AWS WAF CDK Python 如何更改规则操作

Question

这是我的 python cdk 代码，它创建了 2 条规则“AWS-AWSManagedRulesCommonRuleSet”和“AWS-AWS-ManagedRulesAmazonIpReputationList”。在每条规则中都有子规则，我可以将它们的 Rule Actions 更改为 Count，问题是如何将其添加到我的代码中，我没有找到对这些子规则的任何好的解释规则。

添加了一些更改但仍然无效，我收到此错误：

Resource handler returned message: "Error reason: You have used none or multiple values for a field that requires exactly one value., field: RULE, parameter: Rule (Service: Wafv2, Status Code: 400, Request ID: 248d9235-bd01-49f4-963b-109bac2776c5, Extended Request ID: null)" (RequestToken: 8bb5****-****-3e95-****- 
8e336ae3eed4, HandlerErrorCode: InvalidRequest)

代码：

class PyCdkStack(core.Stack):

def __init__(self, scope: core.Construct, construct_id: str, **kwargs) -> None:
    super().__init__(scope, construct_id, **kwargs)

    web_acl = wafv2.CfnWebACL(
        scope_=self, id='WebAcl',
        default_action=wafv2.CfnWebACL.DefaultActionProperty(allow={}),
        scope='REGIONAL',
        visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
            cloud_watch_metrics_enabled=True,
            sampled_requests_enabled=True,
            metric_name='testwafmetric',
        ),
        name='Test-Test-WebACL',
        rules=[
            {
                'name': 'AWS-AWSManagedRulesCommonRuleSet',
                'priority': 1,
                'statement': {
                    'RuleGroupReferenceStatement': {
                        'vendorName': 'AWS',
                        'name': 'AWSManagedRulesCommonRuleSet',
                        'ARN': 'string',
                        "ExcludedRules": [
                            {
                                "Name": "CrossSiteScripting_QUERYARGUMENTS"
                            },
                            {
                                "Name": "GenericLFI_QUERYARGUMENTS"
                            },
                            {
                                "Name": "GenericRFI_QUERYARGUMENTS"
                            },
                            {
                                "Name": "NoUserAgent_HEADER"
                            },
                            {
                                "Name": "SizeRestrictions_QUERYSTRING"
                            }
                        ]
                    }
                },
                'overrideAction': {
                    'none': {}
                },
                'visibilityConfig': {
                    'sampledRequestsEnabled': True,
                    'cloudWatchMetricsEnabled': True,
                    'metricName': "AWS-AWSManagedRulesCommonRuleSet"
                }
            },
        ]
    )

Answer 1

Cfn- 构造是到 cloudformation 资源的一对一映射。您可以简单地查看 aws::wafv2::webacl.

的文档

有关如何在 cloudformation 中排除的示例，请参见下文。请注意，对象键需要以小写字母开头，以便 CDK 处理它们。

{
    "name": "AWS-AWSBotControl-Example",
   "priority": 5, 
   "statement": {
    "managedRuleGroupStatement": {
        "vendorName": "AWS",
        "name": "AWSManagedRulesBotControlRuleSet",
        "excludedRules": [
            {
                "name": "CategoryVerifiedSearchEngine"
            },
            {
                "name": "CategoryVerifiedSocialMedia"
            }
        ]
    },
   "visibilityConfig": {
       "sampledRequestsEnabled": true,
       "cloudWatchMetricsEnabled": true,
       "metricName": "AWS-AWSBotControl-Example"
   }
}

这实际上将提到的两个规则设置为计数模式。参见 https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-rule-group-settings.html#web-acl-rule-group-rule-to-count。注意它说：

Rules that you alter like this are described as being excluded rules in the rule group. If you have metrics enabled, you receive COUNT metrics for each excluded rule. This change alters how the rules in the rule group are evaluated.

AWS WAF CDK Python 如何更改规则操作

AWS WAF CDK Python How to change rule action

python

amazon-web-services

aws-cdk

web-application-firewall