How to add AWS WAF to an ALB via CloudFormation

user_975649 0
Viewed 7179

I can't find any examples or documentation on how to associate a WAF with an ALB via CloudFormation. Supposedly its possible going by this news announcement https://aws.amazon.com/about-aws/whats-new/2017/05/cloudformation-support-for-aws-waf-on-alb/ but there isn't anything I've found that shows how. Using CloudFront instead of ALB is well documented but I haven't found a single example with regard to using an ALB (via CloudFormation).

Update: I dont need a full example that does the entire setup for me but at least a snippet that points out how the WAF will know to associate with the ALB or vice versa. The linking is whats missing.

amazon-alb amazon-waf amazon-cloudformation amazon-web-services
2 Answers

Below is the example in YAML format.

   Resources:
    WafAcldev:
     DependsOn: Whitelist
     DependsOn: WafRule
     Type: AWS::WAF::WebACL
     Condition: CreateDEVResources
     Properties:
      DefaultAction:
        Type: "BLOCK"
      MetricName: test
      Name: test
      Rules:
        -
          Action:
            Type: "ALLOW"
          Priority: 1
          RuleId: !Ref WafRule

    WafRule:
        DependsOn: WhitelistIPdev
        Type: AWS::WAF::Rule
        Condition: CreateDEVResources
        Properties:
          MetricName: test
          Name: test
          Predicates:
            -
              DataId:
               Ref: "Whitelist"
              Negated: false
              Type: "IPMatch"

    MyWebACLAssociation:
          Type: "AWS::WAFRegional::WebACLAssociation"
          Properties:
            ResourceArn: arn:aws:elasticloadbalancing:us-east-2:123456789012:listener/app/my-load-balancer/1234567890123456/1234567890123456
            WebACLId:
              Ref: WafAcldev
    Whitelist:
        Type: AWS::WAF::IPSet
        Condition: CreateDEVResources
        Properties:
          Name: "IPSet for Whitelisted IP adresses"
          IPSetDescriptors:
            -
             Type: "IPV4"
             Value: "213.126.223.11/32"
            -
user_67914650
Related