# Creates a WAF web ACL with some rules and exports the ID. This template is
# not designed to be generic or reusable. It represents a specific
# implementation of a WAF deployment
AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Sample WAF template
Resources:
  WebAcl:
    Type: AWS::WAF::WebACL
    Properties:
      DefaultAction:
        Type: ALLOW
      MetricName: WebAclMetricName
      Name: !Ref WebAclName
      Rules:
        - Action:
            Type: BLOCK
          Priority: 1
          RuleId: !Ref IpBlacklistRule
        - Action:
            Type: BLOCK
          Priority: 2
          RuleId: !Ref UserAgentBlacklistRule
        - Action:
            Type: COUNT
          Priority: 3
          RuleId: !Ref IpCounterRule
  IpBlacklistRule:
    Type: AWS::WAF::Rule
    Properties:
      Name: IpBlacklist
      MetricName: IpBlacklist
      Predicates:
        - DataId: !Ref IpBlacklistIpSet
          Negated: false
          Type: IPMatch
  IpBlacklistIpSet:
    Type: AWS::WAF::IPSet
    Properties:
      Name: IpBlacklistIpSet
      IPSetDescriptors:
        - Type: IPV4
          Value: "192.0.2.44/32"
        - Type: IPV4
          Value: "192.0.7.0/24"
  IpCounterRule:
    Type: AWS::WAF::Rule
    Properties:
      Name: IpCounter
      MetricName: IpCounter
      Predicates:
        - DataId: !Ref IpCounterIpSet
          Negated: false
          Type: IPMatch
  IpCounterIpSet:
    Type: AWS::WAF::IPSet
    Properties:
      Name: IpCounterIpSet
      IPSetDescriptors:
        - Type: IPV4
          Value: "10.0.0.4/32"
  UserAgentBlacklistRule:
    Type: AWS::WAF::Rule
    Properties:
      Name: UserAgentBlacklist
      MetricName: UserAgentBlacklist
      Predicates:
        - DataId: !Ref UserAgentBlacklistByteMatchSet
          Negated: false
          Type: ByteMatch
  UserAgentBlacklistByteMatchSet:
    Type: AWS::WAF::ByteMatchSet
    Properties:
      Name: UserAgentBlacklistByteMatchSet
      ByteMatchTuples:
        - FieldToMatch:
            Type: HEADER
            Data: user-agent
          PositionalConstraint: CONTAINS
          TargetString: amiga
          TextTransformation: LOWERCASE
        - FieldToMatch:
            Type: HEADER
            Data: user-agent
          PositionalConstraint: STARTS_WITH
          TargetString: mozilla
          TextTransformation: LOWERCASE

Add boilerplate sample WAF template
Add boilerplate sample WAF template
