demo-stack.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Demo stack for the rate-based rule provider

Resources:
  NormalRule:
    Type: AWS::WAF::Rule
    Properties:
      Name: demonormalrule
      MetricName: demonormalrulemetric
      Predicates:
      - Negated: False
        Type: SqlInjectionMatch
        DataId: !ImportValue SqlInjectionMatchSetTestPredicate
  RateBasedRule:
    Type: Custom::RateBasedRule
    Properties:
      Name: ratebasedrule
      MetricName: ratebasedrulemetric
      RateKey: IP
      RateLimit: 4500
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-waf-provider'
  RateBasedRuleWithPredicate1:
    DependsOn: RateBasedRule
    Type: Custom::RateBasedRule
    Properties:
      Name: ratebasedrulepredicate1
      MetricName: ratebasedrulepredicate1metric
      RateKey: IP
      RateLimit: 3245
      MatchPredicates:
      -
        Negated: False
        Type: XssMatch
        DataId: !ImportValue XssMatchSetTrestPredicate
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-waf-provider'
  RateBasedRuleWithPredicate2:
    DependsOn: RateBasedRuleWithPredicate1
    Type: Custom::RateBasedRule
    Properties:
      Name: ratebasedrulepredicate2
      MetricName: ratebasedrulepredicate2metric
      RateKey: IP
      RateLimit: 2800
      MatchPredicates:
      -
        Negated: False
        Type: SqlInjectionMatch
        DataId: !ImportValue SqlInjectionMatchSetTestPredicate
      -
        Negated: True
        Type: ByteMatch
        DataId: !ImportValue ByteMatchSetTestPredicate
      ServiceToken: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:binxio-cfn-waf-provider'
  WebACL:
    DependsOn:
    - RateBasedRuleWithPredicate1
    Type: AWS::WAF::WebACL
    Properties:
      DefaultAction:
        Type: ALLOW
      MetricName: demowebaclmetric
      Name: demowebacl
      Rules:
      - Action:
          Type: BLOCK
        Priority: 1
        RuleId: !Ref NormalRule

Outputs:
  RateBasedRuleRef:
    Value: !Ref RateBasedRule
  NormalRuleRef:
    Value: !Ref NormalRule