aws / aws/aws-cdk

aws_wafv2: UNABLE to go lower than value 100 for "RateBasedStatementProperty"

Open
#31,742 4 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-wafv2 bug effort/small needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

I am unable to set my `limit` for a `RateBasedStatementProperty` below 100. Attempting to do so results in a stack error:

```
Resource handler returned message: "Model validation failed (#/Rules/0/Statement/RateBasedStatement/Limit: failed validation constraint for keyword [minimum])" (RequestToken: TOKEN, HandlerErrorCode: InvalidRequest)
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

I am able to set a rate below 100.

### Current Behavior

Unable to set a rate below 100, must be done via web console in AWS.

### Reproduction Steps

```python
waf_acl = aws_wafv2.CfnWebACL(
scope_=self,
id='RootWAF',
default_action=aws_wafv2.CfnWebACL.DefaultActionProperty(allow={}),
scope='CLOUDFRONT',
visibility_config=aws_wafv2.CfnWebACL.VisibilityConfigProperty(
cloud_watch_metrics_enabled=True,
metric_name="WAF",
sampled_requests_enabled=True,
),
rules=[
aws_wafv2.CfnWebACL.RuleProperty(
name='Rate-Limit-Requests',
priority=0,
action=aws_wafv2.CfnWebACL.RuleActionProperty(block={}),
visibility_config=aws_wafv2.CfnWebACL
.VisibilityConfigProperty(
cloud_watch_metrics_enabled=True,
metric_name="Rate-Limit-Requests",
sampled_requests_enabled=True,
),
statement=aws_wafv2.CfnWebACL.StatementProperty(
rate_based_statement=aws_wafv2.CfnWebACL
.RateBasedStatementProperty(
aggregate_key_type='IP',
limit=60, # FAILS HERE !!!!
evaluation_window_sec=60,
),
),
),
],
)
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.162.1 (build 10aa526)

### Framework Version

_No response_

### Node.js Version

v18.16.0

### OS

macOS

### Language

Python

### Language Version

Python 3.12.0

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Python entry point aws_wafv2.CfnWebACL.RateBasedStatementProperty and reproduce the limit=60 example. Compare the generated property validation with the AWS WAF error stating a minimum of 100; done means a rate below 100 can be deployed through CDK as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.