search

aws-cloudformation / cfn-lint

CloudFormation Linter
MIT No Attribution
2.44k stars 592 forks source link

Higher limit lint value for AWS WAF2 Ratelimit #3738

Open vaclavbarta opened 1 week ago

vaclavbarta commented 1 week ago

Hello, sorry - I'm not sure if this repository relates to my issues, but i think so.

AWS announced at august 2024 the lowering the limit for WAF RateLimit's limit from 100 to 10 here https://aws.amazon.com/about-aws/whats-new/2024/08/aws-waf-rate-based-rules-lower-rate-limits/ but this value cannot be used due cloudformation validation.

But i can't use it through cloudformation (cdk) because values lower than 100 failing on Cloudformation error

Resource handler returned message: "Model validation failed (#/Rules: 2 schema violations found) #/Rules/8/Statement/RateBasedStatement/Limit: failed validation constraint for keyword [minimum] (#/Rules/8/Statement/RateBasedStatement/Limit) #/Rules/9/Statement/RateBasedStatement/Limit: failed validation constraint for keyword [minimum] (#/Rules/9/Statement/RateBasedStatement/Limit)" (RequestToken: REDACTED-606b89, HandlerErrorCode: InvalidRequest)

I found that it is defined also here. Should it be synced please ? :)

https://github.com/aws-cloudformation/cfn-lint/blob/ee77420d94027eb03e2d28b36b265aac5de5d756/src/cfnlint/data/schemas/providers/us_east_1/aws-wafv2-rulegroup.json#L769-L773

Thank you very much Vaclav

kddejong commented 1 week ago

So we get our resource schemas from docs. Unfortunately it is wrong there and that is what service side validation uses. So while we can change it you will still get there.

vaclavbarta commented 1 week ago

Thank you @kddejong for fast response. I checked the zip and really there is 100 🤔 - Didn't you know where this can be reported to somebody who can fix it ? 😎

vaclavbarta commented 1 week ago

I try wrote it to Twitter so we see ;) https://x.com/AWSSupport/status/1844069569633161571

kddejong commented 1 week ago

I can see that its in the process of being changed but I can't say when it will be complete. Hopefully it will be soon.