aws / aws/aws-cdk

(wafv2): add WebACL L2 Construct

Open
#17,749 7 comments 54 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafv2 effort/large feature-request p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Description

Now, @aws-cdk/aws-wafv2 has no L2 Construct. I will implements L2 Constructs.

### Use Case

When users create WebACL, this Cunstruct will support it.

### Proposed Solution

We can create L2 constructs for aws-wafv2.

### Other information

_No response_

### Acknowledge

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### Design

ref: [cloudformation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html)

#### Usage

##### Define WebACL

```ts
import * as wafv2 from 'aws-cdk-lib/aws-wafv2'
import * as wafv2Statement from 'aws-cdk-lib/aws-wafv2-statement'

const webAcl = new wafv2.WebACL(this, "WebACL", {
scope: wafv2.Scope.REGIONAL,
defaultAction: wafv2.DefaultAction.block(),
rules: [
{
name: "IPSetAllow",
action: wafv2.RuleAction.allow(),
statement: new wafv2Statement.IPSetReferenceStatement(ipSet),
},
{
name: "OWASP",
overrideAction: wafv2.OverrideAction.count(),
statement: wafv2Statement.ManagedRuleGroupStatement.awsCommon(),
},
],
});
```

> Note: `visibilityConfig` have default value.
> If `WebACLProps.visibilityConfig` is set, Rules inherit it.

> Note: `wafv2Statement.ManagedRuleGroupStatement.awsCommon()` will be Enum like pattern.

##### Associate to other resources

```ts
webAcl.attachTo(target);
```

and if associate to CloudFront as following:

```ts
new cloudfront.Distribution(this, 'distribution', {
webAcl: webAcl,
})
```

#### class diagram

##### WebACL

```mermaid
classDiagram
WebACL ..> WebACLProps
WebACLProps o.. CustomResponseBody
WebACLProps o.. Scope
WebACLProps o.. DefaultAction
WebACLProps o.. Rule
DefaultAction ..> DefaultActionConfig
WebACLProps o.. VisibilityConfig
Rule o.. VisibilityConfig

class WebACL {
+constructor(props: WebACLProps)
+attachTo(target: ITarget)
}
class WebACLProps {
name?: string;
description?: string;
scope: Scope;
customResponseBodies?: Record;
defaultAction: DefaultAction;
rules?: Rule[];
visibilityConfig?: VisibilityConfig;
}
<> WebACLProps

class CustomResponseBody {
content: string;
contentType: string;
}
<> CustomResponseBody

class Scope {
REGIONAL
CLOUDFRONT
}
<> Scope

class DefaultAction {
allow()$ DefaultAction
block()$ DefaultAction
bind()* DefaultActionConfig
}
<> DefaultAction
class DefaultActionConfig {
configuration: CfnWebACL.DefaultActionProperty;
}
<> DefaultActionConfig

class Rule {
name: string;
action: RuleAction;
overrideAction: OverrideAction;
priority: number;
statement: Statement;
visibilityConfig?: VisibilityConfig;
ruleLabels?: Label[];
}
<> Rule
class VisibilityConfig {
cloudWatchMetricsEnabled: boolean;
metricName: string;
sampledRequestsEnabled: boolean;
}
<> VisibilityConfig
```

##### Rule

```mermaid
classDiagram
Rule o.. RuleAction
RuleAction ..> RuleActionConfig
Rule o.. OverrideAction
OverrideAction ..> OverrideActionConfig
Rule o.. IStatement
IStatement ..> StatementConfig

class Rule {
name: string;
action: RuleAction;
overrideAction: OverrideAction;
priority?: number;
statement: Statement;
visibilityConfig: VisibilityConfig;
ruleLabels?: string[];
}
<> Rule

class RuleAction {
allow()$ RuleAction
block()$ RuleAction
count()$ RuleAction
bind()* RuleActionConfig
}
<> RuleAction
class RuleActionConfig {
configuration: CfnRuleGroup.RuleActionProperty
}
<> RuleActionConfig

class OverrideAction {
count()$ OverrideAction
none()$ OverrideAction
bind()* OverrideActionConfig
}
<> OverrideAction
class OverrideActionConfig {
count?: Json;
none?: Json;
}

class IStatement {
bind() StatementConfig
}
<> IStatement
class StatementConfig {
configuration: CfnRuleGroup.StatementProperty;
}
<> StatementConfig
```

### Roadmap

1. implement `WebACL` with only required properties
- It will not be able to use Rules
1. implement `Rule` with one `Statement`(LabelMatchStatement)
1. implement other remaining properties
1. implement Statements

Contributor guide

Open the contributing guide

Research direction

Start with the linked CloudFormation WebACL reference and the proposed WebACL, Rule, and statement entry points. Follow the roadmap from required WebACL properties through rules, remaining properties, and statements. Done means the planned L2 constructs support the documented usage, including visibility defaults and resource association.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.