add wafv2 permissions

aws/policy/security-services.yaml

@@ -27,6 +27,40 @@ Statement:
     Resource:
       - 'arn:aws:iam::{{ aws_account_id }}:role/ansible_lambda_role'
 
+  - Sid: AllowRegionalRestrictedResourceActionsWhichIncurFees
+    Effect: Allow
+    Action:
+      - wafv2:ListRuleGroups
+      - wafv2:ListWebACLs
+      - wafv2:AssociateWebACL
+      - wafv2:DeleteRuleGroup
+      - wafv2:CreateRuleGroup
+      - wafv2:PutFirewallManagerRuleGroups
+      - wafv2:GetWebACLForResource
+      - wafv2:GetLoggingConfiguration
+      - wafv2:DeleteWebACL
+      - wafv2:GetRateBasedStatementManagedKeys
+      - wafv2:ListLoggingConfigurations
+      - wafv2:GetIPSet
+      - wafv2:CreateWebACL
+      - wafv2:ListIPSets
+      - wafv2:GetWebACL
+      - wafv2:GetRuleGroup
+      - wafv2:CreateIPSet
+      - wafv2:ListAvailableManagedRuleGroups
+      - wafv2:DeleteIPSet
+      - wafv2:DescribeManagedRuleGroup
+      - wafv2:CheckCapacity
+      - wafv2:ListResourcesForWebACL
+      - wafv2:DeleteLoggingConfiguration
+      - wafv2:PutLoggingConfiguration
+      - wafv2:DisassociateWebACL
+      - wafv2:UpdateWebACL
+      - wafv2:UpdateRuleGroup
+      - wafv2:DeleteFirewallManagerRuleGroups
+      - wafv2:DisassociateFirewallManager
+      - wafv2:UpdateIPSet
+
   - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
     Effect: Allow
     Action:

aws/terminator/security_services.py

@@ -265,6 +265,27 @@ def terminate(self):
         self.client.delete_regex_pattern_set(RegexPatternSetId=self.id, ChangeToken=self.change_token)
 
 
+class WafV2IpSetRegionl(Terminator):
+    @staticmethod
+    def create(credentials):
+        return Terminator._create(credentials, WafV2IpSetRegionl, 'wafv2', lambda client: client.list_ip_sets(Scope='REGIONAL')['IPSets'])
+
+    @property
+    def id(self):
+        return self.instance['Id']
+
+    @property
+    def name(self):
+        return self.instance['Name']
+
+    @property
+    def lock_token(self):
+        return self.instance['LockToken']
+
+    def terminate(self):
+        self.client.delete_ip_set(Id=self.id, Name=self.name, LockToken=self.lock_token, Scope='REGIONAL')
+
+
 class InspectorAssessmentTemplate(DbTerminator):
     @staticmethod
     def create(credentials):