aws / aws/aws-cdk

wafv2: add_override does not obey Action key

Open
#29,165 18 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafv2 @aws-cdk/core bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

Trying to add a rule to an specific key breaks as Action is not added:

```python
waf_acl = wafv2.CfnWebACL(self, 'id', **params)
# Assuming above we would have only one rule
new_rule = {
"Action": {
"Block": {}
},
"Name": "Deny_regex",
"Priority": 1,
"Statement": {
"RegexPatternSetReferenceStatement": {
"Arn": {
"Fn::ImportValue": "my-regex-arn"
},
"FieldToMatch": {
"SingleHeader": {
"Name": "my-header"
}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
},
"VisibilityConfig": {
"CloudWatchMetricsEnabled": True,
"MetricName": "Deny_regex",
"SampledRequestsEnabled": True
}
}
waf_acl.add_override('Properties.Rules.1', new_rule)

```

At the final template, the `Action` block is not present:
```json
{
"Name": "Deny_regex",
"Priority": 1,
"Statement": {
"RegexPatternSetReferenceStatement": {
"Arn": {
"Fn::ImportValue": "my-regex-arn"
},
"FieldToMatch": {
"SingleHeader": {
"Name": "my-header"
}
},
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
},
"VisibilityConfig": {
"CloudWatchMetricsEnabled": true,
"MetricName": "Deny_regex",
"SampledRequestsEnabled": true
}
}
```

### Expected Behavior

Expected the rule json output to have the `Action` block

### Current Behavior

Somehow, the Action json block is not being added to the final template

### Reproduction Steps

Create a waf, and try to use add_override with a plain json rule on wafv2

### Possible Solution

Add Action to the jsii interface mappings? Somehow Action is missing.

### Additional Information/Context

_No response_

### CDK CLI Version

2.127.0 (build 6c90efc)

### Framework Version

_No response_

### Node.js Version

v18.17.0

### OS

MacOs

### Language

Python

### Language Version

Python 3.9.6

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing CfnWebACL.add_override('Properties.Rules.1', ...) through the TypeScript/jsii interface mappings for WAFv2 rule properties. Reproduce the reported Python case and compare the synthesized template. Done means the Action block is retained in the final JSON, with a regression test covering the override.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.