From a34bc121986a2388df08de9d37a192bac0b772db Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Fri, 7 Aug 2026 16:16:04 -0400
Subject: [PATCH] feat(infra): associate shared prod CloudFront WAF with site
 distribution

Read /seahaven/waf/app-web-acl-arn and set web_acl_id so the marketing
site sits behind the same-account M-17 WebACL.
---
 terraform/cloudfront.tf | 8 ++++++++
 terraform/outputs.tf    | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/terraform/cloudfront.tf b/terraform/cloudfront.tf
index e507ddd..2f18033 100644
--- a/terraform/cloudfront.tf
+++ b/terraform/cloudfront.tf
@@ -6,6 +6,13 @@ resource "aws_cloudfront_origin_access_control" "site" {
   signing_protocol                  = "sigv4"
 }
 
+# Shared CloudFront WAF (M-17) published by org-baseline stack seahaven-app-web-acl
+# in this account (PLAT-92). aws_cloudfront_distribution.web_acl_id takes the
+# WAFv2 ARN despite the attribute name.
+data "aws_ssm_parameter" "app_web_acl_arn" {
+  name = "/seahaven/waf/app-web-acl-arn"
+}
+
 resource "aws_cloudfront_distribution" "site" {
   enabled             = true
   is_ipv6_enabled     = true
@@ -14,6 +21,7 @@ resource "aws_cloudfront_distribution" "site" {
   price_class         = "PriceClass_100"
   http_version        = "http2and3"
   aliases             = var.attach_apex_alias ? [var.domain_name] : []
+  web_acl_id          = data.aws_ssm_parameter.app_web_acl_arn.value
 
   origin {
     domain_name              = aws_s3_bucket.origin.bucket_regional_domain_name
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
index 4bd075d..0668e69 100644
--- a/terraform/outputs.tf
+++ b/terraform/outputs.tf
@@ -13,6 +13,11 @@ output "cloudfront_domain_name" {
   value       = aws_cloudfront_distribution.site.domain_name
 }
 
+output "cloudfront_web_acl_id" {
+  description = "WAFv2 WebACL ARN associated with the distribution (SSM /seahaven/waf/app-web-acl-arn)"
+  value       = aws_cloudfront_distribution.site.web_acl_id
+}
+
 output "github_deploy_role_arn" {
   description = "OIDC role ARN for GitHub Actions content deploy"
   value       = aws_iam_role.github_deploy.arn