Taskfile.yml

version: '3'
#output: prefixed
env:
  SKIP_QUOTA_CHECK: true
  WAF_TEST: TRUE
  WAF_TEST_PASS_STATUS_CODES: 200 # HTTP response status code that WAF uses while passing requests (default [200,404])
  CREATE_DIAGRAM: false
  TOOL_KIT_STACKNAME: CDKToolkit
  LASTEST_FIREWALLFACTORY_VERSION:
    sh: curl --silent "https://api.github.com/repos/globaldatanet/aws-firewall-factory/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/'
vars:
  prerequisite:
  config: # without .json
  REGION:
    sh: echo $AWS_REGION
  CDK_DEFAULT_ACCOUNT:
    sh: aws sts get-caller-identity |jq -r .
tasks:
  destroy:
    desc: Destroy Stack
    cmds:
      - task: cdkdestroy
  deploy:
    desc: Deploy Stack
    cmds:
      - task: cdkdeploy
      - task: creatediagram
  synth:
    desc: synth Stack
    cmds:
      - cdk synth
    vars:
      ACCOUNT:
        sh: aws sts get-caller-identity |jq -r .Account
      TAGS:
        sh: cat tags/tags.json | jq -j '.[]|"--tags " + (.Key)+"="+(.Value)+" "'
    env:
      PROCESS_PARAMETERS: .config
  diff:
    desc: CDK Diff
    cmds:
      - bash -c 'source options.sh && cdk diff --toolkit-stack-name {{.TOOL_KIT_STACKNAME}}'
    silent: true
    interactive: true
    env:
      PROCESS_PARAMETERS: "{{.config}}"
      PREREQUISITE: "{{.prerequisite}}"
  cdkdestroy:
    desc: CDK Destroy
    cmds:
      - bash -c 'source options.sh && cdk destroy --force'
    vars:
      ACCOUNT:
        sh: aws sts get-caller-identity |jq -r .Account
    env:
      PROCESS_PARAMETERS: "{{.config}}"
      PREREQUISITE: "{{.prerequisite}}"
    silent: true
    interactive: true
  cdkdeploy:
    desc: CDK Deploy
    cmds:
      - bash -c 'source options.sh && cdk deploy --require-approval never {{.TAGS}} --toolkit-stack-name {{.TOOL_KIT_STACKNAME}}'
    vars:
      ACCOUNT:
        sh: aws sts get-caller-identity |jq -r .Account
      TAGS:
        sh: cat tags/tags.json | jq -j '.[]|"--tags " + (.Key)+"="+(.Value)+" "'
    env:
      PROCESS_PARAMETERS: "{{.config}}"
      PREREQUISITE: "{{.prerequisite}}"
    silent: true
    interactive: true
  creatediagram:
    desc: Create Diagram
    cmds:
      - if [[ {{.CREATE_DIAGRAM}} = true ]] ; then echo 🤳🏻 $(cfn-dia draw.io -t cdk.out/"$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Prefix')-WAF-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.WebAcl.Name')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Stage')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.DeployHash')".template.json --output-file $(sed "s/values/diagrams/g;s/.json/.drawio/g" <<< values/{{.config}}.json) --ci-mode --skip-synth); else echo ⏭   Skipping Diagram generation 🤳🏻 ; fi
    silent: true
    env:
      PROCESS_PARAMETERS: values/{{.config}}.json
  testwaf:
    desc: Test of your waf using GoTestWAF
    cmds:
      - echo 🧪  Testing of your new 🔥 WAF using GoTestWAF
      - mkdir -p ./waf-evaluation-report/$(date '+%Y-%m-%d')
      - |
        items=$(ts-node ./gotestwaf/gotestwaf.ts | jq -r '.[] | .SecuredDomain[]?')
        for item in ${items[@]}; do
            echo "Using fqdn in 🖥  url : $item"
            ./gotestwaf/gotestwaf --url https://$item --workers 50 --blockConnReset  --wafName="$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Prefix')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.WebAcl.Name')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Stage')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.DeployHash')" --configPath=./gotestwaf/config.yaml --testCasesPath=./gotestwaf/testcases --skipWAFBlockCheck --reportPath "./waf-evaluation-report/$(date '+%Y-%m-%d')" --reportName "$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Prefix')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.WebAcl.Name')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.Stage')-$(ts-node ./gotestwaf/gotestwaf.ts| jq -r '.General.DeployHash')-$item" --passStatusCodes {{.WAF_TEST_PASS_STATUS_CODES}} --blockConnReset
        done
    silent: true
    env:
      PROCESS_PARAMETERS: "{{.config}}"
    preconditions:
      - sh: "[ '{{.WAF_TEST}}' != 'true' ]"
        msg: ⏭  Skipping WAF Testing 🧪
  generate-waf-skeleton:
    desc: Generate WAF Skeleton
    silent: true
    cmds:
      - ts-node ./lib/tools/generate-waf-skeleton.ts
  generate-shield-skeleton:
    desc: Generate Shield Skeleton
    silent: true
    cmds:
      - ts-node ./lib/tools/generate-shield-skeleton.ts