DFR-4794: Test old div PFE for WAF updates

[joe-wilko-hmcts]

https://tools.hmcts.net/jira/browse/DFR-4794

Change description

This PR updates the configuration in AAT to align with the recent prod.tfvars changes for div-pfe WAF config.

Testing done

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• Does this PR introduce a breaking change

Link to Terraform Plan

https://tfplan-viewer.hmcts.net/azure-platform-terraform/2850

🤖AEP PR SUMMARY🤖

• environments/stg/stg.tfvars
  🆕 Added multiple new frontend IDs to the existing frontends list, expanding the targets for configuration.
  🔍 Introduced new request matching criteria including:
  • Several RequestCookieNames matchers for cookies like "nfdiv-cookie-preferences", "dtCookie", and "nfdiv-session".
  • New QueryStringArgNames matchers including "lng", "code", and "client_id".
  • Extended RequestBodyPostArgNames matchers that now include various uploaded files parameters related to applicants and clarifications (e.g. "applicant1UploadedFiles", "applicant2UploadedFiles", "coClarificationUploadedFiles", and others).
    These additions enhance filtering or routing rules based on cookies, query parameters, and POST body arguments.

[github-actions]

Review of Changes and Suggestions for Improvement

Code Quality & Best Practices

1. Repeated Patterns: The match_variable, operator, and selector structure is repeated. Consider using a loop or a consolidated structure to improve maintainability and reduce redundancy.

   • Example:
     hcl
     match_variable_entries = [
     { match_variable = "RequestCookieNames", operator = "Equals", selector = "nfdiv-cookie-preferences" },
     { match_variable = "RequestCookieNames", operator = "Equals", selector = "dtCookie" },
     ...
     ]

     for_each = match_variable_entries
     resource "xyz" {
     match_variable = each.value.match_variable
     operator = each.value.operator
     selector = each.value.selector
     }

2. Consistent Ordering: Ensure attributes like match_variable are consistently alphabetized or grouped logically to make future diffs easier to review.

3. Use Named Descriptions: Add comments or descriptions about why specific rules are needed. This will help future maintainers understand the broader context of these configurations.

---

Security Considerations

4. Sensitive Match Patterns: Some selectors like code, client_id, and RequestBodyPostArgNames (e.g., uploadedFiles) may suggest sensitive data. Ensure proper controls in downstream systems to sanitize these inputs.
   • Validate that no unintended sensitive data is being exposed or logged during processing.

---

Cost and Carbon Usage

5. Resource Optimization: This file likely influences system rules. Evaluate if combining some patterns (e.g., using StartsWith instead of Equals for cookie prefixes) could reduce operational overhead.
   • Example:

     { match_variable = \"RequestCookieNames\", operator = \"StartsWith\", selector = \"nfdiv-\" }

   • Benefits: Fewer system rules could translate into lower processing costs and reduced CPU cycles, indirectly impacting energy usage and costs.

---

Suggested Action Items

• Refactor repetitive blocks: Explore a for_each or similar iterative structure.
• Add comments: Describe the purpose of new selectors.
• Audit sensitive fields: Ensure fields like client_id and uploaded file references are necessary and protected.
• Optimize matching: Use broader match patterns (e.g., StartsWith) where appropriate to minimize rule duplication.

[hmcts-platform-operations]

Tip

✅ master branch build is now passing!

Build: #apply - Azure Platform

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[hmcts-platform-operations]

Tip

✅ master branch build is now passing!

Build: #apply - Azure Platform