將 AWS WAF 與無服務器關聯 WAF 結合使用

Question

我在 AWS WAF 的 AWS 賬戶中創建了 Web ACL，並為其分配了一些規則。 在我的 serverless.yml 文件中，我使用了-serverless-associate-waf插件。

但是，當我從 go 到我的 Web ACL > 我的 acl > 關聯的 AWS 資源時，我沒有看到那里列出的關聯的 API 網關。

這是我的 serverless.yml 文件的外觀：

service: ${opt:product}

plugins:
    - serverless-domain-manager
    - serverless-apigw-binary
    - serverless-associate-waf

custom:
    associateWaf:
        name: name-of-my-acl
    esLogs:
        endpoint: link.amazonaws.com
        index: "${opt:stage}-logs"
        includeApiGWLogs: true
        retentionInDays: 30
    stage: ${opt:stage, 'dev'}
    region: ${opt:region, 'ap-south-1'}
    accountId: ${opt:accountId}
    awsBucket: ${opt:awsBucket, 'documents'}
    awsPermaBucket: ${opt:awsPermaBucket, 'perma-documents-dev'}
    cryptoKey: ${opt:cryptoKey}
    apigwBinary:
        types:
            - 'multipart/form-data'
    customDomain:
        domainName: ${opt:stage}-${opt:product}-api.io
        basePath: ""
        stage: ${self:custom.stage}
        createRoute53Record: true

provider:
    vpc:
        securityGroupIds:
            - sg-1234
        subnetIds:
            - subnet-1234
            - subnet-1234
    environment:
        region: ${self:custom.region}
        stage: ${self:custom.stage}
        module: ${opt:product}
        awsBucket: ${self:custom.awsBucket}
        authToken: ${opt:authToken}
        accountId: ${opt:accountId}
        awsPermaBucket: ${self:custom.awsPermaBucket}
        cryptoKey: ${opt:cryptoKey}
    iamRoleStatements:
        - Effect: Allow
          Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - logs:DescribeLogStreams
          Resource: "*"
        - Effect: Allow
          Action:
              - s3:*
          Resource: "*"
        - Effect: "Allow"
          Action:
              - "sqs:*"
          Resource: "arn:aws:sqs:${opt:region}:*:${opt:stage}-${opt:product}-sqs-queue"
    name: aws
    runtime: nodejs12.x
    stage: ${self:custom.stage}
    region: ${self:custom.region}
    memorySize: 256
    timeout: 30
    package:
        exclude:
            - "*/**"
        include:
            - build/**
            - node_modules/**

functions:
    orgSettingsAPI:
        name: ${self:service}-${self:custom.stage}-api
        handler: build/src/lambda.handler
        events:
            - http:
                  method: any
                  path: /api/{proxy+}
                  authorizer:
                      arn: arn:aws:lambda:${opt:region}:${self:custom.accountId}:function:authenticator-${self:custom.stage}-api
                      resultTtlInSeconds: 60
                      identitySource: method.request.header.Authorization
                      identityValidationExpression: ^Bearer.+
                  cors:
                      origins:
                        - "*"
                      headers:
                        - Content-Type
                        - X-Amz-Date
                        - Authorization
                        - X-Api-Key
                        - X-Amz-Security-Token
                      allowCredentials: true
                      maxAge: 86400
            - http:
                  method: any
                  path: /internal/{proxy+}
        vpc:
            securityGroupIds:
                - sg-1234
            subnetIds:
                - subnet-1234
                - subnet-1234
        environment:
            SqsQueueName: ${opt:stage}-${opt:product}-sqs-queue
        reservedConcurrency: 10
        events:
            - sqs:
                  arn:
                      Fn::GetAtt:
                          - SqsQueue
                          - Arn
                  batchSize: 1

resources:
    Resources:
        GatewayResponse:
            Type: "AWS::ApiGateway::GatewayResponse"
            Properties:
                ResponseParameters:
                    gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
                    gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
                ResponseType: EXPIRED_TOKEN
                RestApiId:
                    Ref: "ApiGatewayRestApi"
                StatusCode: "401"
        AuthFailureGatewayResponse:
            Type: "AWS::ApiGateway::GatewayResponse"
            Properties:
                ResponseParameters:
                    gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
                    gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
                ResponseType: UNAUTHORIZED
                RestApiId:
                    Ref: "ApiGatewayRestApi"
                StatusCode: "401"
      

當我調試部署過程時，它說：

無服務器：找不到名為“name-of-my-acl”的 WAF。 我是命名錯誤還是使用錯誤？

我不明白我應該在 serverless.yml 文件中為我的 WAF 使用什么名稱。

Answer 1

發現問題，原來我需要添加

version: V2

由於 AWS WAF 支持 V2，就在名稱之后。 一旦我添加並重新部署了 API 網關，它就會連接到創建的 WAF。

PS：name是我們要使用的ACL的名稱。