WAF — AWS WAF v2
Quick start, the Web ACL and tag operations that work, and why no request is ever evaluated against a stored rule.
Web ACL records for SDK and AWS::WAFv2::WebACL workflows. Rules are stored
verbatim and never evaluated — nothing is allowed or blocked.
Status: ⚠️ Partial
Quick start
export AWS_ENDPOINT_URL=http://localhost:4566
aws wafv2 create-web-acl \
--name api-acl --scope REGIONAL \
--default-action Allow={} \
--visibility-config SampledRequestsEnabled=false,CloudWatchMetricsEnabled=false,MetricName=api
aws wafv2 list-web-acls --scope REGIONALAny credentials work; with none configured, run eval "$(overcast env)" first
— see Using AWS SDKs and CLI.
What works
| Area | Behaviour |
|---|---|
| Web ACLs | CreateWebACL, GetWebACL, ListWebACLs, DeleteWebACL in both REGIONAL and CLOUDFRONT scope |
| Tags | TagResource, UntagResource, ListTagsForResource by Web ACL ARN |
| Console | Create, list, detail and delete views, plus a node on the system map |
Differences from AWS
| Area | On AWS | Overcast |
|---|---|---|
| Rule evaluation | Requests to API Gateway, CloudFront and ALBs are filtered | Rules are stored metadata; no request is evaluated |
UpdateWebACL | Edits rules and visibility config on an existing ACL | Not implemented — 501 Not Implemented |
LockToken | Rejects a stale token with WAFOptimisticLockException | Accepted and ignored |
| Association | AssociateWebACL attaches an ACL to a resource | Not implemented |
| WAF Classic | The AWSWAF_20150824 API is still served | Not implemented — 501 Not Implemented |
Gotchas
Note
Everything unlisted above returns 501 Not Implemented rather than a
success that did nothing.
Operations
All 7 listed operations are implemented. Per-operation status, notes and AWS API links: WAF v2 operations.
Related
- Shield — the other half of the same control plane
- All service pages
- Service names and state overrides
- AWS API reference