diff --git a/terraform/main.tf b/terraform/main.tf index 2f89894..5512a4d 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -118,6 +118,7 @@ module "pypi" { edge_security_dictionary = "Edge_Security" fastly_key = var.credentials["fastly"] ngwaf_percent_enabled = 10 + datadog_token = var.datadog_token } module "test-pypi" { @@ -154,6 +155,7 @@ module "test-pypi" { edge_security_dictionary = "Edge_Security" fastly_key = var.credentials["fastly"] ngwaf_percent_enabled = 100 + datadog_token = var.datadog_token } module "file-hosting" { diff --git a/terraform/warehouse/main.tf b/terraform/warehouse/main.tf index 9890fce..88398bb 100644 --- a/terraform/warehouse/main.tf +++ b/terraform/warehouse/main.tf @@ -20,6 +20,7 @@ variable "activate_ngwaf_service" { type = bool } variable "edge_security_dictionary" { type = string } variable "fastly_key" { type = string } variable "ngwaf_percent_enabled" { type = number } +variable "datadog_token" { type = string } locals { @@ -194,6 +195,13 @@ resource "fastly_service_vcl" "pypi" { placement = "none" } + logging_datadog { + name = "Log Edge Errors" + token = var.datadog_token + response_condition = "Edge Error" + format = "{ \"ddsource\": \"fastly\", \"service\": \"%%{req.service_id}V\", \"date\": \"%%{begin:%Y-%m-%dT%H:%M:%S%z}t\", \"time_start\": \"%%{begin:%Y-%m-%dT%H:%M:%S%Z}t\", \"time_end\": \"%%{end:%Y-%m-%dT%H:%M:%S%Z}t\", \"http\": { \"request_time_ms\": %%{time.elapsed.msec}V, \"method\": \"%%m\", \"url\": \"%%{json.escape(req.url)}V\", \"useragent\": \"%%{json.escape(req.http.User-Agent)}V\", \"referer\": \"%%{json.escape(req.http.referer)}V\", \"protocol\": \"%%H\", \"request_x_forwarded_for\": \"%%{X-Forwarded-For}i\", \"status_code\": \"%%s\" }, \"network\": { \"client\": { \"ip\": \"%%h\", \"name\": \"%%{client.as.name}V\", \"number\": \"%%{client.as.number}V\", \"connection_speed\": \"%%{client.geo.conn_speed}V\" }, \"destination\": { \"ip\": \"%%A\" } }, \"geoip\": { \"geo_city\": \"%%{client.geo.city.utf8}V\", \"geo_country_code\": \"%%{client.geo.country_code}V\", \"geo_continent_code\": \"%%{client.geo.continent_code}V\", \"geo_region\": \"%%{client.geo.region}V\" }, \"bytes_written\": %%B, \"bytes_read\": %%{req.body_bytes_read}V, \"host\": \"%%{if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host)}V\", \"origin_host\": \"%%v\", \"is_ipv6\": %%{if(req.is_ipv6, \"true\", \"false\")}V, \"is_tls\": %%{if(req.is_ssl, \"true\", \"false\")}V, \"tls_client_protocol\": \"%%{json.escape(tls.client.protocol)}V\", \"tls_client_servername\": \"%%{json.escape(tls.client.servername)}V\", \"tls_client_cipher\": \"%%{json.escape(tls.client.cipher)}V\", \"tls_client_cipher_sha\": \"%%{json.escape(tls.client.ciphers_sha)}V\", \"tls_client_tlsexts_sha\": \"%%{json.escape(tls.client.tlsexts_sha)}V\", \"is_h2\": %%{if(fastly_info.is_h2, \"true\", \"false\")}V, \"is_h2_push\": %%{if(fastly_info.h2.is_push, \"true\", \"false\")}V, \"h2_stream_id\": \"%%{fastly_info.h2.stream_id}V\", \"request_accept_content\": \"%%{Accept}i\", \"request_accept_language\": \"%%{Accept-Language}i\", \"request_accept_encoding\": \"%%{Accept-Encoding}i\", \"request_accept_charset\": \"%%{Accept-Charset}i\", \"request_connection\": \"%%{Connection}i\", \"request_dnt\": \"%%{DNT}i\", \"request_forwarded\": \"%%{Forwarded}i\", \"request_via\": \"%%{Via}i\", \"request_cache_control\": \"%%{Cache-Control}i\", \"request_x_requested_with\": \"%%{X-Requested-With}i\", \"request_x_att_device_id\": \"%%{X-ATT-Device-Id}i\", \"content_type\": \"%%{Content-Type}o\", \"is_cacheable\": %%{if(fastly_info.state~\"^(HIT|MISS)$\", \"true\",\"false\")}V, \"response_age\": \"%%{Age}o\", \"response_cache_control\": \"%%{Cache-Control}o\", \"response_expires\": \"%%{Expires}o\", \"response_last_modified\": \"%%{Last-Modified}o\", \"response_tsv\": \"%%{TSV}o\", \"server_datacenter\": \"%%{server.datacenter}V\", \"req_header_size\": %%{req.header_bytes_read}V, \"resp_header_size\": %%{resp.header_bytes_written}V, \"socket_cwnd\": %%{client.socket.cwnd}V, \"socket_nexthop\": \"%%{client.socket.nexthop}V\", \"socket_tcpi_rcv_mss\": %%{client.socket.tcpi_rcv_mss}V, \"socket_tcpi_snd_mss\": %%{client.socket.tcpi_snd_mss}V, \"socket_tcpi_rtt\": %%{client.socket.tcpi_rtt}V, \"socket_tcpi_rttvar\": %%{client.socket.tcpi_rttvar}V, \"socket_tcpi_rcv_rtt\": %%{client.socket.tcpi_rcv_rtt}V, \"socket_tcpi_rcv_space\": %%{client.socket.tcpi_rcv_space}V, \"socket_tcpi_last_data_sent\": %%{client.socket.tcpi_last_data_sent}V, \"socket_tcpi_total_retrans\": %%{client.socket.tcpi_total_retrans}V, \"socket_tcpi_delta_retrans\": %%{client.socket.tcpi_delta_retrans}V, \"socket_ploss\": %%{client.socket.ploss}V }" + } + response_object { name = "Bandersnatch User-Agent prohibited" status = 403 @@ -235,6 +243,12 @@ resource "fastly_service_vcl" "pypi" { statement = "req.http.Fastly-Client-IP == \"127.0.0.1\" && req.http.Fastly-Client-IP != \"127.0.0.1\"" } + condition { + name = "Edge Error" + type = "RESPONSE" + statement = "(resp.status >= 500 && resp.status < 600)" + } + # NGWAF dynamic "dictionary" { for_each = var.activate_ngwaf_service ? [1] : []