so i have a file called

wafVariables.ts

which contains the config for the rulesets, which looks like this:

import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';

/*
Define the rule statements and then attach them to the rule objects below.

Currently we just have a base set of managed rules from AWS.
 */
const commonRulesetStatement: wafv2.WebAclRuleStatement = {
  managedRuleGroupStatement: {
    vendorName: 'AWS',
    name: 'AWSManagedRulesCommonRuleSet',
  },
};

const SQLiRulesetStatement: wafv2.WebAclRuleStatement = {
  managedRuleGroupStatement: {
    vendorName: 'AWS',
    name: 'AWSManagedRulesSQLiRuleSet',
  },
};

const ipReputationRulesetStatement: wafv2.WebAclRuleStatement = {
  managedRuleGroupStatement: {
    vendorName: 'AWS',
    name: 'AWSManagedRulesAmazonIpReputationList',
  },
};

then those rule group statements need to be used to create rules to pass in to the webacl resource:

/*
Define rules here, this is to make the resource definitions as tidy as possible in waf.ts
 */
export const commonRuleSetRule = {
  name: 'common-ruleset-rule',
  priority: 1,
  statement: commonRulesetStatement,
  overrideAction: {
    none: {},
  },
  visibilityConfig: {
    sampledRequestsEnabled: true,
    cloudwatchMetricsEnabled: true,
    metricName: 'AWS-AWSManagedRulesCommonRuleSet',
  },
};

then in a file called

waf.ts

we do something like this:

import * as aws from '@pulumi/aws';
import {
  commonRuleSetRule,
} from './wafVariables';

export const regionalWebAcl = new aws.wafv2.WebAcl('regional-web-acl', {
  defaultAction: {
    allow: {},
  },
  description: 'A web acl containing a base set of rules',
  scope: 'REGIONAL',
  rules: [
    commonRuleSetRule,
  ],
  visibilityConfig: {
    cloudwatchMetricsEnabled: true,
    metricName: 'regional-web-acl',
    sampledRequestsEnabled: true,
  },
  tags: {
    ...tags,
    Name: 'regional-web-acl',
  },
});

if you want to see if the rules would be triggered without actioning the request, set the

overrideAction

to

count

in the rule group like this :

export const commonRuleSetRule = {
  name: 'common-ruleset-rule',
  priority: 5,
  statement: commonRulesetStatement,
  overrideAction: {
    count: {},
  },
  visibilityConfig: {
    sampledRequestsEnabled: true,
    cloudwatchMetricsEnabled: true,
    metricName: 'AWS-AWSManagedRulesCommonRuleSet',
  },
};

and if you need to exclude any rules from the rulegroups, you can do so like this:

const botRulesetStatement: pulumi.Input<aws.types.input.wafv2.WebAclRuleStatement> = {
  managedRuleGroupStatement: {
    vendorName: 'AWS',
    name: 'AWSManagedRulesBotControlRuleSet',
    excludedRules: [
      {
        name: 'SignalNonBrowserUserAgent',
      },
      {
        name: 'CategoryHttpLibrary',
      },
      {
        name: 'SignalAutomatedBrowser',
      },
    ],
  },
};

hope this helps! drop me a message if you need anything else

for example, the core ruleset, the name/vendor is at the top of this page https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs

be mindful of the WCU count of the rule sets, as there is a maximum of 1500 WCU per webacl