[apigateway] Support WebAclArn for an API Gateway stage

• I’m submitting a …

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?

• I am unable to find the option to set the webACl of a stage of an api-gateway

• What is the expected behavior (or behavior of feature suggested)?

• I am able to set the webAcl of a stage of an api-gateway

• What is the motivation / use case for changing the behavior or adding this feature?

• It is important to be able to set the web acl of an api-gateway

• Please tell us about your environment:

  • CDK CLI Version: 0.30.0
  • Module Version: 0.30.0
  • OS: OSX Mojave
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

I cannot seem to find the option to set the webAcl through aws-cdk of a stage of an api-gateway. This is how it looks like in the aws apigateway console I’ve looked through these files. https://github.com/aws/aws-cdk/blob/4a0272db5eb9aae5f440bb0813fdbad6514b60c3/packages/%40aws-cdk/aws-apigateway/lib/stage.ts My current relevant code:

new apigateway.LambdaRestApi(this, `${name}-LambdaRpcGateway`, {
      handler: lambdaFunc,
    });

[ozeebee]

Hi, just adding this just in case someone comes across this thread:

If you use WAFv2, don’t try to use wafregional’s CfnWebACLAssociation as proposed above: this won’t work. You have to use wafv2 equivalent:

import { CfnWebACLAssociation } from '@aws-cdk/aws-wafv2'
...
new CfnWebACLAssociation(this, 'WebACLAssoc', {
  webAclArn: props.webACLArn,
  resourceArn: `arn:aws:apigateway:eu-west-1::/restapis/${props.restApiId}/stages/${stageName}`
})
...

This did the job for me. Hope this can save some time to other ppl 😉

[nija-at]

Apolgies for the delayed response.

@seanyu4296 - Don’t try to process any generated tokens in your cdk code. Use it as if it returned the resolved value (in this case, the restApiId).

cdk’s synthesis will automatically detect tokens embedded within strings and resolve them.

You should be able to simply do

new wafR.CfnWebACLAssociation(this, 'WAFFirewall', {
      webAclId: 'some-id-here',
      resourceArn: `arn:aws:apigateway:ap-southeast-1::/restapis/${gateway.restApiId}/stages/prod`,
    });

Can you do this and check the output template that you can find in the cdk.out/ folder? The resourceArn attribute should be set as expected.