chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 #32252

ren-yamanashi · 2024-11-22T15:27:32Z

Reason for this change

When attaching a WebACL to CloudFront Distribution, the region must be us-east-1, but no validation was done.

see: https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-creating.html

For Region, if you've chosen a Regional resource type, choose the Region where you want AWS WAF to store the web ACL.

You only need to choose this option for Regional resource types. For CloudFront distributions, the Region is hard-coded to the US East (N. Virginia) Region, us-east-1, for Global (CloudFront) applications.

Description of changes

Add validation to the attachWebAclId method of CloudFront Distribution

Description of how you validated changes

Unit and integ testing

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

ren-yamanashi · 2024-11-22T15:31:04Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+    if (webAclId.startsWith('arn:')) {
+      const arnParts = Stack.of(this).splitArn(webAclId, ArnFormat.SLASH_RESOURCE_NAME);
+      if (!Token.isUnresolved(arnParts.region) && arnParts.region !== 'us-east-1') {
+        throw new Error(`WebACL for CloudFront distributions must be created in the us-east-1 region; received ${arnParts.region}`);
+      }
+    }


If a Web ACL created using AWS WAF Classic is specified, this validation will not be performed because the ACL ID received is not arn.

codecov · 2024-11-22T15:42:52Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.50%. Comparing base (f091714) to head (c94ec02).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #32252      +/-   ##
==========================================
+ Coverage   78.48%   78.50%   +0.01%     
==========================================
  Files         106      106              
  Lines        7201     7201              
  Branches     1321     1321              
==========================================
+ Hits         5652     5653       +1     
+ Misses       1362     1361       -1     
  Partials      187      187

Flag	Coverage Δ
suite.unit	`78.50% <ø> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`78.50% <ø> (+0.01%)`	⬆️

ren-yamanashi · 2024-11-22T15:48:11Z

Exemption Request

Because this MR does not have any modifications that would change the existing snapshot test,

…ate-cloud-front-waf-region

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

mazyu36

Thank you for the contribution.
Just one question.

mazyu36 · 2024-11-25T14:09:10Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

   * @param webAclId The WAF WebACL to associate with this distribution
   */
  public attachWebAclId(webAclId: string) {
    if (this.webAclId) {
      throw new Error('A WebACL has already been attached to this distribution');
    }
+    if (webAclId.startsWith('arn:')) {


Isn't this validation also necessary in the place where the webacl props is being passed?

aws-cdk/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

Line 342 in 28698b8

this.webAclId = props.webAclId;

@mazyu36

Thank you very much. As you pointed out, validation was needed, so we have modified it!

(I have modified the policy to provide a validation method in the private method.)

4a02e21

…ate-cloud-front-waf-region

mazyu36

Thanks! LGTM

mergify · 2024-11-29T22:16:55Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…ate-cloud-front-waf-region

Pull request has been modified.

ren-yamanashi · 2024-11-30T04:17:28Z

@mazyu36 @gracelu0

I updated the branch because CI failed.(The cause is unknown...)

Could you please approve it again?

The modifications are as follows.
Merge branch 'main' into this branch

mazyu36 · 2024-11-30T04:28:34Z

Thank you. Please wait as approval from a maintainer is needed (I'm just a community reviewer, not a maintainer).

…ate-cloud-front-waf-region

mergify · 2024-12-02T18:13:13Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Pull request has been modified.

aws-cdk-automation · 2024-12-02T18:44:44Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: c94ec02
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-12-02T19:28:39Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2024-12-02T19:29:01Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

ren-yamanashi added 2 commits November 22, 2024 23:50

feat(cloudfront): validate attachWebAclId

11e77c4

feat(cloudfront): fix validation logic and test

8458596

github-actions bot added the repeat-contributor [Pilot] contributed between 3-5 PRs to the CDK label Nov 22, 2024

aws-cdk-automation requested a review from a team November 22, 2024 15:27

github-actions bot added the p2 label Nov 22, 2024

aws-cdk-automation previously requested changes Nov 22, 2024

View reviewed changes

ren-yamanashi commented Nov 22, 2024

View reviewed changes

ren-yamanashi changed the title ~~feat(cloudfront): prevent WebACL from being created in regions other than us-east-1~~ fix(cloudfront): prevent WebACL from being created in regions other than us-east-1 Nov 22, 2024

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Nov 22, 2024

ren-yamanashi added 3 commits November 23, 2024 00:51

feat(cloudfront): fix comment

4416463

delete period

1407e77

refactor: validation logic

8e16c2e

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 22, 2024

Merge branch 'main' of https://github.com/aws/aws-cdk into feat-valid…

28698b8

…ate-cloud-front-waf-region

ren-yamanashi changed the title ~~fix(cloudfront): prevent WebACL from being created in regions other than us-east-1~~ chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 Nov 24, 2024

mazyu36 reviewed Nov 25, 2024

View reviewed changes

ren-yamanashi added 2 commits November 27, 2024 21:31

Merge branch 'main' of https://github.com/aws/aws-cdk into feat-valid…

7b0bb76

…ate-cloud-front-waf-region

feat: add validation

4a02e21

mazyu36 approved these changes Nov 27, 2024

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Nov 27, 2024

gracelu0 previously approved these changes Nov 29, 2024

View reviewed changes

Merge branch 'main' into feat-validate-cloud-front-waf-region

b27ebf0

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Nov 29, 2024

Merge branch 'main' of https://github.com/aws/aws-cdk into feat-valid…

48d5fce

…ate-cloud-front-waf-region

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Nov 30, 2024

github-actions bot mentioned this pull request Dec 1, 2024

Monthly PR metrics report #32340

Open

Merge branch 'main' of https://github.com/aws/aws-cdk into feat-valid…

11a68bf

…ate-cloud-front-waf-region

gracelu0 previously approved these changes Dec 2, 2024

View reviewed changes

Merge branch 'main' into feat-validate-cloud-front-waf-region

c94ec02

gracelu0 approved these changes Dec 2, 2024

View reviewed changes

mergify bot merged commit 64a0e2c into aws:main Dec 2, 2024
19 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Dec 2, 2024

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Dec 2, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 #32252

chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 #32252

ren-yamanashi commented Nov 22, 2024

aws-cdk-automation left a comment

ren-yamanashi Nov 22, 2024

codecov bot commented Nov 22, 2024 •

edited

Loading

ren-yamanashi commented Nov 22, 2024 •

edited

Loading

mazyu36 left a comment

mazyu36 Nov 25, 2024

ren-yamanashi Nov 27, 2024

mazyu36 left a comment

mergify bot commented Nov 29, 2024

ren-yamanashi commented Nov 30, 2024 •

edited

Loading

mazyu36 commented Nov 30, 2024

mergify bot commented Dec 2, 2024

aws-cdk-automation commented Dec 2, 2024

mergify bot commented Dec 2, 2024

github-actions bot commented Dec 2, 2024

chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 #32252

chore(cloudfront): prevent WebACL from being created in regions other than us-east-1 #32252

Conversation

ren-yamanashi commented Nov 22, 2024

Reason for this change

Description of changes

Description of how you validated changes

Checklist

aws-cdk-automation left a comment

Choose a reason for hiding this comment

ren-yamanashi Nov 22, 2024

Choose a reason for hiding this comment

codecov bot commented Nov 22, 2024 • edited Loading

Codecov Report

ren-yamanashi commented Nov 22, 2024 • edited Loading

mazyu36 left a comment

Choose a reason for hiding this comment

mazyu36 Nov 25, 2024

Choose a reason for hiding this comment

ren-yamanashi Nov 27, 2024

Choose a reason for hiding this comment

mazyu36 left a comment

Choose a reason for hiding this comment

mergify bot commented Nov 29, 2024

ren-yamanashi commented Nov 30, 2024 • edited Loading

mazyu36 commented Nov 30, 2024

mergify bot commented Dec 2, 2024

aws-cdk-automation commented Dec 2, 2024

AWS CodeBuild CI Report

mergify bot commented Dec 2, 2024

github-actions bot commented Dec 2, 2024

codecov bot commented Nov 22, 2024 •

edited

Loading

ren-yamanashi commented Nov 22, 2024 •

edited

Loading

ren-yamanashi commented Nov 30, 2024 •

edited

Loading