CCD-5347: PI33 Enabling Prevention mode in Front Door WAF

[kiran-yenigala-hmcts]

Jira link

See PROJ-XXXXXX

Change description

Testing done

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• Does this PR introduce a breaking change

Link to Terraform Plan

https://tfplan-viewer.hmcts.net/azure-platform-terraform/2633

🤖AEP PR SUMMARY🤖

• ithc.tfvars:
  • Changed the mode from "Detection" to "Prevention" for the "return-case-doc-ccd" frontend.
• prod.tfvars:
  • Changed the mode from "Detection" to "Prevention" for the "return-case-doc-ccd" frontend.
• stg.tfvars:
  • Changed the mode from "Detection" to "Prevention" for the "return-case-doc-ccd" frontend.
• test.tfvars:
  • Changed the mode from "Detection" to "Prevention" for the "return-case-doc-ccd" frontend.

[github-actions]

Code Quality

1. Consistency in Naming Conventions: Ensure that the naming pattern for keys and values in tfvars files is consistent. For example, some custom domains contain "ccd" while others don't (return-case-doc.ccd vs return-case-doc-ccd). If this is intentional, document why this inconsistency exists.

2. Key Sorting: For readability and ease of maintenance, consider sorting the attributes alphabetically within each block. This reduces cognitive load when finding keys.

---

Security

1. Mode Change Impact: The change from Detection to Prevention can have significant implications in production and non-production environments. Ensure the deployment is tested rigorously to avoid unintended service disruptions. Consider adding a comment or documentation to highlight why Prevention is necessary.

2. Environment-Specific Backend Domains: Ensure the backend domains specified are correctly scoped and tested for every environment (firewall-nonprodi-palo-cftithc in ITHC, firewall-prod-int-palo-cftprod in prod, etc.). Any misconfiguration could lead to traffic misdirection or service breaks.

---

Best Practice

1. Modularization: If the frontend configurations are repetitive apart from some specific values (like dns_zone_name, backend_domain), consider modularizing them to improve maintainability. For example:
   hcl
   frontend_template = {
   mode = "Prevention"
   custom_domain = var.custom_domain
   dns_zone_name = var.dns_zone_name
   backend_domain = var.backend_domain
   }

   Then, pass specific values via variables.
   
   

2. Comments: Add comments describing the context or impact of the mode change. For instance, why is Prevention mode necessary now? This adds clarity for future maintenance.

3. Validation: If Terraform supports validation rules in your codebase (via variables blocks), consider adding constraints to validate mode values to only allow valid strings (Detection or Prevention) to reduce future errors.

---

Cost and Carbon Usage

1. Backend Domain Usage: Review the backend domain(s) for cost efficiency in Azure. If the resources backing these domains (e.g., Palo Alto firewalls) are over-provisioned for any environment (especially non-prod), consider optimizing the infrastructure for cost and sustainability.

2. Terraform Plan Audit: The Prevention mode in production may introduce additional operational complexity for the firewall (e.g., inspecting all traffic, blocking malicious requests). Ensure this mode doesn’t lead to unexpected cost spikes due to scaling or resource allocation on Azure.

---

Suggestions Summary

• Ensure naming conventions are consistent, or document deviations.
• Sort keys alphabetically to enhance readability.
• Test thoroughly before enabling Prevention mode.
• Modularize repetitive configurations for maintainability.
• Add validation rules and comments for clarity.
• Audit infrastructure provisioning costs tied to backend domains.

These improvements help maintain quality, comprehensibility, security, and sustainability.