(wafv2): change in CfnWebACL model validation & lack of associated documentation

❓ General Issue

I don’t think this is a bug with CDK per se. I see differing CloudFormation behavior from just one day ago having to do with aws-wafv2.

cdk deploy previously resulted in completion of stack creation but now results in error message:

Model validation failed (#: extraneous key [true] is not permitted)

I identified that this is due to how the CfnWebAcl.props.defaultAction parameter were coded. Below is an example.

              defaultAction: {
                     block: {
                         true: true,
                     }
                },

It now must be

              defaultAction: {
                     block: {}
                },

Iterating to this point was not obvious. I tried different keys and values to no avail. Attempting block: true resulted in cdk exception:

block: true should be an 'object'.

Other similar patterns are problematic such as for CfnWebAcl.props.rules.action

In addition the language-specific api documentation for most (any?) is non existent. For example, https://docs.aws.amazon.com/cdk/api/latest/typescript/api/aws-wafv2/ruleactionproperty.html results in 404. This does not help with determining correct syntax.

The Question

I guess my question is what changed and where is the resource to figure out what the correct syntax is? I was even using the same ver cdk between behavior changes so I imagine this is a CloudFormation change in behavior.

Also, was I doing something incorrect originally? I remember having to try a couple different approaches to forming an object that worked - might have even seen an example of the idiom in the issue tracker.

Environment

• CDK CLI Version: 1.74.0 (build e86602f)
• Module Version: 1.74.0
• Node.js Version: v10.22.1
• OS: Ubuntu 20.04
• Language (Version): TypeScript 3.7.5

Other information

[arjanschaaf]

Ran into this issue with a Java based CDK project as well. Fix was to use this code:

CfnWebACL.DefaultActionProperty.builder().allow(Collections.emptyMap()).build()

[Pokis]

Nah mate, tried that and similar approaches. Current solution that I am going to do is: Generate cloudformation with synth -> substitute the required part with simple string substitute -> deploy the generated file

Adjusted the place where I need to substitute with: webAcl.AddPropertyOverride(“DefaultAction.Allow”, “CHANGE_THIS_WITH_BRACKETS”); so all I have to do is substitute that keyword. If I add brackets there btw, it just parses them as string, and json must be there, so cant do that directly apparently.