custom-resource.py overrides DefaultAction about aws-waf-security-automations HOT 7 CLOSED

This default action should apply for Web ACL’s default action. I mean, if any rule got trigged when a request is process, then the default action takes place.

The rules configured by custom resource are set to be added as block ... what if we add an extra input parameter in this template to ask what should be the rules’ action?

from aws-waf-security-automations.

Hello,

I have a custom scenario where I want the default action to be "BLOCK". I updated the cloudformation

"WAFWebACL": {
      "Type": "AWS::WAF::WebACL",
      "Condition": "CreateWebACL",
      "DependsOn": [
        "WAFWhitelistRule"
      ],
      "Properties": {
        "Name": {
          "Ref": "AWS::StackName"
        },
        "DefaultAction": {
          "Type": **"BLOCK"**
        },
        "MetricName": "SecurityAutomationsMaliciousRequesters",
        "Rules": [
          {
            "Action": {
              "Type": "ALLOW"
            },
            "Priority": 10,
            "RuleId": {
              "Ref": "WAFWhitelistRule"
            }
          }
        ]
      }
    },

but once custom-resource.py runs it changes it to "ALLOW".

I don't see a need for this line in the python script
DefaultAction={'Type': 'ALLOW'}

why not simply honor the cloudformation value?

from aws-waf-security-automations.

I got your point!

We can't remove this parameter from update_web_acl as it seems to be required but I'll add an extra step to retrieve the current action instead assuming the it should be ALLOW.

from aws-waf-security-automations.

@hvital

how I read the documentation is that if "DefaultAction" is passed then "Type" is required but I don't believe that "DefaultAction" is required

from aws-waf-security-automations.

I miss understood the Type (string) -- [REQUIRED] boto doc. Lets just remove this parameter then :)

Just added a note to include this for the next update. Thanks for pointing this out!!

from aws-waf-security-automations.

thanks!

from aws-waf-security-automations.

Hi @dpmallinger.

We've just pushed a new version that include a fix for what you've mentioned.

Custom resource won't update the WebACL anymore:
https://github.com/awslabs/aws-waf-security-automations/blob/c7b25b4f9005469f1606e8da19c9704268f0697a/source/custom-resource/custom-resource.py#L272

Many thanks!

from aws-waf-security-automations.