| 7 | class WafCloudFrontStack(Stack): |
| 8 | |
| 9 | def make_rules(self, list_of_rules={}): |
| 10 | rules = list() |
| 11 | for r in list_of_rules: |
| 12 | rule = wafv2.CfnWebACL.RuleProperty( |
| 13 | name = r["name"], |
| 14 | priority = r["priority"], |
| 15 | override_action = wafv2.CfnWebACL.OverrideActionProperty(none={}), |
| 16 | statement = wafv2.CfnWebACL.StatementProperty( |
| 17 | managed_rule_group_statement = wafv2.CfnWebACL.ManagedRuleGroupStatementProperty( |
| 18 | name = r["name"], |
| 19 | vendor_name = "AWS", |
| 20 | excluded_rules = [] |
| 21 | ) ## managed_rule_group_statement |
| 22 | ), ## statement |
| 23 | visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty( |
| 24 | cloud_watch_metrics_enabled = True, |
| 25 | metric_name = r["name"], |
| 26 | sampled_requests_enabled = True |
| 27 | ) ## visibility_config |
| 28 | ) ## wafv2.CfnWebACL.RuleProperty |
| 29 | rules.append(rule) |
| 30 | |
| 31 | ## |
| 32 | ## Allowed country list |
| 33 | ## |
| 34 | ruleGeoMatch = wafv2.CfnWebACL.RuleProperty( |
| 35 | name = 'GeoMatch', |
| 36 | priority = 0, |
| 37 | action = wafv2.CfnWebACL.RuleActionProperty( |
| 38 | block={} ## To disable, change to *count* |
| 39 | ), |
| 40 | statement = wafv2.CfnWebACL.StatementProperty( |
| 41 | not_statement = wafv2.CfnWebACL.NotStatementProperty( |
| 42 | statement = wafv2.CfnWebACL.StatementProperty( |
| 43 | geo_match_statement = wafv2.CfnWebACL.GeoMatchStatementProperty( |
| 44 | ## |
| 45 | ## block connection if source not in the below country list |
| 46 | ## |
| 47 | country_codes = [ |
| 48 | "AR", ## Argentina |
| 49 | "BO", ## Bolivia |
| 50 | "BR", ## Brazil |
| 51 | "CL", ## Chile |
| 52 | "CO", ## Colombia |
| 53 | "EC", ## Ecuador |
| 54 | "FK", ## Falkland Islands |
| 55 | "GF", ## French Guiana |
| 56 | "GY", ## Guiana |
| 57 | "GY", ## Guyana |
| 58 | "PY", ## Paraguay |
| 59 | "PE", ## Peru |
| 60 | "SR", ## Suriname |
| 61 | "UY", ## Uruguay |
| 62 | "VE", ## Venezuela |
| 63 | ] ## country_codes |
| 64 | ) ## geo_match_statement |
| 65 | ) ## statement |
| 66 | ) ## not_statement |