Waf
AWS WAF with rate limiting, IP reputation, OWASP core rules and SQL injection protection in one line. Starts in count mode so nothing breaks.
Arguments
Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).
scope string What the WAF protects. Default: "cloudfront".
cloudfront— Sites and other CloudFront distributions. Created in us-east-1, as AWS requires. Default.regional— Regional resources such as Cognito user pools. Created in the stack's region.
mode string What rules do when they match. Default: "count". The IP allow and block lists always allow / block regardless of mode.
count— Log matches without blocking — check for false positives on live traffic first. Default.block— Block matching requests.
rateLimit object (WafRateLimitArgs) Per-client rate limit: limit (default 2000), windowSeconds (60, 120, 300 or 600; default 300), enabled (default true).
managedRules object (WafManagedRulesArgs) AWS managed rule groups, each a boolean. On by default: core (OWASP Top 10), knownBadInputs (Log4Shell and other exploits), ipReputation (Amazon threat intelligence; off when clientIpHeader is set), sqli. Off by default: anonymousIp (VPNs, Tor, hosting providers — suits B2B), adminProtection. An explicit value always wins.
ruleOverrides map<string, string> Change the action of individual AWS managed rules, keyed by exact AWS rule name: "count", "block" or "allow". Default: { SizeRestrictions_BODY: "count" } — that rule blocks any body over 8 KB, which breaks forms and uploads. Set it to "block" to restore it.
ipAllowList string[] IP addresses or CIDRs (IPv4 and IPv6) that are always allowed, skipping every other rule — e.g. office networks or uptime monitors.
ipBlockList string[] IP addresses or CIDRs (IPv4 and IPv6) that are always blocked.
blockCountries string[] Two-letter ISO country codes to block, e.g. ["KP"]. Follows mode.
clientIpHeader string Header carrying the real visitor IP behind a proxy, e.g. "CF-Connecting-IP" for Cloudflare. The rate limit, IP lists and country blocking use it instead of the proxy's IP. Only set it when every request comes through the proxy (use originProtection: true on the site) — otherwise clients can fake their IP.
logging object (WafLoggingArgs) CloudWatch Logs: enabled (default true), retentionDays (default 30), includeAllowed (default false — only blocked and counted requests). The authorization, cookie and x-origin-secret headers are always redacted.
logging 3 fields
WAF logging to CloudWatch Logs.
enabled boolean Turns logging on or off. Default: true.
includeAllowed boolean Also log allowed requests. Default: false — only blocked and counted requests, which keeps cost low.
retentionDays integer How long logs are kept, in days (a CloudWatch Logs retention value). Default: 30.
managedRules 6 fields
AWS managed rule groups.
adminProtection boolean Admin protection (AWSManagedRulesAdminProtectionRuleSet): requests to admin-looking paths. Default: false.
anonymousIp boolean Anonymous IP list (AWSManagedRulesAnonymousIpList): VPNs, Tor, hosting providers. Suits B2B apps; too strict for most consumer apps. Default: false.
core boolean Core Rule Set (AWSManagedRulesCommonRuleSet): OWASP Top 10 — XSS, path traversal, remote file inclusion, SSRF. Default: true.
ipReputation boolean Amazon IP reputation list (AWSManagedRulesAmazonIpReputationList): IPs from Amazon threat intelligence. Default: true, or false when clientIpHeader is set.
knownBadInputs boolean Known bad inputs (AWSManagedRulesKnownBadInputsRuleSet): Log4Shell, Java deserialisation, React RCE and other known exploit patterns. Default: true.
sqli boolean SQL injection (AWSManagedRulesSQLiRuleSet). Default: true.
rateLimit 3 fields
Per-client rate limit.
enabled boolean Turns the rate limit on or off. Default: true.
limit integer Maximum requests per client in each window (10 to 2,000,000,000). Default: 2000.
windowSeconds integer Evaluation window in seconds: 60, 120, 300 or 600. Default: 300.
This component also accepts a hatch argument to override the underlying resource
configuration. See Overrides & Escape Hatch.
Attributes
Outputs available once the resource is deployed.
arn string The WebACL ARN. Pass to a site's waf.arn (cloudfront scope) or a Cognito user pool's waf.arn (regional scope).
webAclId string The WebACL ID.
name string The physical WebACL name.
scope string "cloudfront" or "regional".
logGroupName string The CloudWatch log group receiving WAF logs. Empty when logging is off.