MDAA TS Docs
    Preparing search index...

    Interface WafProps

    Web Application Firewall configuration for security protection

    interface WafProps {
        allowedCidrs?: string[];
        globalWafArn?: string;
        rateLimit?: RateLimitConfig;
        regionalWafArn?: string;
        skipGlobalDefaultWaf?: boolean;
        skipRegionalDefaultWaf?: boolean;
        wafRules?: { [key: string]: WafRulesProps };
    }
    Index

    Properties

    allowedCidrs? globalWafArn? rateLimit? regionalWafArn? skipGlobalDefaultWaf? skipRegionalDefaultWaf? wafRules?

    Properties

    allowedCidrs?: string[]

    CIDR blocks allowed to access the application

    globalWafArn?: string

    ARN of an existing global (CLOUDFRONT-scoped) WAF Web ACL to associate with CloudFront distributions. Must be in us-east-1. Only used when skipGlobalDefaultWaf is true.

    rateLimit?: RateLimitConfig

    Rate limiting configuration for the default WAFs created by this module.

    Rate limiting is enabled by default (secure-by-default): when omitted, a per-IP rate-based rule is applied to both the regional and global WAFs, plus a per-user (Authorization header) rule on the regional (API Gateway) WAF. Set { enabled: false } to opt out, or tune limit / evaluationWindowSec / perUser to adjust thresholds. Only applies to WAFs created by this module — has no effect when regionalWafArn / globalWafArn reference an externally managed WAF.

    regionalWafArn?: string

    ARN of an existing regional WAF Web ACL to associate with API Gateway and Cognito. Only used when skipRegionalDefaultWaf is true.

    skipGlobalDefaultWaf?: boolean

    Skip creating the default global (CLOUDFRONT-scoped) WAF.

    When true, no global WAF is created. CloudFront distributions (client UI and admin UI) will have no WAF protection unless you provide an existing WAF ARN via globalWafArn. This means no IP allowlisting, rate limiting, or managed rules on the frontend.

    For non-us-east-1 deployments that want automatic global WAF creation, leave this false and configure additional_stacks: [{region: 'us-east-1'}] in mdaa.yaml instead.

    Use cases: using AWS Firewall Manager, providing a pre-created global WAF via globalWafArn, or intentionally running without CloudFront WAF protection.

    false
    skipRegionalDefaultWaf?: boolean

    Skip creating the default regional WAF.

    When true, no regional WAF is created. API Gateway and Cognito will have no WAF protection unless you provide an existing WAF ARN via regionalWafArn.

    Use cases: using AWS Firewall Manager, or providing a pre-created regional WAF.

    false
    wafRules?: { [key: string]: WafRulesProps }

    Custom WAF rules with priorities

    Settings

    Member Visibility

    On This Page

    Properties