aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Support for AWSManagedRulesBotControlRuleSet under ManagedRuleGroupConfig

Open
#1,427 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::WAFv2::WebACL

### Resource name

ManagedRuleGroupConfig

### Description

Using `UpdateWebACL` API call we can set `AWSManagedRulesBotControlRuleSet` under Managed Rule Group Configs as below

```
"ManagedRuleGroupConfigs": [
{
"AWSManagedRulesBotControlRuleSet": {
"InspectionLevel": "string"
},
"LoginPath": "string",
"PasswordField": {
"Identifier": "string"
},
"PayloadType": "string",
"UsernameField": {
"Identifier": "string"
}
}
]
```
However, If we use the same definition in CloudFormation stack and perform a stack update for `AWS::WAFv2::WebACL` resource we would get ***InvalidReqeust*** error

```
Resource handler returned message: "Model validation failed (#: extraneous key [AWSManagedRulesBotControlRuleSet] is not permitted)" (
```
because CloudFormation supports only below attributes in the syntax for `ManagedRuleGroupConfig` under `ManagedRuleGroupStatement`
```
{
"LoginPath" : String,
"PasswordField" : FieldIdentifier,
"PayloadType" : String,
"UsernameField" : FieldIdentifier
}

```
- AWS::WAFv2::WebACL ManagedRuleGroupConfig - [CloudFormation document link](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-managedrulegroupconfig.html)

- The cloudformation template used while testing this behavior

```
Resources:
ExampleWebACL:
Type: 'AWS::WAFv2::WebACL'
Properties:
Name: mywebacl
Scope: REGIONAL
Description: testing
DefaultAction:
Allow: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: ExampleWebACLMetric
Rules:
- Name: AWS-AWSManagedRulesBotControlRuleSet
Priority: 1
OverrideAction:
None: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: TestMetric
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesBotControlRuleSet
ManagedRuleGroupConfigs:
- AWSManagedRulesBotControlRuleSet:
InspectionLevel: COMMON
```

**ASK**
- It would be helpful If we can set the property `AWSManagedRulesBotControlRuleSet` under Managed Rule Group Config

### Other Details

https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateWebACL.html

Contributor guide

Open the contributing guide

Research direction

Start by comparing the AWS::WAFv2::WebACL ManagedRuleGroupConfig CloudFormation documentation with the UpdateWebACL API example and the supplied template. Done means the AWSManagedRulesBotControlRuleSet property with InspectionLevel is accepted under ManagedRuleGroupConfigs and no longer produces the extraneous-key validation error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.