Skip to content

Commit cd5c4f4

Browse files
mickychettamickychetta
authored
feat(aws-wafwebacl-alb): created aws-wafwebacl-alb construct (#465)
* created README for aws-wafwebacl-alb * updated README * created wafwebacl-alb construct * updated file name * added cfn suppress rules * changed r53toAlb construct to just alb
1 parent bb353e9 commit cd5c4f4

File tree

11 files changed

+1599
-1
lines changed

11 files changed

+1599
-1
lines changed

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.eslintignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lib/*.js
2+
test/*.js
3+
*.d.ts
4+
coverage

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.gitignore

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
lib/*.js
2+
test/*.js
3+
*.js.map
4+
*.d.ts
5+
node_modules
6+
*.generated.ts
7+
dist
8+
.jsii
9+
10+
.LAST_BUILD
11+
.nyc_output
12+
coverage
13+
.nycrc
14+
.LAST_PACKAGE
15+
*.snk

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.npmignore

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Exclude typescript source and config
2+
*.ts
3+
tsconfig.json
4+
coverage
5+
.nyc_output
6+
*.tgz
7+
*.snk
8+
*.tsbuildinfo
9+
10+
# Include javascript files and typescript declarations
11+
!*.js
12+
!*.d.ts
13+
14+
# Exclude jsii outdir
15+
dist
16+
17+
# Include .jsii
18+
!.jsii
19+
20+
# Include .jsii
21+
!.jsii

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/README.md

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# aws-wafwebacl-alb module
2+
<!--BEGIN STABILITY BANNER-->
3+
4+
---
5+
6+
![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge)
7+
8+
> All classes are under active development and subject to non-backward compatible changes or removal in any
9+
> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model.
10+
> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.
11+
12+
---
13+
<!--END STABILITY BANNER-->
14+
15+
| **Reference Documentation**:| <span style="font-weight: normal">https://docs.aws.amazon.com/solutions/latest/constructs/</span>|
16+
|:-------------|:-------------|
17+
<div style="height:8px"></div>
18+
19+
20+
| **Language** | **Package** |
21+
|:-------------|-----------------|
22+
|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_wafwebacl_alb`|
23+
|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-wafwebacl-alb`|
24+
|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.wafwebaclalb`|
25+
26+
## Overview
27+
This AWS Solutions Construct implements an AWS WAF web ACL connected to an Application Load Balancer.
28+
29+
Here is a minimal deployable pattern definition in Typescript:
30+
31+
``` typescript
32+
import { Route53ToAlb } from '@aws-solutions-constructs/aws-route53-alb';
33+
import { WafwebaclToAlbProps, WafwebaclToAlb } from "@aws-solutions-constructs/aws-wafwebacl-alb";
34+
35+
// A constructed ALB is required to be attached to the WAF Web ACL.
36+
// In this case, we are using this construct to create one.
37+
const r53ToAlb = new Route53ToAlb(this, 'Route53ToAlbPattern', {
38+
privateHostedZoneProps: {
39+
zoneName: 'www.example.com',
40+
},
41+
publicApi: false,
42+
logAccessLogs: false
43+
});
44+
45+
// This construct can only be attached to a configured Application Load Balancer.
46+
new WafwebaclToAlb(this, 'test-wafwebacl-alb', {
47+
existingLoadBalancerObj: r53ToAlb.loadBalancer
48+
});
49+
```
50+
51+
## Initializer
52+
53+
``` text
54+
new WafwebaclToAlb(scope: Construct, id: string, props: WafwebaclToAlbProps);
55+
```
56+
57+
_Parameters_
58+
59+
* scope [`Construct`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.Construct.html)
60+
* id `string`
61+
* props [`WafwebaclToAlbProps`](#pattern-construct-props)
62+
63+
## Pattern Construct Props
64+
65+
| **Name** | **Type** | **Description** |
66+
|:-------------|:----------------|-----------------|
67+
|existingLoadBalancerObj|[`elbv2.ApplicationLoadBalancer`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html)|The existing Application Load Balancer Object that will be protected with the WAF web ACL. *Note that a WAF web ACL can only be added to a configured Application Load Balancer, so this construct only accepts an existing ApplicationLoadBalancer and does not accept applicationLoadBalancerProps.*|
68+
|existingWebaclObj?|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACL.html)|Existing instance of a WAF web ACL, an error will occur if this and props is set.|
69+
|webaclProps?|[`waf.CfnWebACLProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACLProps.html)|Optional user-provided props to override the default props for the AWS WAF web ACL. To use a different collection of managed rule sets, specify a new rules property. Use our [`wrapManagedRuleSet(managedGroupName: string, vendorName: string, priority: number)`](../core/lib/waf-defaults.ts) function from core to create an array entry from each desired managed rule set.|
70+
71+
## Pattern Properties
72+
73+
| **Name** | **Type** | **Description** |
74+
|:-------------|:----------------|-----------------|
75+
|webacl|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACL.html)|Returns an instance of the waf.CfnWebACL created by the construct.|
76+
|loadBalancer|[`elbv2.ApplicationLoadBalancer`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html)|Returns an instance of the Application Load Balancer Object created by the pattern. |
77+
78+
## Default settings
79+
80+
Out of the box implementation of the Construct without any override will set the following defaults:
81+
82+
### AWS WAF
83+
* Deploy a WAF web ACL with 7 [AWS managed rule groups](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html).
84+
* AWSManagedRulesBotControlRuleSet
85+
* AWSManagedRulesKnownBadInputsRuleSet
86+
* AWSManagedRulesCommonRuleSet
87+
* AWSManagedRulesAnonymousIpList
88+
* AWSManagedRulesAmazonIpReputationList
89+
* AWSManagedRulesAdminProtectionRuleSet
90+
* AWSManagedRulesSQLiRuleSet
91+
92+
*Note that the default rules can be replaced by specifying the rules property of CfnWebACLProps*
93+
* Send metrics to Amazon CloudWatch
94+
95+
### Application Load Balancer
96+
* User provided Application Load Balancer object is used as-is
97+
98+
## Architecture
99+
![Architecture Diagram](architecture.png)
100+
101+
***
102+
&copy; Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/architecture.png

157 KB
Loading

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/lib/index.ts

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/**
2+
* Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
5+
* with the License. A copy of the License is located at
6+
*
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
10+
* OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
11+
* and limitations under the License.
12+
*/
13+
14+
// Imports
15+
import * as waf from '@aws-cdk/aws-wafv2';
16+
import * as elbv2 from "@aws-cdk/aws-elasticloadbalancingv2";
17+
import * as defaults from '@aws-solutions-constructs/core';
18+
// Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate
19+
import { Construct } from '@aws-cdk/core';
20+
21+
/**
22+
* @summary The properties for the WafwebaclToAlb class.
23+
*/
24+
export interface WafwebaclToAlbProps {
25+
/**
26+
* The existing Application Load Balancer instance that will be protected with the WAF web ACL.
27+
*/
28+
readonly existingLoadBalancerObj: elbv2.ApplicationLoadBalancer,
29+
/**
30+
* Existing instance of a WAF web ACL, an error will occur if this and props is set
31+
*/
32+
readonly existingWebaclObj?: waf.CfnWebACL,
33+
/**
34+
* Optional user-provided props to override the default props for the AWS WAF web ACL.
35+
*
36+
* @default - Default properties are used.
37+
*/
38+
readonly webaclProps?: waf.CfnWebACLProps,
39+
}
40+
41+
/**
42+
* @summary The WafwebaclToAlb class.
43+
*/
44+
export class WafwebaclToAlb extends Construct {
45+
public readonly webacl: waf.CfnWebACL;
46+
public readonly loadBalancer: elbv2.ApplicationLoadBalancer;
47+
/**
48+
* @summary Constructs a new instance of the WafwebaclToAlb class.
49+
* @param {cdk.App} scope - represents the scope for all the resources.
50+
* @param {string} id - this is a a scope-unique id.
51+
* @param {WafwebaclToAlbProps} props - user provided props for the construct.
52+
* @access public
53+
*/
54+
constructor(scope: Construct, id: string, props: WafwebaclToAlbProps) {
55+
super(scope, id);
56+
defaults.CheckProps(props);
57+
58+
// Build the Web ACL
59+
this.webacl = defaults.buildWebacl(this, 'REGIONAL', {
60+
existingWebaclObj: props.existingWebaclObj,
61+
webaclProps: props.webaclProps,
62+
});
63+
64+
// Setup the Web ACL Association
65+
new waf.CfnWebACLAssociation(scope, `${id}-WebACLAssociation`, {
66+
webAclArn: this.webacl.attrArn,
67+
resourceArn: props.existingLoadBalancerObj.loadBalancerArn
68+
});
69+
70+
this.loadBalancer = props.existingLoadBalancerObj;
71+
}
72+
}

‎source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/package.json

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
{
2+
"name": "@aws-solutions-constructs/aws-wafwebacl-alb",
3+
"version": "0.0.0",
4+
"description": "CDK constructs for defining an AWS web WAF connected to an Application Load Balancer.",
5+
"main": "lib/index.js",
6+
"types": "lib/index.d.ts",
7+
"repository": {
8+
"type": "git",
9+
"url": "https://github.com/awslabs/aws-solutions-constructs.git",
10+
"directory": "source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb"
11+
},
12+
"author": {
13+
"name": "Amazon Web Services",
14+
"url": "https://aws.amazon.com",
15+
"organization": true
16+
},
17+
"license": "Apache-2.0",
18+
"scripts": {
19+
"build": "tsc -b .",
20+
"lint": "eslint -c ../eslintrc.yml --ext=.js,.ts . && tslint --project .",
21+
"lint-fix": "eslint -c ../eslintrc.yml --ext=.js,.ts --fix .",
22+
"test": "jest --coverage",
23+
"clean": "tsc -b --clean",
24+
"watch": "tsc -b -w",
25+
"integ": "cdk-integ",
26+
"integ-assert": "cdk-integ-assert",
27+
"integ-no-clean": "cdk-integ --no-clean",
28+
"jsii": "jsii",
29+
"jsii-pacmak": "jsii-pacmak",
30+
"build+lint+test": "npm run jsii && npm run lint && npm test && npm run integ-assert",
31+
"snapshot-update": "npm run jsii && npm test -- -u && npm run integ-assert"
32+
},
33+
"jsii": {
34+
"outdir": "dist",
35+
"targets": {
36+
"java": {
37+
"package": "software.amazon.awsconstructs.services.wafwebaclalb",
38+
"maven": {
39+
"groupId": "software.amazon.awsconstructs",
40+
"artifactId": "wafwebaclalb"
41+
}
42+
},
43+
"dotnet": {
44+
"namespace": "Amazon.Constructs.AWS.WafwebaclAlb",
45+
"packageId": "Amazon.Constructs.AWS.WafwebaclAlb",
46+
"signAssembly": true,
47+
"iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/master/logo/default-256-dark.png"
48+
},
49+
"python": {
50+
"distName": "aws-solutions-constructs.aws-wafwebacl-alb",
51+
"module": "aws_solutions_constructs.aws_wafwebacl_alb"
52+
}
53+
}
54+
},
55+
"dependencies": {
56+
"@aws-cdk/aws-autoscaling": "0.0.0",
57+
"@aws-cdk/aws-ec2": "0.0.0",
58+
"@aws-cdk/aws-elasticloadbalancingv2": "0.0.0",
59+
"@aws-cdk/aws-wafv2": "0.0.0",
60+
"@aws-cdk/core": "0.0.0",
61+
"@aws-solutions-constructs/core": "0.0.0",
62+
"@aws-solutions-constructs/aws-route53-alb": "0.0.0",
63+
"constructs": "^3.2.0"
64+
},
65+
"devDependencies": {
66+
"@aws-cdk/assert": "0.0.0",
67+
"@types/jest": "^26.0.22",
68+
"@types/node": "^10.3.0"
69+
},
70+
"jest": {
71+
"moduleFileExtensions": [
72+
"js"
73+
],
74+
"coverageReporters": [
75+
"text",
76+
[
77+
"lcov",
78+
{
79+
"projectRoot": "../../../../"
80+
}
81+
]
82+
]
83+
},
84+
"peerDependencies": {
85+
"@aws-cdk/aws-autoscaling": "0.0.0",
86+
"@aws-cdk/aws-ec2": "0.0.0",
87+
"@aws-cdk/aws-elasticloadbalancingv2": "0.0.0",
88+
"@aws-cdk/aws-wafv2": "0.0.0",
89+
"@aws-cdk/core": "0.0.0",
90+
"@aws-solutions-constructs/core": "0.0.0",
91+
"@aws-solutions-constructs/aws-route53-alb": "0.0.0",
92+
"constructs": "^3.2.0"
93+
},
94+
"keywords": [
95+
"aws",
96+
"cdk",
97+
"awscdk",
98+
"AWS Solutions Constructs",
99+
"AWS WAF Web ACL",
100+
"Application Load Balancer"
101+
]
102+
}

0 commit comments

Comments
 (0)