4.3.0 #346

daknhh · 2024-04-15T06:39:45Z

Added

Allow reusing ipsets with same name. This commit differentiate ipsets from different FMS configs by adding the name of the webacl to it. Without this commit, trying to run aws-firewall-factory for two configs which uses a ipset with the same name would give a error on CloudFormation ('IpSet with name x already exists')
CheckCapacity: see which rule failed. This commit helps a lot by immediately letting us know which rule failed capacity checking and requires fixes
Save chars on ManagedServiceData FMS prop. The ManagedServiceData has a hard limit of 8192 characters. I've asked AWS about raising it and they said that this is a hard limit and they can't raise it. This commit is for saving as much chars as we can out of the ManagedServiceData prop, for squeezing in our rules (even if they have a ton of RuleActionOverrides on them)
Values: allow async code. This adds a dynamic import of the firewall config for enabling people that want to run async code on then, ensuring that all async code will run during the import
Issue#317 Evaluation time windows for request aggregation with rate-based rules. You can now select time windows of 1 minute, 2 minutes or 10 minutes, in addition to the previously supported 5 minutes.
CustomRule StatementType is now part of the log Capacity Table

Fixed

RateBasedStatement.CustomKeys is a array of objects, not a object
Recursive code for adding RateBasedStatement.ScopeDownStatement. The prop ScopeDownStatement of RateBasedStatements can have And, Or and Not statements, just like any other Statement. Without this fix, deploying RateBasedStatements with complex ScopeDownStatements fails on capacity checking.
Don't enforce update if EnforceUpdate prop is not defined. If its not defined, set EnforceUpdate to false.
Enhance the enumcheck to handle API throttling by adding sleep functionality.
Bumped Jest from version 29.7.0 to 29.7.0 (old version: 29.7.0).
Bumped TypeScript from version 5.3.3 to 5.4.5 (old version: 5.3.3).
Bumped ESLint from version 8.56.0 to 8.56.0 (old version: 8.56.0).
Bumped @typescript-eslint/parser and @typescript-eslint/eslint-plugin from version 6.19.0 to 7.6.0.
Bumped AWS CDK from version 2.121.1 to 2.137.0 (old version: 2.121.1).
Bumped @aws-sdk/client-cloudformation, @aws-sdk/client-cloudwatch, @aws-sdk/client-fms, @aws-sdk/client-pricing, @aws-sdk/client-service-quotas, @aws-sdk/client-shield, @aws-sdk/client-ssm, and @aws-sdk/client-wafv2 from version 3.490.0 to 3.554.0
Removed redundant declaration of "@typescript-eslint/eslint-plugin" and "@typescript-eslint/parser" dependencies.
Removed redundant declaration of "@types/lodash" dependency.
Added missing comma after TypeScript version 5.3.3 in devDependencies.

I've found issues running it on Node 20. Also adds a change to ensure that only npm is used for managing dependencies, done by the script `npx only-allow npm`. Not a good idea to mix dependency managers on the same project, like npm and Yarn.

Docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratebasedstatement.html\#cfn-wafv2-webacl-ratebasedstatement-customkeys

This commit differentiate ipsets from different FMS configs by adding the name of the webacl to it. Without this commit, trying to run aws-firewall-factory for two configs which uses a ipset with the same name would give a error on CloudFormation ('IpSet with name x already exists')

This commit helps a lot by immediately letting us know which rule failed capacity checking and requires fixes

The prop ScopeDownStatement of RateBasedStatements can have And, Or and Not statements, just like any other Statement. Without this fix, deploying RateBasedStatements with complex ScopeDownStatement fails on capacity checking.

The ManagedServiceData has a hard limit of 8192 characters. I've asked AWS about raising it and they said that this is a hard limit and they can't raise it. This commit is for saving as much chars as we can out of the ManagedServiceData prop, for squeezing in our rules (even if they have a ton of RuleActionOverrides on them)

This adds a dynamic import of the firewall config for enabling people that want to run async code on then, ensuring that all async code will run during the import

Sometimes the lambda that fetches the latest version of the ManagedRules fetches a 'beta' version, one that shouldn't be used on WAF. Without this fix the error below can happen on CloudFormation: ``` Resource handler returned message: The managed rule group AWSManagedRulesLinuxRuleSet's version [Version_2.2_PLUS_RC_COUNT] isn't valid. This managed rule group version must be an available version for the WAF managed rule group, and have the same format. ```

vboufleur and others added 30 commits April 3, 2024 17:04

Ensure the repo runs only under Node 18

cc4be9f

I've found issues running it on Node 20. Also adds a change to ensure that only npm is used for managing dependencies, done by the script `npx only-allow npm`. Not a good idea to mix dependency managers on the same project, like npm and Yarn.

Fix: customKeys is a array of objects

9159eda

Docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratebasedstatement.html\#cfn-wafv2-webacl-ratebasedstatement-customkeys

CheckCapacity: see which rule failed

c0c43ba

This commit helps a lot by immediately letting us know which rule failed capacity checking and requires fixes

Fix: recursive scopeDownStatement

0d9cc9e

The prop ScopeDownStatement of RateBasedStatements can have And, Or and Not statements, just like any other Statement. Without this fix, deploying RateBasedStatements with complex ScopeDownStatement fails on capacity checking.

Values: allow async code

b90666d

This adds a dynamic import of the firewall config for enabling people that want to run async code on then, ensuring that all async code will run during the import

Bump versions + CHANGELOG

3151d2a

add missing label

54c4157

update labels

0e3695b

update cdk lib and extend transformer for evaluationWindowSec

5111ffc

fix transformer

7045c87

enahnce enum checker

1daf583

bump versions

12193c0

adjust changelog

8d7fd18

update changelog

8817eb3

adjust output and changelog

06926fd

extend for ratebasedStatements

22bf903

fix calculation

be8ef5c

fix ratebasedstatementcapacitycalculation

748a1d5

add statementtype to console.log

7640350

add description to function

10e36b3

improve github action

5d2dc99

gh

4e27e6c

gh

246c844

change to lambda

3ccb919

fix entry point

aa3e7a9

gh check

b9971b6

correct action

388bee8

daknhh added 17 commits April 13, 2024 11:03

rollback to nodejslambda

606b89d

go back to qemu

4a8c12a

adjust guthub action

f279262

change workflow concurrency

9c033c0

add new testcase

2f1d1a6

add missing test values file

8fb6c29

fix

70d3cbd

fix rollout

0417761

remove console log

380e1ab

add guidance before throw error

16bb2bb

update workflow dep versions

0d57740

add second rule

7cd2760

adjust workflows deps

2d2f7ca

adjust workflow triggers

0a8e47b

extend guidance helper and adjust changelog

0432d81

update dependency

061266b

update changelog

a4be5c3

daknhh mentioned this pull request Apr 16, 2024

Several misc fixes #340

Merged

daknhh added 3 commits April 17, 2024 15:30

add toolkit stackname to toolkitstackname

6e560e7

adjust changelog

4a3e074

adjust functionname

a078ae7

daknhh merged commit 5ea87b1 into master Apr 17, 2024
7 checks passed

daknhh mentioned this pull request Apr 17, 2024

🚀 FEATURE: Configurable Rate-Limiting Rule Evaluation Window #317

Closed

daknhh deleted the pullrequests/vboufleur/fix/several branch April 17, 2024 14:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

4.3.0 #346

4.3.0 #346

daknhh commented Apr 15, 2024

4.3.0 #346

4.3.0 #346

Conversation

daknhh commented Apr 15, 2024

Added

Fixed