Associate WAF ACL

[luisiturrios1]

I'm currently using the OpenNext AWS setup for my project, and I'd like to add an AWS WAF ACL to my CloudFront distribution to enhance security. However, I couldn't find any documentation or clear guidance on how to associate an existing WAF ACL with the CloudFront distribution in the current OpenNext setup.

[sommeeeer]

this is more of a SST question than an open-next.

if you are using sstv2 you need to create it using aws-cdk-lib then pass it through to cdk.distribution.webAclId on the NextjsSite construct.

if you are using ion you need to use pulumi's aws.wafv2.WebAcl, and then use transform on sst.aws.Nextjs.

[luisiturrios1]

Thanks a lot for your response, this works for me

new sst.aws.Nextjs("MyApp", {
  transform: {
    cdn: {
      transform: {
        distribution: {
          webAclId: "arn:aws:wafv2:us-east-1:XXXXXXXXXXXX.....",
        },
      },
    },
  },
});