Skip to content

Manual Test Runbook — N3: WAF Policy Module

Owner: Sagar  |  Time: ~5 min (Parts A + B offline) · +20 min (optional Part C integration)  |  Sandbox: snowops-sandbox-01

Promotes N3 (modules/azure/waf-policy/) from 🟦 Code Complete → 🟩 Shipped. Part C (the integration test) creates a WAF policy and verifies a custom rule blocks a synthetic request, then destroys. Requires an Application Gateway WAF v2 or a pre-created Application Gateway to associate the policy.

Prerequisites

  • Sandbox subscription access active (PIM activated if required)
  • az login done; az account show confirms the sandbox subscription is selected
  • SNOWOPS_SANDBOX_SUBSCRIPTION_ID + SNOWOPS_SANDBOX_TENANT_ID exported
  • Local tooling: terraform >= 1.6, go >= 1.22, az CLI >= 2.50
  • Working directory: repo root

Steps

Part A — terraform fmt + validate (offline, ~3 min)

  1. Module + example:
terraform -chdir=modules/azure/waf-policy fmt -recursive -check
terraform -chdir=modules/azure/waf-policy init -backend=false -input=false
terraform -chdir=modules/azure/waf-policy validate

terraform -chdir=modules/azure/waf-policy/examples/basic init -backend=false -input=false
terraform -chdir=modules/azure/waf-policy/examples/basic validate

Expected: Success! The configuration is valid. for both.

  1. Offline Terratest case:
cd tests/terratest
go test -v -timeout 5m ./modules/azure/... -run TestWAFPolicyValidate

Expected: PASS.

Part B — full Terratest suite (offline, ~3 min)

  1. bash cd tests/terratest go test -count=1 -timeout 15m ./...

Expected: full offline suite green.

Part C — integration test: WAF policy apply/destroy (sandbox, ~20 min, ~$0)

Proves the WAF policy is applied and a custom IP-block rule functions. Requires an existing Application Gateway WAF v2 in the sandbox or deploying one for the test (cost ~$0.30/hr while running — destroy promptly).

  1. Apply the example:
cd modules/azure/waf-policy/examples/basic
terraform init -input=false
terraform apply -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "policy_name=snowops-n3-test-waf"

Expected: clean apply; policy_id output is a valid ARM ID.

  1. Verify the policy exists and is in Prevention mode:
az network application-gateway waf-policy show \
  -g snowops-waf-policy-example-rg \
  -n snowops-n3-test-waf \
  --query "{mode:policySettings.mode, state:policySettings.state, rules:customRules[].name}" \
  -o json

Expected: mode = "Prevention", state = "Enabled", custom rules visible.

  1. Associate the policy with an Application Gateway (optional — omit if no AppGw is available in the sandbox):
az network application-gateway waf-config set \
  -g <APPGW_RG> --gateway-name <APPGW_NAME> \
  --waf-policy /subscriptions/$SNOWOPS_SANDBOX_SUBSCRIPTION_ID/resourceGroups/snowops-waf-policy-example-rg/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/snowops-n3-test-waf

Then send a request from a blocked IP or blocked country and confirm it is denied (HTTP 403 from the WAF).

Pass criteria

  • Part A — module + example validate; TestWAFPolicyValidate passes
  • Part B — full offline Terratest suite passes
  • (Part C) WAF policy applies cleanly; custom rules visible in az output
  • (Part C) If associated with AppGw: blocked source returns HTTP 403
  • All test resources removed

Teardown

cd modules/azure/waf-policy/examples/basic
terraform destroy -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID"

Sign-off

  • Tester: _  |  Date: _  |  Result: PASS / FAIL / N/A
  • Notes: