import * as cdk from '@aws-cdk/core' ; import waf = require ( '@aws-cdk/aws-wafv2' ) ; export interface WafStackProps extends cdk . StackProps { gatewayARN : string ; } export class TheWafStack extends cdk . Stack { constructor ( scope , id , props ) { super ( scope , id , props ) ; /**
         * Setup WAF Rules
         */ let wafRules = [ ] ; let awsManagedRules = { name : 'AWS-AWSManagedRulesCommonRuleSet' , priority : 1 , overrideAction : { none : { } } , statement : { managedRuleGroupStatement : { name : 'AWSManagedRulesCommonRuleSet' , vendorName : 'AWS' , excludedRules : [ { name : 'SizeRestrictions_BODY' } ] } } , visibilityConfig : { cloudWatchMetricsEnabled : true , metricName : 'awsCommonRules' , sampledRequestsEnabled : true } } ; wafRules . push ( awsManagedRules ) ; let awsAnonIPList = { name : 'awsAnonymousIP' , priority : 2 , overrideAction : { none : { } } , statement : { managedRuleGroupStatement : { name : 'AWSManagedRulesAnonymousIpList' , vendorName : 'AWS' , excludedRules : [ ] } } , visibilityConfig : { cloudWatchMetricsEnabled : true , metricName : 'awsAnonymous' , sampledRequestsEnabled : true } } ; wafRules . push ( awsAnonIPList ) ; let awsIPRepList = { name : 'awsIPReputation' , priority : 3 , overrideAction : { none : { } } , statement : { managedRuleGroupStatement : { name : 'AWSManagedRulesAmazonIpReputationList' , vendorName : 'AWS' , excludedRules : [ ] } } , visibilityConfig : { cloudWatchMetricsEnabled : true , metricName : 'awsReputation' , sampledRequestsEnabled : true } } ; wafRules . push ( awsIPRepList ) ; let geoBlockRule = { name : 'geoblockRule' , priority : 4 , action : { block : { } } , statement : { geoMatchStatement : { countryCodes : [ 'NZ' ] } } , visibilityConfig : { cloudWatchMetricsEnabled : true , metricName : 'geoBlock' , sampledRequestsEnabled : true } } ; wafRules . push ( geoBlockRule ) ; /**
         * Create and Associate ACL with Gateway
         */ let webACL = new waf . CfnWebACL ( this , 'WebACL' , { defaultAction : { allow : { } } , scope : 'REGIONAL' , visibilityConfig : { cloudWatchMetricsEnabled : true , metricName : 'webACL' , sampledRequestsEnabled : true } , rules : wafRules } ) ; new waf . CfnWebACLAssociation ( this , 'WebACLAssociation' , { webAclArn : webACL . attrArn , resourceArn : props . gatewayARN } ) ; } }