Waf, Waf-v2, Waf-regional documentation

Hey guys, there is a lack of documentation regarding Waf - see #7925. But I could create a working example with api-gateway. Maybe you wanna add it to your docs?

import * as apigateway from "@aws-cdk/aws-apigateway";
import * as wafv2 from "@aws-cdk/aws-wafv2";
import * as cdk from "@aws-cdk/core";

export class WafStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const testApi = new apigateway.RestApi(this, "Test-API", {
      endpointConfiguration: {
        types: [apigateway.EndpointType.REGIONAL],
      },
    });
    testApi.root.addMethod("GET", new apigateway.MockIntegration());

    // @ts-ignore
    const webAcl = new wafv2.CfnWebACL(this, "WebAcl", {
      defaultAction: { allow: {} },
      rules: [
        {
          priority: 1,
          overrideAction: { none: {} },
          visibilityConfig: {
            sampledRequestsEnabled: true,
            cloudWatchMetricsEnabled: true,
            metricName: "AWS-AWSManagedRulesAmazonIpReputationList",
          },
          name: "AWS-AWSManagedRulesAmazonIpReputationList",
          statement: {
            managedRuleGroupStatement: {
              vendorName: "AWS",
              name: "AWSManagedRulesAmazonIpReputationList",
            },
          },
        },
        {
          priority: 2,
          overrideAction: { none: {} },
          visibilityConfig: {
            sampledRequestsEnabled: true,
            cloudWatchMetricsEnabled: true,
            metricName: "AWS-AWSManagedRulesCommonRuleSet",
          },
          name: "AWS-AWSManagedRulesCommonRuleSet",
          statement: {
            managedRuleGroupStatement: {
              vendorName: "AWS",
              name: "AWSManagedRulesCommonRuleSet",
            },
          },
        },
        {
          priority: 3,
          overrideAction: { none: {} },
          visibilityConfig: {
            sampledRequestsEnabled: true,
            cloudWatchMetricsEnabled: true,
            metricName: "AWS-AWSManagedRulesKnownBadInputsRuleSet",
          },
          name: "AWS-AWSManagedRulesKnownBadInputsRuleSet",
          statement: {
            managedRuleGroupStatement: {
              vendorName: "AWS",
              name: "AWSManagedRulesKnownBadInputsRuleSet",
            },
          },
        },
      ],
      scope: "REGIONAL",
      visibilityConfig: {
        sampledRequestsEnabled: true,
        cloudWatchMetricsEnabled: true,
        metricName: "web-acl",
      },
    });

    // Output of 'testApi.arnForExecuteApi(...)': 'arn:aws:execute-api:region:accout-id:api-id/*/*/*'
    // For webAcls we need the following pattern: 'arn:aws:apigateway:region::/restapis/api-id/stages/stage-name'
    // See here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.html#cfn-wafv2-webaclassociation-resourcearn
    const region = cdk.Stack.of(this).region;
    const arn = `arn:aws:apigateway:${region}::/restapis/${testApi.restApiId}/stages/${testApi.deploymentStage.stageName}`;

    // @ts-ignore
    new wafv2.CfnWebACLAssociation(this, "WebAclAssociation", {
      webAclArn: webAcl.attrArn,
      resourceArn: arn,
    });
  }
}

const app = new cdk.App();
new WafStack(app, "Waf-Stack");

[rix0rrr]

Thanks for the example!

An unfortunate truth is that we don’t have time to spend on WAF right now, and even though it might sound that any example is better than no example, we also cannot readily accept your code for multiple reasons:

• We have to vet and maintain it.
• We generally don’t write examples and documentation for L1 classes, as they are “just CloudFormation”, and we don’t want to encourage people writing those.

I would heartily recommend that you get this content out there and publish this content under your own name to your own platforms: maybe to a blog, maybe to a GitHub repository or a Gist. But we can’t accept it into the upstream repository or docs, however silly that may sound.

Cheers!

[bpcrao]

thanks to @Syy0n

this really saved me a ton of time , I spent 6 hrs wasting on this issue thanks again for this one

I really feel AWS has poor examples on WAF - APIGW association and for some reason

This works

  const arn = `arn:aws:apigateway:${region}::/restapis/${this.appGateway.restApiId}/stages/${this.appAPIGateway.deploymentStage.stageName}`;
            console.log(arn);
            new wafv2.CfnWebACLAssociation(this, "WebAclAssociation", {
              webAclArn: props.regionalACLARN,
              resourceArn: arn,
            });

This did not work

new wafv2.CfnWebACLAssociation(this, 'WebAclAssociation', {
          webAclArn: props.regionalACLARN,
          resourceArn: `arn:aws:apigateway:${region}::/restapis/${this.appGateway.restApiId}/stages/${this.appAPIGateway.deploymentStage.stageName}`
        })