Hi folks, I'm setting up AWS WAF v2 which I previously deployed via AWS CDK. I'm getting error:

'WebAcl' has a problem: Invalid or unknown key. Examine values at 'WebAcl.rules'.

I found out it's caused by this rule:

const cognitoRule = {
  name: 'CognitoSignInRateLimit',
  priority: 2,
  action: { ... },
  visibilityConfig: { ... },
  statement: {
    rateBasedStatement: {
      ...
      scopeDownStatement: {
        andStatement: {
          statements: [
            {..}
            {
              notStatement: {
                statements: [
                  {
                    orStatement: {
                      statements: [
                        { ... },
                        { ... }
                      ]
                    }
                  }
                ]
              }
            }
          ]
        }
      }
    }
  }
} satisfies aws.types.input.wafv2.WebAclRule

When I change it like this:

const cognitoRule = {
  name: 'CognitoSignInRateLimit',
  priority: 2,
  action: { ... },
  visibilityConfig: { ... },
  statement: {
    rateBasedStatement: {
      ...
      scopeDownStatement: {
        andStatement: {
          statements: [
            {..}
            {
              notStatement: {
                statements: [ {} ] // 👈 Changed here
              }
            }
          ]
        }
      }
    }
  }
} satisfies aws.types.input.wafv2.WebAclRule

Then the error disappears. Any clue? Is it some bug in Pulumi/Terraform? Because the code seems to be valid both according to TypeScript types and AWS docs.

Hi Filip, if you could extract a repro and file to pulumi/pulumi-aws my team can have a look.

Hi @enough-garden-22763 , thanks, will do 🙂 🙇‍♂️