{"id":28211546,"url":"https://github.com/enfogroup/aws-cdk-waf","last_synced_at":"2026-04-27T08:31:24.851Z","repository":{"id":57699793,"uuid":"500703181","full_name":"enfogroup/aws-cdk-waf","owner":"enfogroup","description":"NPM package wrapper around CDK L1 Construct WebAcl","archived":false,"fork":false,"pushed_at":"2023-08-02T08:17:18.000Z","size":667,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-09-23T16:45:06.923Z","etag":null,"topics":["cdk","npm-package","waf","webacl"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/enfogroup.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-07T05:35:14.000Z","updated_at":"2024-04-25T23:43:05.000Z","dependencies_parsed_at":"2024-11-22T01:33:04.106Z","dependency_job_id":"d9b6248d-db42-47b1-838c-251cef4f66ec","html_url":"https://github.com/enfogroup/aws-cdk-waf","commit_stats":{"total_commits":47,"total_committers":2,"mean_commits":23.5,"dds":0.06382978723404253,"last_synced_commit":"8bbab99c1b637df0d6a8047cc8e74f509b1e129c"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/enfogroup/aws-cdk-waf","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enfogroup%2Faws-cdk-waf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enfogroup%2Faws-cdk-waf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enfogroup%2Faws-cdk-waf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enfogroup%2Faws-cdk-waf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/enfogroup","download_url":"https://codeload.github.com/enfogroup/aws-cdk-waf/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/enfogroup%2Faws-cdk-waf/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32329462,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cdk","npm-package","waf","webacl"],"created_at":"2025-05-17T18:09:37.726Z","updated_at":"2026-04-27T08:31:24.842Z","avatar_url":"https://github.com/enfogroup.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Introduction\n\nThis package exposes an opinionated Construct for setting up an AWS WebAcl using the CDK. Five custom rules are ready to be enabled. If you are not using the custom rules this package will not bring you much value.\n\n# Installation\n\nInstall the package by running\n\n```bash\nnpm install @enfo/cdk-webacl\n```\n\n# Getting started\n\n## Quick start\n\nThis is example is the least amount of configuration you have to do in order for the WebAcl to be created\n\n```typescript\nimport { WebAcl, Scope } from '@enfo/cdk-webacl'\nimport { Stack } from 'aws-cdk-lib'\nimport { RestApi } from 'aws-cdk-lib/aws-apigateway'\nimport { CfnWebACLAssociation } from 'aws-cdk-lib/aws-wafv2'\nimport { Distribution } from 'aws-cdk-lib/aws-cloudfront'\n\nconst stack = new Stack()\nconst webacl = new WebAcl(stack, 'MyWebAcl', {\n  scope: Scope.REGIONAL,\n  metricName: 'my-metric',\n  defaultAction: {\n    allow: {}\n  }\n})\n  .enableIpBlockRule()\n  .enableRateLimitRule()\n  .enableIpReputationRule()\n  .enableManagedCoreRule()\n  .enableBadInputsRule()\n\n// associating it with an API\nconst api = new RestApi(stack, 'Api')\napi.root.addMethod('GET')\nnew CfnWebACLAssociation(this, 'ApiAssociation', {\n  webAclArn: webacl.attrArn,\n  resourceArn: `arn:aws:apigateway:${Stack.of(stack).region}::/restapis/${api.deploymentStage.restApi.restApiId}/stages/${api.deploymentStage.stageName}`\n});\n\n// associating it with a CloudFront Distribution\nnew Distribution(stack, 'Distribution', {\n  webAclId: webacl.attrArn,\n  // more properties\n})\n```\n\n## Configuration options\n\nThe WebAcl and all rules can be configured.\n\n### WebAcl configuration\n\nThe WebAcl Construct takes an object with the interface WebAclProps which supports all properties from CfnWebAclProps except:\n\n* scope, this has been replaced with an enum instead of a string\n* visibilityConfig, this has been removed and its properties flattened into WebAclProps. Only metricName is mandatory\n\nExample of unique configuration options unique to WebAcl:\n\n```typescript\nnew WebAcl(stack, 'MyWebAcl', {\n  scope: Scope.CLOUDFRONT,\n  metricName: 'my-metric',\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true,\n  defaultAction: { // not unique but must be included\n    allow: {}\n  }\n})\n```\n\n### Rules configurations\n\nYou can only enable a rule **ONCE**. Attempting to enable a rule twice will result in an Error being thrown.\n\nAll rules share the same base interface. The following properties have been modified from CfnWebACL.RuleProperty:\n\n* name, no longer mandatory, has a rule specific default\n* priority, no longer mandatory, has a rule specific default\n* statement, removed and some properties flattered into rule properties for rules using AWS Managed Rule Groups ( IP Reputation, Managed Core and Bad Inputs)\n* visibilityConfig, removed and properties flatted into rule properties\n* action, removed from all rules but IP Block\n* overrideAction, set to `{ none: {} }` on all rules but IP Block\n\n### enableIpBlockRule configuration\n\nYou can read about IP set rules [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html). The IP Block rule supports more properties than other rules. These have been grabbed from CfnIPSetProps, some have been replaced, others removed:\n\n* ipSetName, name you want for the IP Set\n* ipSetDescription, description you want for the IP Set\n* addresses, no longer mandatory\n* ipAddressVersion, replaced with enum instead of a string\n* ipSetTags\n\nExample of enableIpBlockRule options:\n\n```typescript\nnew WebAcl(...)\n.enableIpBlockRule({\n  name: 'cool-name', // default 'ip-block'\n  priority: 1, // default 10\n  metricName: 'something', // default 'ip-block'\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true,\n  action: {\n    allow: {}\n  }\n})\n```\n\nCustomizing the IP Set:\n\n```typescript\nnew WebAcl(stack, 'WebAcl', {\n  scope: Scope.REGIONAL,\n  metricName: 'something',\n  defaultAction: {\n    allow: {}\n  }\n})\n  .enableIpBlockRule({\n    ipSetName: 'my-set',\n    ipSetDescription: 'desc',\n    addresses: ['2001:0db8:85a3:0000:0000:8a2e:0370:7334'],\n    ipAddressVersion: IpAddressVersion.IPV6,\n    ipSetTags: [\n      {\n        key: 'key!',\n        value: 'value!'\n      }\n    ]\n  })\n```\n\nYou can also supply your own IP Set:\n\n```typescript\nconst ipSet = new CfnIPSet(stack, 'MySet', {\n  scope: 'REGIONAL',\n  name: 'my-set',\n  addresses: [],\n  ipAddressVersion: 'IPV4'\n})\n\nnew WebAcl(stack, 'WebAcl', {\n  scope: Scope.REGIONAL,\n  metricName: 'something',\n  defaultAction: {\n    allow: {}\n  }\n})\n  .enableIpBlockRule({\n    ipSet\n  })\n```\n\nIf an IP Set is supplied WebAcl will not create one\n\n### enableRateLimitRule configuration\n\nYou can read about rate limit rules [here](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html). The Rate Limit rule supports one property extra than the other rules:\n\n* rateLimit, defaults to 1000\n\nExample of options:\n\n```typescript\nnew WebAcl(...)\n.enableRateLimitRule({\n  name: 'cool-name', // default 'rate-limit'\n  priority: 1, // default 20\n  metricName: 'something', // default 'rate-limit'\n  rateLimit: 1337,\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true\n})\n```\n\n### enableIpReputationRule configuration\n\nYou can read about IP reputation rules [here](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html). Example of enableIpReputationRule options:\n\n```typescript\nnew WebAcl(...)\n.enableIpReputationRule({\n  name: 'cool-name', // default 'ip-reputation'\n  priority: 1, // default 30\n  metricName: 'something', // default 'ip-reputation'\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true,\n  excludedRules: [{ name: 'wow' }],\n  managedRuleGroupConfigs: [{ loginPath: 'login!' }],\n  scopeDownStatement: { managedRuleGroupStatement: { vendorName: 'Enfo', name: 'NotReals' } }\n})\n```\n\n### enableManagedCoreRule configuration\n\nYou can read about the AWS core rules [here](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html). Example of enableManagedCoreRule options:\n\n```typescript\nnew WebAcl(...)\n.enableManagedCoreRule({\n  name: 'cool-name', // default 'managed-core'\n  priority: 1, // default 40\n  metricName: 'something', // default 'managed-core'\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true,\n  excludedRules: [{ name: 'wow' }],\n  managedRuleGroupConfigs: [{ loginPath: 'login!' }],\n  scopeDownStatement: { managedRuleGroupStatement: { vendorName: 'Enfo', name: 'NotReals' } }\n})\n```\n\n### enableBadInputsRule configuration\n\nYou can read about the AWS bad inputs rules [here](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-known-bad-inputs). Example of enableBadInputsRule options:\n\n```typescript\nnew WebAcl(...)\n.enableBadInputsRule({\n  name: 'cool-name', // default 'bad-inputs'\n  priority: 1, // default 50\n  metricName: 'something', // default 'bad-inputs'\n  cloudWatchMetricsEnabled: true,\n  sampledRequestsEnabled: true,\n  excludedRules: [{ name: 'wow' }],\n  managedRuleGroupConfigs: [{ loginPath: 'login!' }],\n  scopeDownStatement: { managedRuleGroupStatement: { vendorName: 'Enfo', name: 'NotReals' } }\n})\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenfogroup%2Faws-cdk-waf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fenfogroup%2Faws-cdk-waf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fenfogroup%2Faws-cdk-waf/lists"}