WebACL

Source: src/AWS/WAFv2/WebACL.ts

An AWS WAFv2 Web ACL — a collection of rules that inspect and control web requests for the AWS resources it is associated with.

REGIONAL web ACLs protect regional resources (Application Load Balancer, API Gateway, AppSync, Cognito user pools, App Runner, Verified Access) via WebACLAssociation. CLOUDFRONT web ACLs protect CloudFront distributions (set Distribution.webAclId to the web ACL’s ARN) and are always provisioned in us-east-1 — the provider pins the region for you.

Creating Web ACLs

Allow-by-Default Web ACL with a Managed Rule Group

const acl = yield* AWS.WAFv2.WebACL("ApiFirewall", {
  rules: [
    {
      Name: "common-rule-set",
      Priority: 0,
      Statement: {
        ManagedRuleGroupStatement: {
          VendorName: "AWS",
          Name: "AWSManagedRulesCommonRuleSet",
        },
      },
      OverrideAction: { None: {} },
      VisibilityConfig: {
        SampledRequestsEnabled: true,
        CloudWatchMetricsEnabled: true,
        MetricName: "common-rule-set",
      },
    },
  ],
});

Rate Limiting Requests per IP

const acl = yield* AWS.WAFv2.WebACL("RateLimited", {
  defaultAction: { Allow: {} },
  rules: [
    {
      Name: "rate-limit",
      Priority: 0,
      Statement: {
        RateBasedStatement: { Limit: 100, AggregateKeyType: "IP" },
      },
      Action: { Block: {} },
      VisibilityConfig: {
        SampledRequestsEnabled: true,
        CloudWatchMetricsEnabled: true,
        MetricName: "rate-limit",
      },
    },
  ],
});

CloudFront Scope

const acl = yield* AWS.WAFv2.WebACL("EdgeFirewall", {
  scope: "CLOUDFRONT", // provisioned in us-east-1 automatically
  defaultAction: { Allow: {} },
});

const distribution = yield* AWS.CloudFront.Distribution("Site", {
  // ...
  webAclId: acl.webAclArn,
});

Protecting Regional Resources

const association = yield* AWS.WAFv2.WebACLAssociation("PoolFirewall", {
  webAclArn: acl.webAclArn,
  resourceArn: userPool.userPoolArn,
});