From b69768edffb4b5b77f37cefbefa48cf61bf581ec Mon Sep 17 00:00:00 2001
From: Abigail Muller <amuller@no10.gov.uk>
Date: Thu, 5 Feb 2026 14:10:33 +0000
Subject: [PATCH 1/2] rate limiting waf rule

---
 infrastructure/modules/ui/waf.tf | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/infrastructure/modules/ui/waf.tf b/infrastructure/modules/ui/waf.tf
index 91094e7b..3ae87462 100644
--- a/infrastructure/modules/ui/waf.tf
+++ b/infrastructure/modules/ui/waf.tf
@@ -207,6 +207,27 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
     }
   }
 
+  rule {
+    name     = "RateLimitRule"
+    priority = 4
+
+    action {
+      block {}
+    }
+
+    statement {
+      rate_based_statement {
+        limit              = 5000
+        aggregate_key_type = "IP"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "RateLimitRule"
+      sampled_requests_enabled   = true
+    }
+  }
 
   visibility_config {
     cloudwatch_metrics_enabled = true

From 8d58498bb99847b0f6873fc84ac1bff50bbb9637 Mon Sep 17 00:00:00 2001
From: Abigail Muller <amuller@no10.gov.uk>
Date: Thu, 5 Feb 2026 15:31:36 +0000
Subject: [PATCH 2/2] clean up waf

---
 infrastructure/modules/ui/waf.tf | 52 ++++++++++++++++----------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/infrastructure/modules/ui/waf.tf b/infrastructure/modules/ui/waf.tf
index 3ae87462..64c86d93 100644
--- a/infrastructure/modules/ui/waf.tf
+++ b/infrastructure/modules/ui/waf.tf
@@ -18,9 +18,31 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
   }
 
   rule {
-    name     = "validate-request"
+    name     = "RateLimitRule"
     priority = 0
 
+    action {
+      block {}
+    }
+
+    statement {
+      rate_based_statement {
+        limit              = 1000
+        aggregate_key_type = "IP"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "RateLimitRule"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "validate-request"
+    priority = 1
+
     action {
       allow {}
     }
@@ -81,7 +103,7 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
 
   rule {
     name     = "validate-query"
-    priority = 1
+    priority = 2
 
     action {
       block {}
@@ -134,7 +156,7 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
 
   rule {
     name     = "validate-large-query"
-    priority = 2
+    priority = 3
 
     action {
       block {}
@@ -187,7 +209,7 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
 
   rule {
     name     = "AWS-AWSManagedRulesKnownBadInputsRuleSet"
-    priority = 3
+    priority = 4
 
     override_action {
       none {}
@@ -207,28 +229,6 @@ resource "aws_wafv2_web_acl" "rapid_acl" {
     }
   }
 
-  rule {
-    name     = "RateLimitRule"
-    priority = 4
-
-    action {
-      block {}
-    }
-
-    statement {
-      rate_based_statement {
-        limit              = 5000
-        aggregate_key_type = "IP"
-      }
-    }
-
-    visibility_config {
-      cloudwatch_metrics_enabled = true
-      metric_name                = "RateLimitRule"
-      sampled_requests_enabled   = true
-    }
-  }
-
   visibility_config {
     cloudwatch_metrics_enabled = true
     metric_name                = "${var.resource-name-prefix}-acl"