aws / aws/aws-cdk

awswafv2: SingleHeaderProperty in GO generates bad CF template (capitalized "Name" property)

Open
#28,074 7 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafv2 bug jsii p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

The use of SingleHeaderProperty in GO CDK for waf header validatrion is synthesizing a nonvalid template.

this is the code used:

```
....rest of rule config...
SearchString: aws.String(props.HeaderValue),

FieldToMatch: &awswafv2.CfnWebACL_FieldToMatchProperty{

SingleHeader: &awswafv2.CfnWebACL_SingleHeaderProperty{

Name: aws.String(props.HeaderName),

},

},
....rest of rule config...
```


This is the generated template portion
"FieldToMatch": { "SingleHeader": { "name": "issued" } },

and this is the error in deployment.
#/Rules/3/Statement/NotStatement/Statement/ByteMatchStatement/FieldToMatch/SingleHeader: required key [Name] not found
#/Rules/3/Statement/NotStatement/Statement/ByteMatchStatement/FieldToMatch/SingleHeader: extraneous key [name] is not permitted

### Expected Behavior

synthesize a template with capitalized property
"FieldToMatch": { "SingleHeader": { "**N**ame": "issued" }

### Current Behavior

This is the generated template portion
"FieldToMatch": { "SingleHeader": { "name": "issued" } },

### Reproduction Steps

create a waf with a rule that validates the header using ByteMathStament:

```
webaclbug := awswafv2.NewCfnWebACL(scope, aws.String("BUGACL"), &awswafv2.CfnWebACLProps{
Name: aws.String("WebACLBUG"),
DefaultAction: awswafv2.CfnWebACL_DefaultActionProperty{
Allow: awswafv2.CfnWebACL_AllowActionProperty{},
},
Scope: aws.String("REGIONAL"),
Rules: []*awswafv2.CfnWebACL_RuleProperty{
{
Name: aws.String("HeaderValidation"),
Statement: &awswafv2.CfnWebACL_StatementProperty{
NotStatement: &awswafv2.CfnWebACL_NotStatementProperty{
Statement: &awswafv2.CfnWebACL_StatementProperty{
ByteMatchStatement: &awswafv2.CfnWebACL_ByteMatchStatementProperty{
SearchString: aws.String("value"),
FieldToMatch: &awswafv2.CfnWebACL_FieldToMatchProperty{
SingleHeader: &awswafv2.CfnWebACL_SingleHeaderProperty{
Name: aws.String("header"),
},
},
TextTransformations: []*awswafv2.CfnWebACL_TextTransformationProperty{
{
Priority: aws.Float64(0),
Type: aws.String("NONE"),
},
},
PositionalConstraint: aws.String("EXACTLY"),
},
},
},
},
Action: aws.String("COUNT"),
Priority: aws.Float64(1),
VisibilityConfig: awswafv2.CfnWebACL_VisibilityConfigProperty{
SampledRequestsEnabled: aws.Bool(true),
CloudWatchMetricsEnabled: aws.Bool(true),
MetricName: aws.String("HeaderParamsCbRuleMetric"),
},
},
},
VisibilityConfig: awswafv2.CfnWebACL_VisibilityConfigProperty{
SampledRequestsEnabled: aws.Bool(true),
CloudWatchMetricsEnabled: aws.Bool(true),
MetricName: aws.String("WebACLMetric"),
},
})
```
### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.110.0

### Framework Version

_No response_

### Node.js Version

18.14.0

### OS

windows 10

### Language

Go

### Language Version

_No response_

### Other information

https://github.com/aws/aws-cdk/discussions/27537
https://github.com/aws/aws-cdk/issues/23709

Contributor guide

Open the contributing guide

Research direction

Start by running the provided Go CDK reproduction with CDK CLI 2.110.0 and inspect the synthesized CloudFormation template for CfnWebACL_SingleHeaderProperty. Compare the generated `name` key with AWS WAF's required `Name` key; done means synthesis produces the capitalized property and the resulting template passes deployment validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.