wafv2: CfnWebACL Rules property has incorrect CloudFormation schema

link to reference doc page: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-wafv2.CfnWebACL.html

I tried instantiating a simple WAF ACL with the following code:

    const acl = new waf.CfnWebACL(this, 'ACL', {
      defaultAction: {
        allow: true,
      },
      scope: 'CLOUDFRONT',
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: 'waf', // TODO add a stage suffix
        sampledRequestsEnabled: false,
      },
      rules: {
        rules: [
          { name: 'AWS-AWSManagedRulesAmazonIpReputationList' },
          { name: 'AWS-AWSManagedRulesCommonRuleSet' },
          { name: 'AWS-AWSManagedRulesKnownBadInputsRuleSet' },
          { name: 'AWS-AWSManagedRulesSQLiRuleSet' },
          { name: 'AWS-AWSManagedRulesLinuxRuleSet' },
        ],
      },
    });

The code compiles but cdk deploy fails with an ACL Internal Failure that doesn’t provide any helpful context.

Can you update the document with a working starter example?

---

This is a 📕 documentation issue

[tmo-trustpilot]

@RachelleJanssen A good catch, and thank you for the comment, but sadly it’s still giving the same error even after I fixed that. Let me know if you figure out anything else that looks off. Thanks!

I’ve discovered you get the error “Your statement has multiple values set for a field that requires exactly one value., field: RULE, parameter: Rule” is returned if you are missing the OverrideAction on the ManagedRuleGroupStatement. The field is needed even if you don’t want to override it, you specify “none” as per the docs.

OverrideAction:
  None: {}

Clearly a CF issue because the cdk types can’t enforce this the way they are, but this GH Issue is the main result when searching for that error message so hopefully this helps someone.

[ralovely]

Given this page is the first (and only, really) coming up in Google for the error

Your statement has multiple values set for a field that requires exactly one value., field: RULE, parameter: Rule"

I would add to @tmo-trustpilot 's comment above:

• You need to specify overrideAction and
• You need to not specify action

Hope this helps someone.