Skip to content

Commit bba361e

Browse files
mickychettaEC2 Default Userroot
authored
feat(aws-wafwebacl-cloudfront): created README for aws-wafwebacl-cloudfront (#389)
* created README for aws-wafwebacl-cloudfront * fixed cloudfront name * created aws-wafwebacl-cloudfront construct and tests * revert README changes in cloudfront constructs * updated variable name in wafwebacl-cloudfront-mediastore test * updated construct prop type to cloudfront.Distribution * updated s3 removal policy to destroy * delete trailing whitespace * Updated comment for existing cloudfront web distribution prop * delete trailing whitespace Co-authored-by: EC2 Default User <[email protected]> Co-authored-by: root <[email protected]>
1 parent 585a742 commit bba361e

17 files changed

+3753
-0
lines changed

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/.eslintignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
lib/*.js
2+
test/*.js
3+
*.d.ts
4+
coverage
5+
test/lambda/index.js

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/.gitignore

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
lib/*.js
2+
test/*.js
3+
*.js.map
4+
*.d.ts
5+
node_modules
6+
*.generated.ts
7+
dist
8+
.jsii
9+
10+
.LAST_BUILD
11+
.nyc_output
12+
coverage
13+
.nycrc
14+
.LAST_PACKAGE
15+
*.snk

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/.npmignore

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Exclude typescript source and config
2+
*.ts
3+
tsconfig.json
4+
coverage
5+
.nyc_output
6+
*.tgz
7+
*.snk
8+
*.tsbuildinfo
9+
10+
# Include javascript files and typescript declarations
11+
!*.js
12+
!*.d.ts
13+
14+
# Exclude jsii outdir
15+
dist
16+
17+
# Include .jsii
18+
!.jsii
19+
20+
# Include .jsii
21+
!.jsii

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/README.md

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# aws-wafwebacl-cloudfront module
2+
<!--BEGIN STABILITY BANNER-->
3+
4+
---
5+
6+
![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge)
7+
8+
> All classes are under active development and subject to non-backward compatible changes or removal in any
9+
> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model.
10+
> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.
11+
12+
---
13+
<!--END STABILITY BANNER-->
14+
15+
| **Reference Documentation**:| <span style="font-weight: normal">https://docs.aws.amazon.com/solutions/latest/constructs/</span>|
16+
|:-------------|:-------------|
17+
<div style="height:8px"></div>
18+
19+
20+
| **Language** | **Package** |
21+
|:-------------|-----------------|
22+
|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_wafwebacl_cloudfront`|
23+
|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-wafwebacl-cloudfront`|
24+
|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.wafwebaclcloudfront`|
25+
26+
## Overview
27+
This AWS Solutions Construct implements an AWS WAF web ACL connected to Amazon CloudFront.
28+
29+
Here is a minimal deployable pattern definition in Typescript:
30+
31+
``` typescript
32+
import { CloudFrontToS3 } from '@aws-solutions-constructs/aws-cloudfront-s3';
33+
import { WafwebaclToCloudFront } from "@aws-solutions-constructs/aws-wafwebacl-cloudfront";
34+
35+
const cloudfrontToS3 = new CloudFrontToS3(this, 'test-cloudfront-s3', {});
36+
37+
// This construct can only be attached to a configured CloudFront.
38+
new WafwebaclToCloudFront(this, 'test-wafwebacl-cloudfront', {
39+
existingCloudFrontWebDistribution: cloudfrontToS3.cloudFrontWebDistribution
40+
});
41+
```
42+
43+
## Initializer
44+
45+
``` text
46+
new WafwebaclToCloudFront(scope: Construct, id: string, props: WafwebaclToCloudFrontProps);
47+
```
48+
49+
_Parameters_
50+
51+
* scope [`Construct`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.Construct.html)
52+
* id `string`
53+
* props [`WafwebaclToCloudFrontProps`](#pattern-construct-props)
54+
55+
## Pattern Construct Props
56+
57+
| **Name** | **Type** | **Description** |
58+
|:-------------|:----------------|-----------------|
59+
|existingCloudFrontWebDistribution|[`cloudfront.Distribution`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.Distribution.html)|The existing CloudFront instance that will be protected with the WAF web ACL. *Note that a WAF web ACL can only be added to a configured CloudFront, so this construct only accepts an existing CloudFrontWebDistribution and does not accept cloudfrontProps.*|
60+
|existingWebaclObj?|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-wafv2.CfnWebACL.html)|Existing instance of a WAF web ACL, an error will occur if this and props is set.|
61+
|webaclProps?|[`waf.CfnWebACLProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-wafv2.CfnWebACLProps.html)|Optional user-provided props to override the default props for the AWS WAF web ACL. To use a different collection of managed rule sets, specify a new rules property. Use our [`wrapManagedRuleSet(managedGroupName: string, vendorName: string, priority: number)`](../core/lib/waf-defaults.ts) function from core to create an array entry from each desired managed rule set.|
62+
63+
## Pattern Properties
64+
65+
| **Name** | **Type** | **Description** |
66+
|:-------------|:----------------|-----------------|
67+
|webacl|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-wafv2.CfnWebACL.html)|Returns an instance of the waf.CfnWebACL created by the construct.|
68+
|cloudFrontWebDistribution|[`cloudfront.Distribution`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.Distribution.html)|Returns an instance of cloudfront.Distribution created by the construct.|
69+
70+
## Default settings
71+
72+
Out of the box implementation of the Construct without any override will set the following defaults:
73+
74+
### AWS WAF
75+
* Deploy a WAF web ACL with 7 [AWS managed rule groups](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html).
76+
* AWSManagedRulesBotControlRuleSet
77+
* AWSManagedRulesKnownBadInputsRuleSet
78+
* AWSManagedRulesCommonRuleSet
79+
* AWSManagedRulesAnonymousIpList
80+
* AWSManagedRulesAmazonIpReputationList
81+
* AWSManagedRulesAdminProtectionRuleSet
82+
* AWSManagedRulesSQLiRuleSet
83+
84+
*Note that the default rules can be replaced by specifying the rules property of CfnWebACLProps*
85+
* Send metrics to Amazon CloudWatch
86+
87+
### Amazon CloudFront
88+
* User provided CloudFront object is used as-is
89+
90+
## Architecture
91+
![Architecture Diagram](architecture.png)
92+
93+
***
94+
&copy; Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/architecture.png

228 KB
Loading

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/lib/index.ts

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/**
2+
* Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
5+
* with the License. A copy of the License is located at
6+
*
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
10+
* OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
11+
* and limitations under the License.
12+
*/
13+
14+
// Imports
15+
import * as cloudfront from '@aws-cdk/aws-cloudfront';
16+
import * as waf from '@aws-cdk/aws-wafv2';
17+
import * as defaults from '@aws-solutions-constructs/core';
18+
// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate
19+
import { Construct } from '@aws-cdk/core';
20+
21+
/**
22+
* @summary The properties for the WafwebaclToCloudFront class.
23+
*/
24+
export interface WafwebaclToCloudFrontProps {
25+
/**
26+
* The existing CloudFront instance that will be protected with the WAF web ACL.
27+
*
28+
* This construct changes the CloudFront distribution by directly manipulating
29+
* the CloudFormation output, so this must be the Construct and cannot be
30+
* changed to the Interface (IDistribution)
31+
*/
32+
readonly existingCloudFrontWebDistribution: cloudfront.Distribution ,
33+
/**
34+
* Existing instance of a WAF web ACL, an error will occur if this and props is set
35+
*/
36+
readonly existingWebaclObj?: waf.CfnWebACL,
37+
/**
38+
* Optional user-provided props to override the default props for the AWS WAF web ACL.
39+
*
40+
* @default - Default properties are used.
41+
*/
42+
readonly webaclProps?: waf.CfnWebACLProps,
43+
}
44+
45+
/**
46+
* @summary The WafwebaclToCloudFront class.
47+
*/
48+
export class WafwebaclToCloudFront extends Construct {
49+
public readonly webacl: waf.CfnWebACL;
50+
public readonly cloudFrontWebDistribution: cloudfront.Distribution;
51+
/**
52+
* @summary Constructs a new instance of the WafwebaclToCloudFront class.
53+
* @param {cdk.App} scope - represents the scope for all the resources.
54+
* @param {string} id - this is a a scope-unique id.
55+
* @param {WafwebaclToCloudFrontProps} props - user provided props for the construct.
56+
* @access public
57+
*/
58+
constructor(scope: Construct, id: string, props: WafwebaclToCloudFrontProps) {
59+
super(scope, id);
60+
defaults.CheckProps(props);
61+
62+
// Build the Web ACL
63+
this.webacl = defaults.buildWebacl(this, 'CLOUDFRONT', {
64+
existingWebaclObj: props.existingWebaclObj,
65+
webaclProps: props.webaclProps,
66+
});
67+
68+
// Property override of CloudFront Cfn Template
69+
const cfnExistingCloudFrontWebDistribution = props.existingCloudFrontWebDistribution.node.defaultChild as cloudfront.CfnDistribution;
70+
71+
cfnExistingCloudFrontWebDistribution.addPropertyOverride('DistributionConfig.WebACLId', this.webacl.attrArn);
72+
73+
this.cloudFrontWebDistribution = props.existingCloudFrontWebDistribution;
74+
}
75+
}

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront/package.json

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"name": "@aws-solutions-constructs/aws-wafwebacl-cloudfront",
3+
"version": "0.0.0",
4+
"description": "CDK constructs for defining an AWS web WAF connected to Amazon CloudFront.",
5+
"main": "lib/index.js",
6+
"types": "lib/index.d.ts",
7+
"repository": {
8+
"type": "git",
9+
"url": "https://github.com/awslabs/aws-solutions-constructs.git",
10+
"directory": "source/patterns/@aws-solutions-constructs/aws-wafwebacl-cloudfront"
11+
},
12+
"author": {
13+
"name": "Amazon Web Services",
14+
"url": "https://aws.amazon.com",
15+
"organization": true
16+
},
17+
"license": "Apache-2.0",
18+
"scripts": {
19+
"build": "tsc -b .",
20+
"lint": "eslint -c ../eslintrc.yml --ext=.js,.ts . && tslint --project .",
21+
"lint-fix": "eslint -c ../eslintrc.yml --ext=.js,.ts --fix .",
22+
"test": "jest --coverage",
23+
"clean": "tsc -b --clean",
24+
"watch": "tsc -b -w",
25+
"integ": "cdk-integ",
26+
"integ-assert": "cdk-integ-assert",
27+
"integ-no-clean": "cdk-integ --no-clean",
28+
"jsii": "jsii",
29+
"jsii-pacmak": "jsii-pacmak",
30+
"build+lint+test": "npm run jsii && npm run lint && npm test && npm run integ-assert",
31+
"snapshot-update": "npm run jsii && npm test -- -u && npm run integ-assert"
32+
},
33+
"jsii": {
34+
"outdir": "dist",
35+
"targets": {
36+
"java": {
37+
"package": "software.amazon.awsconstructs.services.wafwebaclcloudfront",
38+
"maven": {
39+
"groupId": "software.amazon.awsconstructs",
40+
"artifactId": "wafwebaclcloudfront"
41+
}
42+
},
43+
"dotnet": {
44+
"namespace": "Amazon.Constructs.AWS.WafwebaclCloudFront",
45+
"packageId": "Amazon.Constructs.AWS.WafwebaclCloudFront",
46+
"signAssembly": true,
47+
"iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/master/logo/default-256-dark.png"
48+
},
49+
"python": {
50+
"distName": "aws-solutions-constructs.aws-wafwebacl-cloudfront",
51+
"module": "aws_solutions_constructs.aws_wafwebacl_cloudfront"
52+
}
53+
}
54+
},
55+
"dependencies": {
56+
"@aws-cdk/aws-cloudfront": "0.0.0",
57+
"@aws-cdk/aws-cloudfront-origins": "0.0.0",
58+
"@aws-cdk/aws-s3": "0.0.0",
59+
"@aws-cdk/aws-wafv2": "0.0.0",
60+
"@aws-cdk/core": "0.0.0",
61+
"@aws-cdk/aws-lambda": "0.0.0",
62+
"@aws-solutions-constructs/core": "0.0.0",
63+
"@aws-solutions-constructs/aws-cloudfront-apigateway-lambda": "0.0.0",
64+
"@aws-solutions-constructs/aws-cloudfront-s3": "0.0.0",
65+
"@aws-solutions-constructs/aws-cloudfront-mediastore": "0.0.0",
66+
"constructs": "^3.2.0"
67+
},
68+
"devDependencies": {
69+
"@aws-cdk/assert": "0.0.0",
70+
"@types/jest": "^26.0.22",
71+
"@types/node": "^10.3.0"
72+
},
73+
"jest": {
74+
"moduleFileExtensions": [
75+
"js"
76+
],
77+
"coverageReporters": [
78+
"text",
79+
[
80+
"lcov",
81+
{
82+
"projectRoot": "../../../../"
83+
}
84+
]
85+
]
86+
},
87+
"peerDependencies": {
88+
"@aws-cdk/aws-cloudfront": "0.0.0",
89+
"@aws-cdk/aws-cloudfront-origins": "0.0.0",
90+
"@aws-cdk/aws-s3": "0.0.0",
91+
"@aws-cdk/aws-wafv2": "0.0.0",
92+
"@aws-cdk/core": "0.0.0",
93+
"@aws-cdk/aws-lambda": "0.0.0",
94+
"@aws-solutions-constructs/core": "0.0.0",
95+
"@aws-solutions-constructs/aws-cloudfront-apigateway-lambda": "0.0.0",
96+
"@aws-solutions-constructs/aws-cloudfront-s3": "0.0.0",
97+
"@aws-solutions-constructs/aws-cloudfront-mediastore": "0.0.0",
98+
"constructs": "^3.2.0"
99+
},
100+
"keywords": [
101+
"aws",
102+
"cdk",
103+
"awscdk",
104+
"AWS Solutions Constructs",
105+
"AWS WAF Web ACL",
106+
"Amazon CloudFront"
107+
]
108+
}

0 commit comments

Comments
 (0)