aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS managed rule alb-waf-enabled does not work well with ALBs created by cloudformation stack

Open
#1,197 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::WAFv2::WebACLAssociation

### Resource name

_No response_

### Description

Hi

When I delete cloudformation stack containing an ALB associated with a WebACL, webacl association is usually removed first by DisassociateWebACL API call, while the ALB itself is removed couple minutes later because there are resources that depend on it, such as ECS service.

During those couple minutes the rule alb-waf-enabled is re-evaluated and ALB is considered non-compliant. Couple more minutes later, when ALB is finally deleted, the rule is evaluated again and non-compliant ALB disappears.

We create and delete lots of stacks during the day, and therefore we get a lot of noise from these false positive findings.

So far I have solved this issue for us by implementing a custom AWS Config rule that behaves pretty much like the managed one, but ignores non-compliant ALBs if they are part of a CF stack that is being removed. However, it would be nice if you could improve coordination between CloudFormation and Config and I could use managed rule.

Possible options that I see:
* you can skip invoking DisassociateWebACL. If ALB is about to be removed, there is seemingly no point in invoking this API
* you can invoke DisassociateWebACL right before DeleteLoadBalancer invocation

Thank you in advance!

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the AWS::WAFv2::WebACLAssociation behavior described for CloudFormation stack deletion, focusing on the timing of DisassociateWebACL and DeleteLoadBalancer. Compare the two proposed coordination options and define completion as preventing transient alb-waf-enabled false positives while the ALB is being removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.