Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aws - rest-stage - add regex match support for wafv2-enabled filter and set-wafv2 action #7946

Merged
merged 43 commits into from
Dec 14, 2022

Conversation

kk1532
Copy link
Contributor

@kk1532 kk1532 commented Oct 27, 2022

Added regex feature to wafv2-enabled filter of rest-stage.

policies:
  - name: filter-wafv2-apigw
    resource: rest-stage
    filters:
      - type: wafv2-enabled
        state: true
        web-acl: .*FMManagedWebACLV2-?FMS-.*

This fix supports local WAF and FMS based WAF.

Also Added set-wafv2 filter to support regex format.

kk1532 and others added 30 commits April 5, 2022 06:17
mu - changes on LambdaRetry max_attempts
Also rename/shorten the ignore parameter for readability.
@kk1532 kk1532 requested a review from kapilt as a code owner October 31, 2022 08:22
re.match(target_acl, k)]
if len(target_acl_ids) != 1 or \
('arn' not in target_acl_ids[0]):
raise ValueError(f'{target_acl} matching to none or the '
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: the can be omitted.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change has been taken care.

wafs = self.manager.get_resource_manager('wafv2').resources(augment=False)
waf_name_arn_map = {w['Name']: w['ARN'] for w in wafs}
target_acl_id = waf_name_arn_map.get(target_acl, target_acl)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kk1532 ,
Since wafv2-enabled and set-wafv2 are common for cloudfront, appsync, can we make same logic? You can refer to pr/7706 for cloudfront wafv2-enabled as well.

Copy link
Contributor Author

@kk1532 kk1532 Nov 11, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cahn1 wafv2-enabled filter has been updated with cloudfront logic.

@StevenGunn
Copy link
Contributor

@kapilt can you please check out the updated code when you get a chance?

CC: @kk1532 @darrendao @cahn1

@kapilt
Copy link
Collaborator

kapilt commented Nov 21, 2022 via email

@darrendao darrendao changed the title Apigwwaf aws - rest-stage - wafv2 Nov 22, 2022
Copy link
Member

@thisisshi thisisshi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, lgtm

@thisisshi thisisshi changed the title aws - rest-stage - wafv2 aws - rest-stage - add regex match support for wafv2-enabled filter and set-wafv2 action Dec 8, 2022
@ajkerrigan ajkerrigan merged commit 1540bdf into cloud-custodian:master Dec 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants