SAM API Gateway with Cloudformation WAFRegional

I finally resolved the issue with the help of the AWS customer service. This is a limitation they have with CloudFormation when dealing with AWS::WAFRegional::RateBasedRule.

Despite the fact that CloudFormation supports creating WAF regional rate-based rules, the association of them with a Web ACL is not currently supported. If you observe link [1] below, you will realize that: "To add the rate-based rules created through CloudFormation to a web ACL, use the AWS WAF console, API, or command line interface (CLI)."

[1] AWS::WAFRegional::RateBasedRule: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-ratebasedrule.html

I used the Cloudformation template to generate the WebACL, the RateBasedRule, and the association of the WebACL with my APIGW. Using CodeBuild in our CI/CD pipeline, I'm now adding the RateBasedRule to the WebACL by using the CLI command aws waf-regional update-web-acl.

I ran in the same issue and I solve the problem with WAFv2

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Template for WAF Configuration'
Parameters:
  CamerasApi:
    Description: "Arn of the Cameras Api"
    Type: String
    Default: YOUR-API-ID
  StageName:
    Description: "Stage name of the Cameras Api"
    Type: String
    Default: YOUR-Stage
  Blocking:
    Description: "Number of calls per 5 minutes for WAF IP blocking."
    Type: Number
    Default: 2000
  EnvironmentType:
    Type: String
    Default: Prod
    Description: "Type of environment: dev, staging or prod."


Resources:
  WAFCamerasWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: ExampleWebACL
      Description: This is an example WebACL
      Scope: REGIONAL
      DefaultAction: 
        Allow: {}
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: ExampleWebACLMetric
      Rules:
        - Name: RulesTest
          Priority: 0
          Action:
           Block: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: test
          Statement:
            RateBasedStatement:
              Limit: 100
              AggregateKeyType: IP

  MyWebACLAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: !Sub arn:aws:apigateway:${AWS::Region}::/restapis/${CamerasApi}/stages/${StageName}
      WebACLArn: !GetAtt  WAFCamerasWebACL.Arn

Outputs:
  WebACL:
    Description: Name of the web ACL
    Value: !Ref WAFCamerasWebACL

Assuming a AWS::WAFRegional::WebACL and AWS::WAFRegional::RateBasedRule are defined in a Cloudformation stack, they can be attached using the following bash script:

CHANGE_TOKEN=$(aws waf-regional get-change-token --output text)
WEBACL_ID=$(aws waf-regional list-web-acls --query WebACLs[0].WebACLId --output text)
RULE_ID=$(aws waf-regional list-rate-based-rules --query Rules[0].RuleId --output text)
aws waf-regional update-web-acl --web-acl-id $WEBACL_ID --change-token $CHANGE_TOKEN \
    --updates Action="INSERT",ActivatedRule='{Priority=1,RuleId="'$RULE_ID'",Action={Type="BLOCK"},Type="RATE_BASED"}'

However unfortunately this leads to issues when deleting the Cloudformation stack

The following resource(s) failed to delete: [RateBasedRuleName].

Any ideas how to enable the stack to remove the rule when issueing aws cloudformation delete-stack?

Resources:
  BlueWafAlbAssociation:
    Type: "AWS::WAFv2::WebACLAssociation"
    Properties:
      WebACLArn: arn:aws:wafv2:us-east-1:1234567890:regional/webacl/name-of-webacl/id-of-webacl
      ResourceArn: arn:aws:elasticloadbalancing:us-east-1:1234567890:loadbalancer/app/load-balancer-name/xxxxxxxxxxx