Waf2 rule group permission policy

[issabayevmk]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

No changes to security controls.

Description

New resource aws_wafv2_rule_group_permission_policy to manage WAFv2 Rule Group permission policies, enabling cross-account sharing of rule groups.

This resource wraps the PutPermissionPolicy, GetPermissionPolicy, and DeletePermissionPolicy WAFv2 API operations. It follows the provider's IAM resource-based policy pattern (same as aws_networkfirewall_resource_policy, aws_kinesis_resource_policy, etc.) as recommended by the provider design guide.

Supports sharing with:

• Specific accounts or IAM principals
• Multiple accounts
• Entire AWS Organizations (via aws:PrincipalOrgID condition)
• Specific OUs (via aws:PrincipalOrgPaths condition)

Implemented using Terraform Plugin Framework with ARN-based resource identity.

Relations

References

• AWS WAF - Sharing a rule group
• PutPermissionPolicy API Reference
• GetPermissionPolicy API Reference
• DeletePermissionPolicy API Reference

Output from Acceptance Testing

% make testacc TESTS=TestAccWAFV2RuleGroupPermissionPolicy PKG=wafv2

...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.