RuleGroup

Source: src/AWS/WAFv2/RuleGroup.ts

An AWS WAFv2 rule group — a reusable, capacity-bounded collection of rules referenced from web ACLs via RuleGroupReferenceStatement.

The capacity (web ACL capacity units, WCU) is fixed at creation; changing it replaces the rule group.

Creating Rule Groups

Rule Group with a Byte-Match Rule

const group = yield* AWS.WAFv2.RuleGroup("BlockAdminPaths", {
  capacity: 50,
  rules: [
    {
      Name: "block-admin",
      Priority: 0,
      Statement: {
        ByteMatchStatement: {
          SearchString: new TextEncoder().encode("/admin"),
          FieldToMatch: { UriPath: {} },
          TextTransformations: [{ Priority: 0, Type: "LOWERCASE" }],
          PositionalConstraint: "STARTS_WITH",
        },
      },
      Action: { Block: {} },
      VisibilityConfig: {
        SampledRequestsEnabled: true,
        CloudWatchMetricsEnabled: true,
        MetricName: "block-admin",
      },
    },
  ],
});

Reference from a Web ACL

const acl = yield* AWS.WAFv2.WebACL("Firewall", {
  rules: [
    {
      Name: "custom-rules",
      Priority: 0,
      Statement: {
        RuleGroupReferenceStatement: { ARN: group.ruleGroupArn },
      },
      OverrideAction: { None: {} },
      VisibilityConfig: {
        SampledRequestsEnabled: true,
        CloudWatchMetricsEnabled: true,
        MetricName: "custom-rules",
      },
    },
  ],
});