How to add AWS WAF to an ALB via CloudFormation
To solve this I browsed through their release history and found the CloudFormation resources that were updated to support WAF & ALB http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ReleaseHistory.html From there I was able to deduce that the linking component is a WebACLAssociation that maps WAF and ALB. But this also requires that instead of a normal WebACL you must use the WAFRegional. So far it seems to only mean changing ::WAF to ::WAFRegional throughout your code.
WAFRegional (AWS::WAFRegional::WebACL): http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-webacl.html
"MyWebACL": {
"Type": "AWS::WAFRegional::WebACL",
"Properties": {
"Name": "WebACL to with three rules",
"DefaultAction": {
"Type": "ALLOW"
},
"MetricName" : "MyWebACL",
"Rules": [
{
"Action" : {
"Type" : "BLOCK"
},
"Priority" : 1,
"RuleId" : { "Ref" : "MyRule" }
},
{
"Action" : {
"Type" : "BLOCK"
},
"Priority" : 2,
"RuleId" : { "Ref" : "BadReferersRule" }
},
{
"Action" : {
"Type" : "BLOCK"
},
"Priority" : 3,
"RuleId" : { "Ref" : "SqlInjRule" }
}
]
}
}
WebACLAssociation (AWS::WAFRegional::WebACLAssociation) http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-webaclassociation.html
"MyWebACLAssociation": {
"Type": "AWS::WAFRegional::WebACLAssociation",
"Properties": {
"ResourceArn": { "Ref": "MyLoadBalancer" },
"WebACLId": { "Ref": "MyWebACL" }
}
}
Below is the example in YAML format.
Resources:
WafAcldev:
DependsOn: Whitelist
DependsOn: WafRule
Type: AWS::WAF::WebACL
Condition: CreateDEVResources
Properties:
DefaultAction:
Type: "BLOCK"
MetricName: test
Name: test
Rules:
-
Action:
Type: "ALLOW"
Priority: 1
RuleId: !Ref WafRule
WafRule:
DependsOn: WhitelistIPdev
Type: AWS::WAF::Rule
Condition: CreateDEVResources
Properties:
MetricName: test
Name: test
Predicates:
-
DataId:
Ref: "Whitelist"
Negated: false
Type: "IPMatch"
MyWebACLAssociation:
Type: "AWS::WAFRegional::WebACLAssociation"
Properties:
ResourceArn: arn:aws:elasticloadbalancing:us-east-2:123456789012:listener/app/my-load-balancer/1234567890123456/1234567890123456
WebACLId:
Ref: WafAcldev
Whitelist:
Type: AWS::WAF::IPSet
Condition: CreateDEVResources
Properties:
Name: "IPSet for Whitelisted IP adresses"
IPSetDescriptors:
-
Type: "IPV4"
Value: "213.126.223.11/32"
-