aws / aws/aws-cdk

(wafv2): wafv2.CfnWebACL.ExcludedRuleProperty name argument casing

Open
#27,993 5 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-wafv2 bug effort/small p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Not sure if this is a documentation bug, or a bug within CDK, but we're trying to modify rule sets on a Web ACL, and it's unclear if the `name` argument to `wafv2.CfnWebACL.ExcludedRuleProperty` is supposed to be upper-cased or lower-cased. The documentation at https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_wafv2/CfnWebACL.html#excludedruleproperty specifies `name` (with a lower-case `n`).

But we see the following error (warning?) when running CDK:

```
Properties validation failed for resource cirrusscanwafacl with message:
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: required key [Name] not found
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: extraneous key [name] is not permitted
```

The modifications to the rule list seem to take effect, despite the error (warning?) displayed above.

### Expected Behavior

I would not expect to see validation errors when using `name`.

### Current Behavior

I see unexpected validation errors when using `name`:

```
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: required key [Name] not found
#/Rules/3/Statement/RateBasedStatement/ScopeDownStatement/NotStatement/Statement/SizeConstraintStatement/FieldToMatch/SingleHeader: extraneous key [name] is not permitted
```

### Reproduction Steps

Our CDK stack constructs a WAFv2 Web ACL, and specifies rules using:

```
rules=[
# AWS Common Ruleset (with modifications)
wafv2.CfnWebACL.RuleProperty(
name="CirrusScan-AWSManagedRulesCommonRuleSet",
priority=0,
override_action=wafv2.CfnWebACL.OverrideActionProperty(
none={},
),
visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
sampled_requests_enabled=True,
cloud_watch_metrics_enabled=True,
metric_name="CirrusScan-MetricForAMRCommon",
),
statement=wafv2.CfnWebACL.StatementProperty(
managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
vendor_name="AWS",
name="AWSManagedRulesCommonRuleSet",
excluded_rules=[
wafv2.CfnWebACL.ExcludedRuleProperty(
name="SizeRestrictions_BODY"
),
wafv2.CfnWebACL.ExcludedRuleProperty(
name="GenericRFI_BODY"
),
wafv2.CfnWebACL.ExcludedRuleProperty(
name="EC2MetaDataSSRF_BODY"
),
],
),
),
),
```

[Documentation](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_wafv2/CfnWebACL.html#excludedruleproperty) for `wafv2.CfnWebACL.ExcludedRuleProperty` suggests that `name` (lowercase N) should be specified as the parameter, but errors/warnings emitted by CDK suggest it is expecting `Name` (uppercase N).

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.96.2

### Framework Version

_No response_

### Node.js Version

18

### OS

Ubuntu Linux

### Language

Python

### Language Version

Python 3.11

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the Python example with CDK CLI 2.96.2 and inspect the generated WAFv2 resource around ExcludedRuleProperty and SingleHeader. Compare the documented `name` argument with the emitted CloudFormation keys; done means the casing is corrected or clearly documented and the reported validation errors no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.