aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Support for AWSManagedRulesBotControlRuleSet under ManagedRuleGroupConfig
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::WAFv2::WebACL
### Resource name
ManagedRuleGroupConfig
### Description
Using `UpdateWebACL` API call we can set `AWSManagedRulesBotControlRuleSet` under Managed Rule Group Configs as below
```
"ManagedRuleGroupConfigs": [
{
"AWSManagedRulesBotControlRuleSet": {
"InspectionLevel": "string"
},
"LoginPath": "string",
"PasswordField": {
"Identifier": "string"
},
"PayloadType": "string",
"UsernameField": {
"Identifier": "string"
}
}
]
```
However, If we use the same definition in CloudFormation stack and perform a stack update for `AWS::WAFv2::WebACL` resource we would get ***InvalidReqeust*** error
```
Resource handler returned message: "Model validation failed (#: extraneous key [AWSManagedRulesBotControlRuleSet] is not permitted)" (
```
because CloudFormation supports only below attributes in the syntax for `ManagedRuleGroupConfig` under `ManagedRuleGroupStatement`
```
{
"LoginPath" : String,
"PasswordField" : FieldIdentifier,
"PayloadType" : String,
"UsernameField" : FieldIdentifier
}
```
- AWS::WAFv2::WebACL ManagedRuleGroupConfig - [CloudFormation document link](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-managedrulegroupconfig.html)
- The cloudformation template used while testing this behavior
```
Resources:
ExampleWebACL:
Type: 'AWS::WAFv2::WebACL'
Properties:
Name: mywebacl
Scope: REGIONAL
Description: testing
DefaultAction:
Allow: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: ExampleWebACLMetric
Rules:
- Name: AWS-AWSManagedRulesBotControlRuleSet
Priority: 1
OverrideAction:
None: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: TestMetric
Statement:
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesBotControlRuleSet
ManagedRuleGroupConfigs:
- AWSManagedRulesBotControlRuleSet:
InspectionLevel: COMMON
```
**ASK**
- It would be helpful If we can set the property `AWSManagedRulesBotControlRuleSet` under Managed Rule Group Config
### Other Details
https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateWebACL.html
Contributor guide
Research direction
Start by comparing the AWS::WAFv2::WebACL ManagedRuleGroupConfig CloudFormation documentation with the UpdateWebACL API example and the supplied template. Done means the AWSManagedRulesBotControlRuleSet property with InspectionLevel is accepted under ManagedRuleGroupConfigs and no longer produces the extraneous-key validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100