(wafv2): add WebACL L2 Construct
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Description
Now, @aws-cdk/aws-wafv2 has no L2 Construct. I will implements L2 Constructs.
### Use Case
When users create WebACL, this Cunstruct will support it.
### Proposed Solution
We can create L2 constructs for aws-wafv2.
### Other information
_No response_
### Acknowledge
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### Design
ref: [cloudformation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html)
#### Usage
##### Define WebACL
```ts
import * as wafv2 from 'aws-cdk-lib/aws-wafv2'
import * as wafv2Statement from 'aws-cdk-lib/aws-wafv2-statement'
const webAcl = new wafv2.WebACL(this, "WebACL", {
scope: wafv2.Scope.REGIONAL,
defaultAction: wafv2.DefaultAction.block(),
rules: [
{
name: "IPSetAllow",
action: wafv2.RuleAction.allow(),
statement: new wafv2Statement.IPSetReferenceStatement(ipSet),
},
{
name: "OWASP",
overrideAction: wafv2.OverrideAction.count(),
statement: wafv2Statement.ManagedRuleGroupStatement.awsCommon(),
},
],
});
```
> Note: `visibilityConfig` have default value.
> If `WebACLProps.visibilityConfig` is set, Rules inherit it.
> Note: `wafv2Statement.ManagedRuleGroupStatement.awsCommon()` will be Enum like pattern.
##### Associate to other resources
```ts
webAcl.attachTo(target);
```
and if associate to CloudFront as following:
```ts
new cloudfront.Distribution(this, 'distribution', {
webAcl: webAcl,
})
```
#### class diagram
##### WebACL
```mermaid
classDiagram
WebACL ..> WebACLProps
WebACLProps o.. CustomResponseBody
WebACLProps o.. Scope
WebACLProps o.. DefaultAction
WebACLProps o.. Rule
DefaultAction ..> DefaultActionConfig
WebACLProps o.. VisibilityConfig
Rule o.. VisibilityConfig
class WebACL {
+constructor(props: WebACLProps)
+attachTo(target: ITarget)
}
class WebACLProps {
name?: string;
description?: string;
scope: Scope;
customResponseBodies?: Record;
defaultAction: DefaultAction;
rules?: Rule[];
visibilityConfig?: VisibilityConfig;
}
<> WebACLProps
class CustomResponseBody {
content: string;
contentType: string;
}
<> CustomResponseBody
class Scope {
REGIONAL
CLOUDFRONT
}
<> Scope
class DefaultAction {
allow()$ DefaultAction
block()$ DefaultAction
bind()* DefaultActionConfig
}
<> DefaultAction
class DefaultActionConfig {
configuration: CfnWebACL.DefaultActionProperty;
}
<> DefaultActionConfig
class Rule {
name: string;
action: RuleAction;
overrideAction: OverrideAction;
priority: number;
statement: Statement;
visibilityConfig?: VisibilityConfig;
ruleLabels?: Label[];
}
<> Rule
class VisibilityConfig {
cloudWatchMetricsEnabled: boolean;
metricName: string;
sampledRequestsEnabled: boolean;
}
<> VisibilityConfig
```
##### Rule
```mermaid
classDiagram
Rule o.. RuleAction
RuleAction ..> RuleActionConfig
Rule o.. OverrideAction
OverrideAction ..> OverrideActionConfig
Rule o.. IStatement
IStatement ..> StatementConfig
class Rule {
name: string;
action: RuleAction;
overrideAction: OverrideAction;
priority?: number;
statement: Statement;
visibilityConfig: VisibilityConfig;
ruleLabels?: string[];
}
<> Rule
class RuleAction {
allow()$ RuleAction
block()$ RuleAction
count()$ RuleAction
bind()* RuleActionConfig
}
<> RuleAction
class RuleActionConfig {
configuration: CfnRuleGroup.RuleActionProperty
}
<> RuleActionConfig
class OverrideAction {
count()$ OverrideAction
none()$ OverrideAction
bind()* OverrideActionConfig
}
<> OverrideAction
class OverrideActionConfig {
count?: Json;
none?: Json;
}
class IStatement {
bind() StatementConfig
}
<> IStatement
class StatementConfig {
configuration: CfnRuleGroup.StatementProperty;
}
<> StatementConfig
```
### Roadmap
1. implement `WebACL` with only required properties
- It will not be able to use Rules
1. implement `Rule` with one `Statement`(LabelMatchStatement)
1. implement other remaining properties
1. implement Statements
Contributor guide
Research direction
Start with the linked CloudFormation WebACL reference and the proposed WebACL, Rule, and statement entry points. Follow the roadmap from required WebACL properties through rules, remaining properties, and statements. Done means the planned L2 constructs support the documented usage, including visibility defaults and resource association.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100