How to configure WAF WebACL for load balancer?

Question

Pulumi · Accepted Answer

Sure. We’ll create a program using Pulumi's AWS library to set up and associate a WAF (Web Application Firewall) WebACL (Access-Control List) with a Load Balancer.

Here is a step-by-step explanation:

1. **Creating an Application Load Balancer.** An Application Load Balancer makes routing decisions at the application layer (HTTP/HTTPS) and offers features like path-based routing and host-based routing.

2. **Creating a WAF WebACL.** WebACL is a collection of rules that AWS WAF uses to allow, block, or count web requests.

3. **Associating the WebACL with the Load Balancer.** AWS WAF inspects web requests that are forwarded to Amazon CloudFront distributions or an Application Load Balancer.

The code described above is as follows:

```typescript
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// Create an AWS resource (S3 Bucket)
const alb = new aws.lb.LoadBalancer("alb", {
  internal: false,
  loadBalancerType: "application"
});

const awsWebACL = new aws.waf.WebAcl("webACL", {
  metricName: "webACL",
  defaultAction: {
    type: "ALLOW"
  } ,
  rules: [{
      action: {
         type: "BLOCK"
      },
      priority: 1,
      type: "REGULAR",
      ruleId: "ruleId"
  }]
});

// Associate WAF WebACL with load balancer
const wafRegionalWebAclAssociation = new aws.wafregional.WebAclAssociation("webAclAssociation", {
  resourceArn: alb.arn,
  webAclId: awsWebACL.id,
});

export const loadBalancerArn = alb.arn;
export const webAclId = awsWebACL.id;
```

Please replace `"ruleId"` with your actual ruleId. The ruleId is an ID that's returned by `CreateRule` and `ListRules`.

The above pulumi program will create an ALB(Application Load Balancer) and a WAF(Web Application Firewall) WebACL, and associate the WebACL with the ALB. The ACL contains one rule that blocks requests, you can customize this configuration with your own set of rules.
Finally, the association is returned so you can easily check the status of resources in your program.