = 80
165+
frontend_port = 80
166+
protocol = "http"
167+
bandwidth = 10
168+
}
169+
170+
# clb 服务器组
171+
resource "alicloud_slb_server_group" "example" {
172+
load_balancer_id = alicloud_slb_load_balancer.example.id
173+
name = "clb_server_group_tf_${random_integer.example.result}"
174+
}
175+
176+
# 服务器组添加ECS
177+
resource "alicloud_slb_server_group_server_attachment" "default" {
178+
depends_on = [time_sleep.example]
179+
server_group_id = alicloud_slb_server_group.example.id
180+
server_id = alicloud_instance.instance.id
181+
port = 80
182+
weight = 100
183+
type = "ecs"
184+
}
185+
186+
187+
188+
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
terraform {
2+
required_providers {
3+
alicloud = {
4+
source = "aliyun/alicloud"
5+
}
6+
}
7+
}

0 commit comments

Comments
 (0)