Merge pull request #2758 from DFE-Digital/2345-add-rate-limiting-for-services

Add ingress rate limit

Author: RMcVelia

.gitignore

@@ -28,3 +28,4 @@ bin/konduit.sh
 .terraform
 terraform/*token*
 terraform/*/vendor
+terraform/domains/*/vendor/

terraform/domains/environment_domains/config/production.tfvars.json

@@ -2,5 +2,16 @@
   "domains": ["www", "apex"],
   "environment_short": "pd",
   "environment_tag": "Prod",
-  "origin_hostname": "apply-for-qts-production-web.teacherservices.cloud"
+  "origin_hostname": "apply-for-qts-production-web.teacherservices.cloud",
+  "rate_limit": [
+    {
+      "agent": "all",
+      "priority": 100,
+      "duration": 5,
+      "limit": 300,
+      "selector": "Host",
+      "operator": "GreaterThanOrEqual",
+      "match_values": "0"
+    }
+  ]
 }

terraform/domains/environment_domains/main.tf

@@ -6,6 +6,7 @@ module "domains" {
   domains             = var.domains
   environment         = var.environment_short
   host_name           = var.origin_hostname
+  rate_limit          = try(var.rate_limit, null)
 }
 
 data "azurerm_cdn_frontdoor_profile" "main" {

terraform/domains/environment_domains/variables.tf

@@ -35,6 +35,19 @@ variable "origin_hostname" {
   description = "Origin endpoint url"
 }
 
+variable "rate_limit" {
+  type = list(object({
+    agent        = optional(string)
+    priority     = optional(number)
+    duration     = optional(number)
+    limit        = optional(number)
+    selector     = optional(string)
+    operator     = optional(string)
+    match_values = optional(string)
+  }))
+  default = null
+}
+
 locals {
   hostname = "${var.domains[0]}.${var.zone}"
 }