aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS managed rule alb-waf-enabled does not work well with ALBs created by cloudformation stack
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::WAFv2::WebACLAssociation
### Resource name
_No response_
### Description
Hi
When I delete cloudformation stack containing an ALB associated with a WebACL, webacl association is usually removed first by DisassociateWebACL API call, while the ALB itself is removed couple minutes later because there are resources that depend on it, such as ECS service.
During those couple minutes the rule alb-waf-enabled is re-evaluated and ALB is considered non-compliant. Couple more minutes later, when ALB is finally deleted, the rule is evaluated again and non-compliant ALB disappears.
We create and delete lots of stacks during the day, and therefore we get a lot of noise from these false positive findings.
So far I have solved this issue for us by implementing a custom AWS Config rule that behaves pretty much like the managed one, but ignores non-compliant ALBs if they are part of a CF stack that is being removed. However, it would be nice if you could improve coordination between CloudFormation and Config and I could use managed rule.
Possible options that I see:
* you can skip invoking DisassociateWebACL. If ALB is about to be removed, there is seemingly no point in invoking this API
* you can invoke DisassociateWebACL right before DeleteLoadBalancer invocation
Thank you in advance!
### Other Details
_No response_
Contributor guide
Research direction
Start by reviewing the AWS::WAFv2::WebACLAssociation behavior described for CloudFormation stack deletion, focusing on the timing of DisassociateWebACL and DeleteLoadBalancer. Compare the two proposed coordination options and define completion as preventing transient alb-waf-enabled false positives while the ALB is being removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100