PLT-503: Add test and sandbox environments to DPC WAF plan and apply

[gfreeman-navapbc]

🎫 Ticket

https://jira.cms.gov/browse/PLT-503

🛠 Changes

Adds test and sbx environments to the DPC WAF configuration

ℹ️ Context

These are changes made as a part of the overall WAF migration work.

🧪 Validation

Once this is applied, we should see the Web ACL configurations show up with the placeholder IP sets. We'll need to manually update them in AWS, and then reapply once we remove the association with the security group on ingress.

[ildesenesence]

Curious what impact our engineers should actually see with this - seems like this is just setting up the skeleton for rules to be capable of being applied, but isn't actually applying rules? I haven't followed this all the way back to the current WAF configuration to verify that.

[gsf]

The api-waf service will need to be updated to not create and associate IP sets on sandbox.

[gfreeman-navapbc]

Curious what impact our engineers should actually see with this - seems like this is just setting up the skeleton for rules to be capable of being applied, but isn't actually applying rules? I haven't followed this all the way back to the current WAF configuration to verify that.

See https://github.com/CMSgov/ab2d-bcda-dpc-platform/tree/main/terraform/modules/firewall
and https://github.com/CMSgov/ab2d-bcda-dpc-platform/tree/main/terraform/services/api-waf

@ildesenesence