Package: ikala-cloud.aws-waf-solution
AWS WAF SolutionThis CDK Construct modify and rebuild fromCloudfront with Automated WAF.The solution use CDK construct to automatically deploy a set of AWS WAF rules design to filter common web-based attacks.Users can select from preconfigured protective features that define the rules included in an AWS WAF web access control list (web ACL). After the solution deploys, AWS WAF begins inspecting web requests to the user’s existing Amazon CloudFront distributions、Application Load Balancers、API Gateway, and blocks them when applicable.What is differenceThe project is CDK Construct which is handy to integrate into your existing CDK project.Support count mode for testing WAF rule, seeAPI.md.Support Application Load Balancers and API Gateway (The origin repository doesn't support ALB any more in next release, seeissue)AWS Shield Advance is optional (The origin repository enforce to enable it)Support CDKv1 and CDKv2CDKv2npm install @ikala-cloud/aws-waf-solution
or
npm install @ikala-cloud/aws-waf-solution@latest
or
npm install @ikala-cloud/aws-waf-solution@^2.0.0CDKv1npm install @ikala-cloud/aws-waf-solution@cdkv1
or
npm install @ikala-cloud/aws-waf-solution@^1.0.38Construct PropsRefAPI ReferenceCloudFront UsageconstenvUSEast1={region:'us-east-1',account:process.env.CDK_DEFAULT_ACCOUNT,};conststackTest1=newcdk.Stack(app,'TestStackAutomatedWafForCloudFront',{env:envUSEast1});newAutomatedWaf(stackTest1,'AutomatedWaf',{waf2Scope:Waf2ScopeOption.CLOUDFRONT,resourceNamingPrefix:'CloudFront_ApiGW',errorThreshold:55,requestThreshold:300,blockPeriod:60,logLevel:LogLevel.DEBUG,});Notice the WAF region must beus-east-1for CloudFront.After deploying, it need to do two things on AWS Management Console.1. Attach Cloudfront to WAF.Clickadd AWS ResourcesSelect existing CloudFront Distribution.2. Set S3 bucket on CloudFront standand loggingFind S3 bucket name on CloudFormation outputSet CloudFront standard logging on CloudFront Settings:warning: Log Prefix must beAWSLogs/Application Load Balancers Usageconstenv={region:process.env.CDK_DEFAULT_REGION,account:process.env.CDK_DEFAULT_ACCOUNT,};conststackTest2=newcdk.Stack(app,'TestStackAutomatedWafForALB',{env});constalbArn=`arn:aws:elasticloadbalancing:${cdk.Aws.REGION}:${cdk.Aws.ACCOUNT_ID}:loadbalancer/app/ApiNe-Alb16-2VIC9075YQEZ/db92cdc88d2e7c9d`;newAutomatedWaf(stackTest2,'AutomatedWaf',{waf2Scope:Waf2ScopeOption.REGIONAL,associatedResourceArn:albArn,resourceNamingPrefix:'Alb_Api',errorThreshold:50,requestThreshold:300,blockPeriod:60,logLevel:LogLevel.DEBUG,});After deploying, follow these steps on AWS Management Console. See below:Find S3 bucket name on CloudFormation outputClickEdit Attributeson Basic Configuration of Load BalancersEnable Access logs and input S3 bucketAPI Gateway Usageconstenv={region:process.env.CDK_DEFAULT_REGION,account:process.env.CDK_DEFAULT_ACCOUNT,};conststackTest3=newcdk.Stack(app,'TestStackAutomatedWafForApiGW',{env});/***RefStagearninhttps://docs.aws.amazon.com/apigateway/latest/developerguide/arn-format-reference.html*/constrestApiArn=`arn:aws:apigateway:${cdk.Aws.REGION}::/restapis/0j90w09yf9/stages/prod`;newAutomatedWaf(stackTest3,'AutomatedWaf',{waf2Scope:Waf2ScopeOption.REGIONAL,associatedResourceArn:restApiArn,resourceNamingPrefix:'ApiGW',errorThreshold:50,requestThreshold:300,blockPeriod:60,logLevel:LogLevel.DEBUG,});TroubleshootingIf deployment error, the cloudFormation Error event like thisReceived response status [FAILED] from custom resource. Message returned: 'HttpFloodLambdaLogParser' (RequestId: b4e08ea2-fe0a-46f8-98aa-6f96d4558579)If any custom resource deploy error like above, delete the stack and redeploy it that will pass.