(wafv2): wafv2.CfnWebACL.ExcludedRuleProperty name argument casing
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
Not sure if this is a documentation bug, or a bug within CDK, but we're trying to modify rule sets on a Web ACL, and it's unclear if the `name` argument to `wafv2.CfnWebACL.ExcludedRuleProperty` is supposed to be upper-cased or lower-cased. The documentation at https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_wafv2/CfnWebACL.html#excludedruleproperty specifies `name` (with a lower-case `n`).
But we see the following error (warning?) when running CDK:
```
Properties validation failed for resource cirrusscanwafacl with message:
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: required key [Name] not found
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: extraneous key [name] is not permitted
```
The modifications to the rule list seem to take effect, despite the error (warning?) displayed above.
### Expected Behavior
I would not expect to see validation errors when using `name`.
### Current Behavior
I see unexpected validation errors when using `name`:
```
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: required key [Name] not found
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: extraneous key [name] is not permitted
```
### Reproduction Steps
Our CDK stack constructs a WAFv2 Web ACL, and specifies rules using:
```
rules=[
# AWS Common Ruleset (with modifications)
wafv2.CfnWebACL.RuleProperty(
name="CirrusScan-AWSManagedRulesCommonRuleSet",
priority=0,
override_action=wafv2.CfnWebACL.OverrideActionProperty(
none={},
),
visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
sampled_requests_enabled=True,
cloud_watch_metrics_enabled=True,
metric_name="CirrusScan-MetricForAMRCommon",
),
statement=wafv2.CfnWebACL.StatementProperty(
managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
vendor_name="AWS",
name="AWSManagedRulesCommonRuleSet",
excluded_rules=[
wafv2.CfnWebACL.ExcludedRuleProperty(
name="SizeRestrictions_BODY"
),
wafv2.CfnWebACL.ExcludedRuleProperty(
name="GenericRFI_BODY"
),
wafv2.CfnWebACL.ExcludedRuleProperty(
name="EC2MetaDataSSRF_BODY"
),
],
),
),
),
```
[Documentation](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_wafv2/CfnWebACL.html#excludedruleproperty) for `wafv2.CfnWebACL.ExcludedRuleProperty` suggests that `name` (lowercase N) should be specified as the parameter, but errors/warnings emitted by CDK suggest it is expecting `Name` (uppercase N).
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.96.2
### Framework Version
_No response_
### Node.js Version
18
### OS
Ubuntu Linux
### Language
Python
### Language Version
Python 3.11
### Other information
_No response_
Contributor guide
Research direction
Start by reproducing the Python example with CDK CLI 2.96.2 and inspect the generated WAFv2 resource around ExcludedRuleProperty and SingleHeader. Compare the documented `name` argument with the emitted CloudFormation keys; done means the casing is corrected or clearly documented and the reported validation errors no longer occur.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100