wafv2_web_acl

Create and delete WAF Web ACLs

Collection: community.aws

Full Name: community.aws.wafv2_web_acl

Synopsis

Create and delete WAF Web ACLs

Parameters

Name	Type	Required	Default
access_key	str
aws_ca_bundle	path
aws_config	dict
cloudwatch_metrics	bool		`true`
custom_response_bodies	dict
debug_botocore_endpoint_logs	bool		`false`
default_action	str
description	str
endpoint_url	str
metric_name	str
name	str	yes
profile	str
purge_rules	bool		`true`
purge_tags	bool		`true`
region	str
rules	list
sampled_requests	bool		`false`
scope	str	yes
secret_key	str
session_token	str
state	str	yes
tags	dict
validate_certs	bool		`true`

Example

yaml

- name: Create test web acl
  community.aws.wafv2_web_acl:
    name: test05
    description: hallo eins
    scope: REGIONAL
    default_action: Allow
    sampled_requests: false
    cloudwatch_metrics: true
    metric_name: test05-acl-metric
    rules:
        - name: zwei
          priority: 0
          action:
            block: {}
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: ddos
          statement:
            xss_match_statement:
                field_to_match:
                    body: {}
                text_transformations:
                    - type: NONE
                      priority: 0
        - name: admin_protect
          priority: 1
          override_action:
            none: {}
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: fsd
          statement:
            managed_rule_group_statement:
                vendor_name: AWS
                name: AWSManagedRulesAdminProtectionRuleSet
        # AWS Managed Bad Input Rule Set
        # but allow PROPFIND_METHOD used e.g. by webdav
        - name: bad_input_protect_whitelist_webdav
          priority: 2
          override_action:
            none: {}
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: bad_input_protect
          statement:
            managed_rule_group_statement:
                vendor_name: AWS
                name: AWSManagedRulesKnownBadInputsRuleSet
                excluded_rules:
                    - name: PROPFIND_METHOD
        # Rate Limit example. 1500 req/5min
        # counted for two domains via or_statement. login.mydomain.tld and api.mydomain.tld
        - name: rate_limit_example
          priority: 3
          action:
            block: {}
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: mydomain-ratelimit
          statement:
            rate_based_statement:
                limit: 1500
                aggregate_key_type: IP
                evaluation_window_sec: 300 # Time window in seconds (60, 120, 300, or 600). Default is 300.
                scope_down_statement:
                    or_statement:
                        statements:
                            - byte_match_statement:
                                search_string: login.mydomain.tld
                                positional_constraint: CONTAINS
                                field_to_match:
                                    single_header:
                                        name: host
                                text_transformations:
                                    - type: LOWERCASE
                                      priority: 0
                            - byte_match_dtatement:
                                search_string: api.mydomain.tld
                                positional_constraint: CONTAINS
                                field_to_match:
                                    single_header:
                                        name: host
                                text_transformations:
                                    - type: LOWERCASE
                                      priority: 0
    purge_rules: true
    tags:
        A: B
        C: D
    state: present

- name: Create IP filtering web ACL
  community.aws.wafv2_web_acl:
    name: ip-filtering-traffic
    description: ACL that filters web traffic based on rate limits and whitelists some IPs
    scope: REGIONAL
    default_action: Allow
    sampled_requests: true
    cloudwatch_metrics: true
    metric_name: ip-filtering-traffic
    rules:
        - name: whitelist-own-IPs
          priority: 0
          action:
            allow: {}
          statement:
            ip_set_reference_statement:
                arn: 'arn:aws:wafv2:us-east-1:123456789012:regional/ipset/own-public-ips/1c4bdfc4-0f77-3b23-5222-123123123'
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: waf-acl-rule-whitelist-own-IPs
        - name: rate-limit-per-IP
          priority: 1
          action:
            block:
                custom_response:
                    response_code: 429
                    custom_response_body_key: too_many_requests
          statement:
            rate_based_statement:
                limit: 5000
                aggregate_key_type: IP
          visibility_config:
            sampled_requests_enabled: true
            cloud_watch_metrics_enabled: true
            metric_name: waf-acl-rule-rate-limit-per-IP
          purge_rules: true
    custom_response_bodies:
        too_many_requests:
            content_type: APPLICATION_JSON
            content: '{ message: "Your request has been blocked due to too many HTTP requests coming from your IP" }'
    region: us-east-1
    state: present