WAF for Request-Driven Web Service Addon template

[siddvoh]

We're now bringing support for WAF with App Runner in Copilot! Read full blog post here.

Configure your Request-Driven Web Service service and then go to

.
└── copilot/
  └── <name of your Request-Driven Web Service>/
      └── manifest.yml

If you don't have addons/ folder under ./copilot/<name of your Request-Driven Web Service> yet, create one.

In the addons folder, create two new files: waf.yml and addons.parameters.yml. Your folders would now look like this:

.
└── copilot
    └── <name of your Request-Driven Web Service>/
        ├── manifest.yml
        └── addons/
            ├── waf.yml 
            └── addons.parameters.yml

Copy and paste the following content to the respective files:

• "waf.yml"

#Addon template to add WAF configuration to your App Runner service.
  
Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.
  ServiceARN:
    Type: String
    Default: ""
    Description: The ARN of the service being deployed.
  
Resources:
  # Configuration of the WAF Web ACL you want to asscoiate with 
  # your App Runner service.
  Firewall:
    Metadata:
      'aws:copilot:description': 'Associating your App Runner service with your WAF Web ACL'
    Type: AWS::WAFv2::WebACLAssociation
    Properties: 
      ResourceArn: !Sub ${ServiceARN}
      WebACLArn:  <paste your WAF Web ACL ARN here> # Paste your WAF Web ACL ARN here.

• "addons.parameters.yml"

Parameters:
  ServiceARN: !Ref Service

Now, edit the Firewall.Properties.WebACLArn field of the waf.yml file and paste your WAF Web ACL ARN in it.

Finally, run copilot svc deploy! Your Request-Driven Web service will now be deployed along with a WAF Web ACL!