|
| 1 | +# CFNDSL |
| 2 | + |
| 3 | +Resource('RateLimitRule') { |
| 4 | + Type 'Custom::WAFRateLimit' |
| 5 | + Property('ServiceToken', FnGetAtt('WAFRateLimitFunction', 'Arn')) |
| 6 | + Property('EnvironmentName', Ref('EnvironmentName')) |
| 7 | + Property('Region', Ref("AWS::Region")) |
| 8 | + Property('Rate', 5000) |
| 9 | + Property('Negated', true) |
| 10 | + Property('Action', 'BLOCK') |
| 11 | + Property('IPSet', waf_ip_set(ip_blocks, ['rate_limited'])) |
| 12 | + Property('WebACLId', Ref('WebACL')) |
| 13 | + Property('Priority', 2) |
| 14 | +} |
| 15 | + |
| 16 | +Resource('WAFRateLimitFunction') { |
| 17 | + Type 'AWS::Lambda::Function' |
| 18 | + Property('Code', './waf_rate_limit/') |
| 19 | + Property('Handler', 'handler.lambda_handler') |
| 20 | + Property('Runtime', 'python3.6') |
| 21 | + Property('Timeout', 60) |
| 22 | + Property('Role', FnGetAtt('WAFRole', 'Arn')) |
| 23 | +} |
| 24 | + |
| 25 | +Resource("WAFRole") { |
| 26 | + Type 'AWS::IAM::Role' |
| 27 | + Property('AssumeRolePolicyDocument', { |
| 28 | + Statement: [ |
| 29 | + Effect: 'Allow', |
| 30 | + Principal: { Service: [ 'lambda.amazonaws.com' ] }, |
| 31 | + Action: [ 'sts:AssumeRole' ] |
| 32 | + ] |
| 33 | + }) |
| 34 | + Property('Path','/') |
| 35 | + Property('Policies', Policies.new.get_policies('waf')) |
| 36 | +} |
0 commit comments