[IT-3995] Setup WAF for application

requirements-dev.txt

@@ -1,2 +1,2 @@
-pre-commit~=3.8.0
-pytest==6.2.5
+pre-commit~=3.8
+pytest~=6.2

requirements.txt

@@ -1,3 +1,3 @@
-aws-cdk-lib==2.139.0
-constructs>=10.0.0,<11.0.0
-boto3>=1.34.1
+aws-cdk-lib~=2.139
+constructs~=10.0
+boto3~=1.34

src/load_balancer_stack.py

@@ -3,14 +3,15 @@
 from aws_cdk import (
     aws_ec2 as ec2,
     aws_elasticloadbalancingv2 as elbv2,
+    aws_wafv2 as wafv2,
 )
 
 from constructs import Construct
 
 
 class LoadBalancerStack(cdk.Stack):
     """
-    API Gateway to allow access to ECS app from the internet
+    Load Balancer to allow access to ECS app from the internet
     """
 
     def __init__(
@@ -21,6 +22,50 @@ def __init__(
         self.alb = elbv2.ApplicationLoadBalancer(
             self, "AppLoadBalancer", vpc=vpc, internet_facing=True
         )
+
+        # WAF to protect against common web attacks (OWASP Top 10)
+        web_acl = wafv2.CfnWebACL(
+            self,
+            "WebAcl",
+            name="AppWebAcl",
+            default_action=wafv2.CfnWebACL.DefaultActionProperty(
+                allow=wafv2.CfnWebACL.AllowActionProperty()
+            ),
+            scope="REGIONAL",
+            visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
+                cloud_watch_metrics_enabled=True,
+                metric_name="AWSManagedRulesCommonRuleSet",
+                sampled_requests_enabled=True,
+            ),
+            rules=[
+                wafv2.CfnWebACL.RuleProperty(
+                    name="AWSManagedRulesCommonRuleSet",
+                    priority=0,
+                    statement=wafv2.CfnWebACL.StatementProperty(
+                        managed_rule_group_statement=wafv2.CfnWebACL.ManagedRuleGroupStatementProperty(
+                            name="AWSManagedRulesCommonRuleSet",
+                            vendor_name="AWS",
+                            excluded_rules=[],
+                        )
+                    ),
+                    action=wafv2.CfnWebACL.RuleActionProperty(block={}),
+                    visibility_config=wafv2.CfnWebACL.VisibilityConfigProperty(
+                        cloud_watch_metrics_enabled=True,
+                        metric_name="AWSManagedRulesCommonRuleSet",
+                        sampled_requests_enabled=True,
+                    ),
+                    override_action=wafv2.CfnWebACL.OverrideActionProperty(none={}),
+                )
+            ],
+        )
+
+        wafv2.CfnWebACLAssociation(
+            self,
+            "web_acl_association",
+            resource_arn=self.alb.load_balancer_arn,
+            web_acl_arn=web_acl.attr_arn,
+        )
+
         cdk.CfnOutput(
             self,
             "LoadBalancerDns",