Files

T

Jon Chery 94065a4fbc feat(P27): add Examples section to every module README (D-058)

Each module README (10 primitives + 2 patterns) now has a ## Examples
section before ## Versioning, referencing and excerpting the validated
simple.yaml + complex.yaml (+ mysql.yaml for RDS) example contracts. The
RDS README includes a Multi-engine variation subsection (D-059).

---ci---
project: acdl
phase: 27
milestone: v1.7
status: execute
---/ci---

2026-07-22 20:23:48 +00:00

3.0 KiB

Raw Blame History

waf — WAFv2 Web ACL

Module kind: primitive | Version: 1.0.0

A WAFv2 Web ACL scoped to CloudFront. It applies managed rule groups by default and can be associated with a CloudFront distribution to filter traffic before it reaches the origin. CloudFront-scoped Web ACLs are always created in us-east-1.

Resources

Resource	Type	Purpose
`webacl`	`aws_wafv2_web_acl`	WAFv2 Web ACL with managed rules

Inputs

Name	Type	Required	Default	Description
`name`	string	yes	—	Name of the Web ACL
`scope`	string	no	`cloudfront`	Scope of the Web ACL (default cloudfront for CloudFront associations)
`default_action`	string	no	`allow`	Default action (default allow)
`rules`	string	no	—	Optional custom rules as JSON (default: managed rules only)
`region`	string	yes	—	AWS region (CloudFront-scoped WAF is always us-east-1; the adapter ignores this for cloudfront scope)

Outputs

Name	Type	Description
`web_acl_arn`	arn	The WAF Web ACL ARN

Usage

{
  "id": "waf",
  "type": "aws:wafv2:webacl",
  "module": "waf@1.0.0",
  "inputs": {
    "name": "acdl-static-assets-waf",
    "scope": "cloudfront",
    "default_action": "allow",
    "region": "us-east-1"
  }
}

The web_acl_arn output is typically wired as a ref: expression into the cloudfront primitive's waf_web_acl_arn input inside a module composition (see modules/l2/static-assets).

Compliance extension points

Rate limiting — add a rate-based rule to cap requests per IP (SOC2 CC6.1, DORA operational resilience).
Geo blocking — add a geo-match statement to block/allow countries for data-residency compliance (GDPR Art.44, SOC2 CC6.1).
Custom rules — add custom rule statements for application-specific filtering (e.g. block SQLi/IP allow-lists) (SOC2 CC6.1).
Logging — enable WAF access logging to S3/CloudWatch/Kinesis for auditability (SOC2 CC7.2, DORA audit trail).

Examples

Validated example contracts are in examples/. The platform-test pipeline validates them against schemas/contract.schema.json.

Simple

A minimal deployment:

examples/simple.yaml

# Simple WAF with managed rules only
uses: acdl/pipelines/deploy.yaml@v1.6
module: waf
environment: dev
inputs:
  name: my-waf
  region: us-east-1

Complex

A production deployment with optional inputs:

examples/complex.yaml

# Complex WAF with rate limiting + geo blocking (custom rules)
uses: acdl/pipelines/deploy.yaml@v1.6
module: waf
environment: dev
inputs:
  name: my-production-waf
  scope: cloudfront
  default_action: allow
  region: us-east-1

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

3.0 KiB Raw Blame History