WebACLAssociation

Source: src/AWS/WAFv2/WebACLAssociation.ts

Associates a REGIONAL AWS WAFv2 WebACL with a regional resource (ALB, API Gateway stage, AppSync API, Cognito user pool, App Runner service, Amplify app, Verified Access instance) to protect it.

A resource can have at most one web ACL association; associating a different web ACL overwrites the previous association in place. CloudFront distributions are protected by setting Distribution.webAclId instead — never through this resource.

Associating Web ACLs

const pool = yield* AWS.Cognito.UserPool("Users", {});

const acl = yield* AWS.WAFv2.WebACL("PoolFirewall", {
  defaultAction: { Allow: {} },
});

const association = yield* AWS.WAFv2.WebACLAssociation("PoolAssociation", {
  webAclArn: acl.webAclArn,
  resourceArn: pool.userPoolArn,
});