feat(mtls): adding waf

Refs: #1377

packages/infra/lib/ihe-stack.ts

@@ -1,6 +1,5 @@
 import { Stack, StackProps } from "aws-cdk-lib";
 import { CfnOutput } from "aws-cdk-lib";
-import * as s3 from "aws-cdk-lib/aws-s3";
 import * as cert from "aws-cdk-lib/aws-certificatemanager";
 import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
 import * as ec2 from "aws-cdk-lib/aws-ec2";
@@ -10,11 +9,14 @@ import * as sns from "aws-cdk-lib/aws-sns";
 import { Construct } from "constructs";
 import { EnvConfig } from "../config/env-config";
 import { createLambda } from "./shared/lambda";
-import { setupLambdasLayers } from "./shared/lambda-layers";
-import { LambdaLayers } from "./shared/lambda-layers";
 import * as apigwv2 from "aws-cdk-lib/aws-apigatewayv2";
 import { HttpLambdaIntegration } from "aws-cdk-lib/aws-apigatewayv2-integrations";
 import { Function as Lambda } from "aws-cdk-lib/aws-lambda";
+import { LambdaLayers, setupLambdasLayers } from "./shared/lambda-layers";
+import * as s3 from "aws-cdk-lib/aws-s3";
+import { aws_wafv2 as wafv2 } from "aws-cdk-lib";
+import { wafRules } from "./shared/waf-rules";
+import * as cdk from "aws-cdk-lib";
 
 interface IHEStackProps extends StackProps {
  config: EnvConfig;
@@ -86,6 +88,18 @@ export class IHEStack extends Stack {
  securityPolicy: apigwv2.SecurityPolicy.TLS_1_2,
  });
 
+ const waf = new wafv2.CfnWebACL(this, "IHEGatewayWAF", {
+ defaultAction: { allow: {} },
+ scope: "REGIONAL",
+ name: `IHEGatewayWAF`,
+ rules: wafRules,
+ visibilityConfig: {
+ cloudWatchMetricsEnabled: true,
+ metricName: `IHEGatewayWAF-Metric`,
+ sampledRequestsEnabled: false,
+ },
+ });
+
  const apigw2 = new apigwv2.HttpApi(this, "IHEAPIGatewayv2", {
  defaultDomainMapping: {
  domainName: domainName,
@@ -97,6 +111,18 @@ export class IHEStack extends Stack {
  disableExecuteApiEndpoint: true,
  });
 
+ const apiGatewayArn = cdk.Stack.of(this).formatArn({
+ service: "apigateway",
+ resource: apigw2.apiId,
+ region: cdk.Stack.of(this).region,
+ account: cdk.Stack.of(this).account,
+ });
+
+ new wafv2.CfnWebACLAssociation(this, "APIWAFAssociation", {
+ resourceArn: apiGatewayArn,
+ webAclArn: waf.attrArn,
+ });
+
  // commenting out so CFN deletes
  new r53.ARecord(this, "IHEAPIDomainRecordv2", {
  recordName: iheApiUrl,