[アップデート] AWS CDK で CloudFront Distribution の作成後に Web ACL をアタッチ可能になりました

npm i aws-cdk-lib@latest aws-cdk@latest

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
import * as wafv2 from 'aws-cdk-lib/aws-wafv2';

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps) {
    super(scope, id, props);

    // CloudFront Distribution
    const distribution = new cloudfront.Distribution(this, 'Distribution', {
      defaultBehavior: {
        origin: new origins.HttpOrigin('classmethod.jp'),
      },
      // webAclId: webAcl.attrArn, // 以前まではこのように Distribution 作成時に WebACL をアタッチする方法のみだった
    });

    // AWS WAFv2 WebACL
    const webAcl = new wafv2.CfnWebACL(this, 'WebAcl', {
      scope: 'CLOUDFRONT',
      defaultAction: { allow: {} },
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: 'webACL',
        sampledRequestsEnabled: true,
      },
      rules: [],
    });

    // CloudFront Distribution に WebACL をアタッチ
    distribution.attachWebAclId(webAcl.attrArn);
  }
}

$ npx cdk diff Main
start: Building 27e445a130d4f4553a04ed2a11e6f447d55a5ee7ee1dc2211971188b3fcbe293:XXXXXXXXXXXX-us-east-1
success: Built 27e445a130d4f4553a04ed2a11e6f447d55a5ee7ee1dc2211971188b3fcbe293:XXXXXXXXXXXX-us-east-1
start: Publishing 27e445a130d4f4553a04ed2a11e6f447d55a5ee7ee1dc2211971188b3fcbe293:XXXXXXXXXXXX-us-east-1
success: Published 27e445a130d4f4553a04ed2a11e6f447d55a5ee7ee1dc2211971188b3fcbe293:XXXXXXXXXXXX-us-east-1
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Stack Main
Resources
[~] AWS::CloudFront::Distribution Distribution Distribution830FAC52
 └─ [~] DistributionConfig
     └─ [+] Added: .WebACLId


✨  Number of stacks with differences: 1

$ npm run deploy -- Main

> [email protected] deploy
> cdk deploy --require-approval never --method=direct Main


✨  Synthesis time: 4.75s

Main: deploying... [1/1]
Main: updating stack...
10:10:26 PM | CREATE_FAILED        | AWS::WAFv2::WebACL            | WebAcl
Resource handler returned message: "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT (Service: Wafv2, Status Code: 400, Request ID: 9
8b508f1-626c-4922-87ad-5e1341bb6029)" (RequestToken: 1de0e851-bc87-21c5-4fe3-994251e5f14a, HandlerErrorCode: InvalidRequest)