Top / Amazon Web Service / AWS WAF V2 / Web ACL

AWS WAF V2 Web ACL

This page shows how to write Terraform and CloudFormation for AWS WAF V2 Web ACL and write them securely.

terraform-logo

Review your .tf file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

aws_wafv2_web_acl (Terraform)

The Web ACL in AWS WAF V2 can be configured in Terraform with the resource name aws_wafv2_web_acl. The following sections describe 4 examples of how to use the resource and its parameters.

Example Usage from GitHub

main.tf#L1
resource "aws_wafv2_web_acl" "aws_wafv2_web_acl_REGIONAL" {
  name        = "REGIONAL-managed-rule"
  description = "Example of a REGIONAL managed rule."
  scope       = "REGIONAL"

  default_action {
waf.tf#L2
resource "aws_wafv2_web_acl" "wec_acl" {
  name = "web-acl"
  scope = "REGIONAL"

  default_action {
    allow {}
waf2.tf#L1
resource "aws_wafv2_web_acl" "pass" {
  name        = "managed-rule-example"
  description = "Example of a managed rule."
  scope       = "REGIONAL"

  default_action {
waf.tf#L5
resource "aws_wafv2_web_acl" "covidportal_acl" {
  name  = "covid_portal"
  scope = "REGIONAL"

  default_action {
    allow {}

Review your Terraform file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Creates a WAFv2 Web ACL resource.

>> from Terraform Registry

AWS::WAFv2::WebACL (CloudFormation)

The WebACL in WAFv2 can be configured in CloudFormation with the resource name AWS::WAFv2::WebACL. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

WAF.yml#L5
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: name-WAF
      Scope: REGIONAL
      Description: This is the Peoplesoft92 ALB WAF
      DefaultAction:
website-waf.yml#L3
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: ExampleWebACL
      Scope: REGIONAL
      Description: This is an example WebACL
      DefaultAction:
waf.serverless.yml#L3
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: ${env:REGION}-waf
      Scope: CLOUDFRONT
      Description: Waf Used by Cloudfront
      DefaultAction:
waf.yml#L29
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub ${ProductName}-waf-restrict-cloudfront-access-${Stage}
      Scope: REGIONAL
      Description: Restricts access to CloudFront
      DefaultAction:
waf.yml#L12
    Type: AWS::WAFv2::WebACL
    Properties:
      DefaultAction:
        BLOCK: {}
      Description: WebACL for SlsTestWebApp Access.
      Name: SlsTestWebAppWebACL
project-with-waf.json#L84
            "Type": "AWS::WAFv2::WebACL"
        },
        "WAFAssociation1": {
            "Properties": {
                "ResourceArn": "arn:aws:iam::...:...",
                "WebACLArn": {
EWAFv2WebACLProhibited.json#L6
      "Type": "AWS::WAFv2::WebACL",
      "Properties": {
        "DefaultAction": {
          "Allow": [
            "Stuff"
          ]
api-enhanced-observability-variables_template.json#L35
            "Type": "AWS::WAFv2::WebACL",
            "Properties": {
                "DefaultAction": {
                    "Allow": {}
                },
                "Description": "Application WAF",
WAF-enterprise-only.json#L34
      "Type": "AWS::WAFv2::WebACL",
      "Condition": "RestrictPublicDashboardToEnterprise",
      "Properties": {
        "DefaultAction": {
          "Allow": {}
        },
wafv2.json#L33
      "Type": "AWS::WAFv2::WebACL",
      "Properties": {
        "DefaultAction": {
          "Allow": {}
        },
        "Name": {

Parameters

>> from AWS CloudFormation Documentation

Explanation in CloudFormation Registry

Note This is the latest version of AWS WAF, named AWS WAFV2, released in November, 2019. For information, including how to migrate your AWS WAF resources from the prior release, see the AWS WAF Developer Guide. Use an AWS::WAFv2::WebACL to define a collection of rules to use to inspect and control web requests. Each rule has an action defined (allow, block, or count) for requests that match the statement of the rule. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can contain rule statements that you define explicitly and rule statements that reference rule groups and managed rule groups. You can associate a web ACL with one or more AWS resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync GraphQL API.

>> from AWS CloudFormation Documentation

The Other Related AWS WAF V2 Resources

Frequently asked questions

What is AWS WAF V2 Web ACL?

AWS WAF V2 Web ACL is a resource for WAF V2 of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS WAF V2 Web ACL?

For Terraform, the andrzejsydor/aws, Ndomi/terraform and bridgecrewio/checkov source code examples are useful. See the Terraform Example section for further details.

For CloudFormation, the seunremi/WAF-DEPLOYMENT, bcx-exa/template_micro_frontend_core and bcx-exa/open_source_triple_continent_traditional source code examples are useful. See the CloudFormation Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.

Table of Contents