add wafv2 permissions

aws/policy/security-services.yaml

@@ -27,6 +27,40 @@ Statement:
     Resource:
       - 'arn:aws:iam::{{ aws_account_id }}:role/ansible_lambda_role'
 
+  - Sid: AllowRegionalRestrictedResourceActionsWhichIncurFees
+    Effect: Allow
+    Action:
+      - wafv2:ListRuleGroups
+      - wafv2:ListWebACLs
+      - wafv2:AssociateWebACL
+      - wafv2:DeleteRuleGroup
+      - wafv2:CreateRuleGroup
+      - wafv2:PutFirewallManagerRuleGroups
+      - wafv2:GetWebACLForResource
+      - wafv2:GetLoggingConfiguration
+      - wafv2:DeleteWebACL
+      - wafv2:GetRateBasedStatementManagedKeys
+      - wafv2:ListLoggingConfigurations
+      - wafv2:GetIPSet
+      - wafv2:CreateWebACL
+      - wafv2:ListIPSets
+      - wafv2:GetWebACL
+      - wafv2:GetRuleGroup
+      - wafv2:CreateIPSet
+      - wafv2:ListAvailableManagedRuleGroups
+      - wafv2:DeleteIPSet
+      - wafv2:DescribeManagedRuleGroup
+      - wafv2:CheckCapacity
+      - wafv2:ListResourcesForWebACL
+      - wafv2:DeleteLoggingConfiguration
+      - wafv2:PutLoggingConfiguration
+      - wafv2:DisassociateWebACL
+      - wafv2:UpdateWebACL
+      - wafv2:UpdateRuleGroup
+      - wafv2:DeleteFirewallManagerRuleGroups
+      - wafv2:DisassociateFirewallManager
+      - wafv2:UpdateIPSet
+
   - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
     Effect: Allow
     Action:

aws/terminator/security_services.py

@@ -265,6 +265,77 @@ def terminate(self):
         self.client.delete_regex_pattern_set(RegexPatternSetId=self.id, ChangeToken=self.change_token)
 
 
+class WafV2(DbTerminator):
+    @property
+    def id(self):
+        return self.instance['Id']
+
+    @property
+    def name(self):
+        return self.instance['Name']
+
+    @property
+    def lock_token(self):
+        return self.instance['LockToken']
+
+    @property
+    def scope(self):
+        return self.instance['Scope']
+
+    @abc.abstractmethod
+    def terminate(self):
+        """Terminate or delete the AWS resource."""
+
+
+class WafV2IpSet(WafV2):
+    @staticmethod
+    def create(credentials):
+        regional = DbTerminator._create(credentials, WafV2IpSet, 'wafv2', lambda client: client.list_ip_sets(Scope='REGIONAL')['IPSets'])
+        for item in regional:
+            item.update({"Scope": "REGIONAL"})
+
+        cloudfront = DbTerminator._create(credentials, WafV2IpSet, 'wafv2', lambda client: client.list_ip_sets(Scope='CLOUDFRONT')['IPSets'])
+        for item in cloudfront:
+            item.update({"Scope": "CLOUDFRONT"})
+
+        return regional + cloudfront
+
+    def terminate(self):
+        self.client.delete_ip_set(Id=self.id, Name=self.name, LockToken=self.lock_token, Scope=self.scope)
+
+
+class WafV2RuleGroup(WafV2):
+    @staticmethod
+    def create(credentials):
+        regional = DbTerminator._create(credentials, WafV2RuleGroup, 'wafv2', lambda client: client.list_rule_groups(Scope='REGIONAL')['RuleGroups'])
+        for item in regional:
+            item.update({"Scope": "REGIONAL"})
+
+        cloudfront = DbTerminator._create(credentials, WafV2RuleGroup, 'wafv2', lambda client: client.list_rule_groups(Scope='CLOUDFRONT')['RuleGroups'])
+        for item in cloudfront:
+            item.update({"Scope": "CLOUDFRONT"})
+        return regional + cloudfront
+
+    def terminate(self):
+        self.client.delete_rule_group(Id=self.id, Name=self.name, LockToken=self.lock_token, Scope=self.scope)
+
+
+class WafV2WebAcl(WafV2):
+    @staticmethod
+    def create(credentials):
+        regional = DbTerminator._create(credentials, WafV2WebAcl, 'wafv2', lambda client: client.list_web_acls(Scope='REGIONAL')['WebACLs'])
+        for item in regional:
+            item.update({"Scope": "REGIONAL"})
+
+        cloudfront = DbTerminator._create(credentials, WafV2WebAcl, 'wafv2', lambda client: client.list_web_acls(Scope='CLOUDFRONT')['WebACLs'])
+        for item in cloudfront:
+            item.update({"Scope": "CLOUDFRONT"})
+        return regional + cloudfront
+
+    def terminate(self):
+        self.client.delete_web_acl(Id=self.id, Name=self.name, LockToken=self.lock_token, Scope=self.scope)
+
+
 class InspectorAssessmentTemplate(DbTerminator):
     @staticmethod
     def create(credentials):