aws / aws/aws-cdk

aws-fms:CfnPolicy: Missing example for AntiDDos rule

Open
#34,931 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-iam documentation feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the issue

Hi.

I am trying to create a Policy with the AWSManagedRulesAntiDDoSRuleSet.

The documentation does not contain an example and I keep getting the following error when I deploy the stack.

`Resource handler returned message: "AWSManagedRulesAntiDDoSRuleSet can't have null or empty ManagedRuleGroupConfigs.`

even through the the ManagedRuleGroupConfigs is containing an array with a AWSManagedRulesAntiDDoSRuleSet.

I am adding the following json to the managedServiceData property as a string.

```json
{
"type": "WAFV2",
"preProcessRuleGroups": [
{
"overrideAction": { "type": "NONE" },
"ruleGroupType": "ManagedRuleGroup",
"ruleGroupArn": null,
"excludeRules": [],
"ruleActionOverrides": [
{ "name": "ChallengeAllDuringEvent", "actionToUse": { "count": {} } },
{ "name": "ChallengeDDoSRequests", "actionToUse": { "count": {} } },
{ "name": "DDoSRequests", "actionToUse": { "count": {} } }
],
"ManagedRuleGroupConfigs": [
{
"AWSManagedRulesAntiDDoSRuleSet": {
"ClientSideActionConfig": {
"Challenge": {
"UsageOfAction": "ENABLED",
"Sensitivity": "HIGH",
"ExemptUriRegularExpressions": [
{
"RegexString": [\\/api\\/|\\.(acc|avi|css|gif|ico|jpe?g|js|json|mp[34]|ogg|otf|pdf|png|tiff?|ttf|webm|webp|woff2?|xml)$](x-webdoc://6CAED313-A56A-4DDF-8258-EB531335EA4D/api/|/.(acc|avi|css|gif|ico|jpe?g|js|json|mp%5b34%5d|ogg|otf|pdf|png|tiff?|ttf|webm|webp|woff2?|xml)$)
}
]
}
},
"SensitivityToBlock": "LOW"
}
}
],
"managedRuleGroupIdentifier": {
"vendorName": "AWS",
"managedRuleGroupName": "AWSManagedRulesAntiDDoSRuleSet",
"version": null
}
}
],
"postProcessRuleGroups": [],
"defaultAction": { "type": "ALLOW" },
"overrideCustomerWebACLAssociation": false,
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "FmsPublicMetricGlobalNonProd"
}
}

```

Can anyone provide me with a working example or explain to me what is wrong.

### Links

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_fms.CfnPolicy.SecurityServicePolicyDataProperty.html#managedservicedata

Contributor guide

Open the contributing guide

Research direction

Start with the linked CfnPolicy.SecurityServicePolicyDataProperty API documentation and the managedServiceData section, then compare its documented structure with the AWSManagedRulesAntiDDoSRuleSet payload in the issue. Done means the documentation includes a valid working example or clearly explains the required ManagedRuleGroupConfigs structure and resolves the reported deployment error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.