From cd5c4f432123983af7bd89477044e7639e7c8e75 Mon Sep 17 00:00:00 2001 From: mickychetta <45010053+mickychetta@users.noreply.github.com> Date: Tue, 19 Oct 2021 13:13:02 -0700 Subject: [PATCH] feat(aws-wafwebacl-alb): created aws-wafwebacl-alb construct (#465) * created README for aws-wafwebacl-alb * updated README * created wafwebacl-alb construct * updated file name * added cfn suppress rules * changed r53toAlb construct to just alb --- .../aws-wafwebacl-alb/.eslintignore | 4 + .../aws-wafwebacl-alb/.gitignore | 15 + .../aws-wafwebacl-alb/.npmignore | 21 + .../aws-wafwebacl-alb/README.md | 102 ++ .../aws-wafwebacl-alb/architecture.png | Bin 0 -> 160765 bytes .../aws-wafwebacl-alb/lib/index.ts | 72 ++ .../aws-wafwebacl-alb/package.json | 102 ++ .../test/integ.no-arguments.expected.json | 915 ++++++++++++++++++ .../test/integ.no-arguments.ts | 50 + .../test/test.wafwebacl-alb.test.ts | 317 ++++++ .../aws-wafwebacl-apigateway/README.md | 2 +- 11 files changed, 1599 insertions(+), 1 deletion(-) create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.eslintignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.gitignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.npmignore create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/README.md create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/architecture.png create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/lib/index.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/package.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/test/integ.no-arguments.expected.json create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/test/integ.no-arguments.ts create mode 100644 source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/test/test.wafwebacl-alb.test.ts diff --git a/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.eslintignore b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.eslintignore new file mode 100644 index 000000000..910cb0513 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.eslintignore @@ -0,0 +1,4 @@ +lib/*.js +test/*.js +*.d.ts +coverage \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.gitignore b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.gitignore new file mode 100644 index 000000000..6773cabd2 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.gitignore @@ -0,0 +1,15 @@ +lib/*.js +test/*.js +*.js.map +*.d.ts +node_modules +*.generated.ts +dist +.jsii + +.LAST_BUILD +.nyc_output +coverage +.nycrc +.LAST_PACKAGE +*.snk \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.npmignore b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.npmignore new file mode 100644 index 000000000..f66791629 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/.npmignore @@ -0,0 +1,21 @@ +# Exclude typescript source and config +*.ts +tsconfig.json +coverage +.nyc_output +*.tgz +*.snk +*.tsbuildinfo + +# Include javascript files and typescript declarations +!*.js +!*.d.ts + +# Exclude jsii outdir +dist + +# Include .jsii +!.jsii + +# Include .jsii +!.jsii \ No newline at end of file diff --git a/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/README.md b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/README.md new file mode 100644 index 000000000..bbcd7e292 --- /dev/null +++ b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/README.md @@ -0,0 +1,102 @@ +# aws-wafwebacl-alb module + + +--- + +![Stability: Experimental](https://img.shields.io/badge/stability-Experimental-important.svg?style=for-the-badge) + +> All classes are under active development and subject to non-backward compatible changes or removal in any +> future version. These are not subject to the [Semantic Versioning](https://semver.org/) model. +> This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package. + +--- + + +| **Reference Documentation**:| https://docs.aws.amazon.com/solutions/latest/constructs/| +|:-------------|:-------------| +
+ + +| **Language** | **Package** | +|:-------------|-----------------| +|![Python Logo](https://docs.aws.amazon.com/cdk/api/latest/img/python32.png) Python|`aws_solutions_constructs.aws_wafwebacl_alb`| +|![Typescript Logo](https://docs.aws.amazon.com/cdk/api/latest/img/typescript32.png) Typescript|`@aws-solutions-constructs/aws-wafwebacl-alb`| +|![Java Logo](https://docs.aws.amazon.com/cdk/api/latest/img/java32.png) Java|`software.amazon.awsconstructs.services.wafwebaclalb`| + +## Overview +This AWS Solutions Construct implements an AWS WAF web ACL connected to an Application Load Balancer. + +Here is a minimal deployable pattern definition in Typescript: + +``` typescript +import { Route53ToAlb } from '@aws-solutions-constructs/aws-route53-alb'; +import { WafwebaclToAlbProps, WafwebaclToAlb } from "@aws-solutions-constructs/aws-wafwebacl-alb"; + +// A constructed ALB is required to be attached to the WAF Web ACL. +// In this case, we are using this construct to create one. +const r53ToAlb = new Route53ToAlb(this, 'Route53ToAlbPattern', { + privateHostedZoneProps: { + zoneName: 'www.example.com', + }, + publicApi: false, + logAccessLogs: false +}); + +// This construct can only be attached to a configured Application Load Balancer. +new WafwebaclToAlb(this, 'test-wafwebacl-alb', { + existingLoadBalancerObj: r53ToAlb.loadBalancer +}); +``` + +## Initializer + +``` text +new WafwebaclToAlb(scope: Construct, id: string, props: WafwebaclToAlbProps); +``` + +_Parameters_ + +* scope [`Construct`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.Construct.html) +* id `string` +* props [`WafwebaclToAlbProps`](#pattern-construct-props) + +## Pattern Construct Props + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +|existingLoadBalancerObj|[`elbv2.ApplicationLoadBalancer`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html)|The existing Application Load Balancer Object that will be protected with the WAF web ACL. *Note that a WAF web ACL can only be added to a configured Application Load Balancer, so this construct only accepts an existing ApplicationLoadBalancer and does not accept applicationLoadBalancerProps.*| +|existingWebaclObj?|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACL.html)|Existing instance of a WAF web ACL, an error will occur if this and props is set.| +|webaclProps?|[`waf.CfnWebACLProps`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACLProps.html)|Optional user-provided props to override the default props for the AWS WAF web ACL. To use a different collection of managed rule sets, specify a new rules property. Use our [`wrapManagedRuleSet(managedGroupName: string, vendorName: string, priority: number)`](../core/lib/waf-defaults.ts) function from core to create an array entry from each desired managed rule set.| + +## Pattern Properties + +| **Name** | **Type** | **Description** | +|:-------------|:----------------|-----------------| +|webacl|[`waf.CfnWebACL`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-waf.CfnWebACL.html)|Returns an instance of the waf.CfnWebACL created by the construct.| +|loadBalancer|[`elbv2.ApplicationLoadBalancer`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-elasticloadbalancingv2.ApplicationLoadBalancer.html)|Returns an instance of the Application Load Balancer Object created by the pattern. | + +## Default settings + +Out of the box implementation of the Construct without any override will set the following defaults: + +### AWS WAF +* Deploy a WAF web ACL with 7 [AWS managed rule groups](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-list.html). + * AWSManagedRulesBotControlRuleSet + * AWSManagedRulesKnownBadInputsRuleSet + * AWSManagedRulesCommonRuleSet + * AWSManagedRulesAnonymousIpList + * AWSManagedRulesAmazonIpReputationList + * AWSManagedRulesAdminProtectionRuleSet + * AWSManagedRulesSQLiRuleSet + + *Note that the default rules can be replaced by specifying the rules property of CfnWebACLProps* +* Send metrics to Amazon CloudWatch + +### Application Load Balancer +* User provided Application Load Balancer object is used as-is + +## Architecture +![Architecture Diagram](architecture.png) + +*** +© Copyright 2021 Amazon.com, Inc. or its affiliates. All Rights Reserved. diff --git a/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/architecture.png b/source/patterns/@aws-solutions-constructs/aws-wafwebacl-alb/architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..039628bf36df993db2208150b03914595a0f43a5 GIT binary patch literal 160765 zcmZ^~1z40_*ET$KNGS-?jVMT`)X?3XLpL+@&@Ct^C5m)N2uOFAv~)`=(%sE>ao^AT zA1}Pme;iD3&7M7L@4eQ!&K1`?6(wnGOcG2G2!t&wBcTQYp$q{JE_77j$`l1R3h;v9 zq9!c{DjFbL2Z2xvTqSi}9Xu>;>@7g_oZ|n!qvv3=hPk-Xb4t*2aF{!rz-?eGW-w<* z783^(FBlYf?*M!NjBK vu54*wLhbB12hFDaO?_nX(^7L*><*Cic2lbca!n_7;_!*5snkOVti@j`6{o0
zyo(~Z!LwX(JD+!a|21Zq-v#mCh*a?2A#28)cG