Introduction
To manipulate AWS resources, we use PowerShell Core with AWS CLI v2. The post describes several functions which get information about web ACL. By documentation, AWS web ACL gives you fine-grained control over all of the HTTP(S) web requests that your protected resource responds to. You can protect Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, and Amazon Cognito resources.
Background
Solution uses AWS CLI v2, Web ACL v2 and PowerShell Core v.7.2.
Function Get-WAF2WebAclARN
Function Get-WAF2WebAclARN seeks regional web ACL by its name and return ARN or $null if a web ACL is not found.
Code
Function Get-WAF2WebAclARN {
[CmdletBinding(DefaultParameterSetName = 'Default')]
Param (
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = 'Default')]
[ValidateNotNullOrEmpty()]
[string]$WebAclName,
[Parameter(Mandatory = $false)]
[ValidateNotNullOrEmpty()]
[string]$RegionName = "us-west-1",
[Parameter(Mandatory = $false)]
[ValidateNotNullOrEmpty()]
[string]$AwsProfile = "default"
)
$functionName = $($myInvocation.MyCommand.Name);
Write-Host "$($functionName)(webACL=$WebAclName,
region=$RegionName, profile=$AwsProfile) starts." -ForegroundColor Blue;
$jsonObjects = $null;
$strJsonObjects = $null;
$awsObjects = $null;
$existObject = $false;
$queryRequest = "WebACLs[?Name==``$WebAclName``]";
$jsonObjects = aws --output json --profile $AwsProfile
--region $RegionName --color on `
wafv2 list-web-acls `
--scope REGIONAL `
--query $queryRequest;
if (-not $?) {
Write-Host "Listing web ACLs failed" -ForegroundColor Red;
return $null;
}
if ($jsonObjects) {
$strJsonObjects = [string]$jsonObjects;
$awsObjects = ConvertFrom-Json -InputObject $strJsonObjects;
$existObject = ($awsObjects.Count -gt 0);
}
if ($existObject) {
$webAclARN = $awsObjects.ARN;
Write-Verbose "Web ACL '$WebAclName' is found, ARN=$webAclARN";
return $webAclARN;
}
else {
Write-Verbose "Web ACL '$WebAclName' doesn't exist";
return $null;
}
}
Parameters
Functions has the following parameters:
- string
$WebAclName – the name of web ACL which is searched. Mandatory parameter with not empty value; - string
$RegionName – the name of AWS Region where web ACL is searched. Optional parameter with default value us-west-1; - string
$AwsProfile – the name of user AWS profile name from .aws config file. Optional parameter with default value default.
Return value
Function returns $null or ARN of found web ACL.
Workflow
Function is a wrapper to AWS CLI method aws wafv2 list-web-acls with query parameter...
$queryRequest = "WebACLs[?Name==``$WebAclName``]";
...which limits output to the required web ACL.
At lines 66-70, output is convert to the array of objects. At lines 71-79 result is checked and $null or ARN of found web ACL is returned.
Function Get-WAF2WebAclForResource
Function Get-WAF2WebAclForResource returns web ACL ARN if the web ACL is associated with the resource, that is defined by ARN. If a resource ARN is wrong or a web ACL is not associated with the resource, $null is returned.
Code
Function Get-WAF2WebAclForResource {
[CmdletBinding(DefaultParameterSetName = 'Default')]
Param (
[Parameter(Mandatory = $true, Position = 0, ParameterSetName = 'Default')]
[ValidateNotNullOrEmpty()]
[string]$ResourceARN,
[Parameter(Mandatory = $false)]
[ValidateNotNullOrEmpty()]
[string]$RegionName = "us-west-1",
[Parameter(Mandatory = $false)]
[ValidateNotNullOrEmpty()]
[string]$AwsProfile = "default"
)
$functionName = $($myInvocation.MyCommand.Name);
Write-Host "$($functionName)(Resource=$ResourceARN,
region=$RegionName, profile=$AwsProfile) starts." -ForegroundColor Blue;
$jsonObjects = $null;
$strJsonObjects = $null;
$awsObjects = $null;
$existObject = $false;
$jsonObjects = aws --output json --profile $AwsProfile
--region $RegionName --color on `
wafv2 get-web-acl-for-resource `
--resource-arn $ResourceARN;
if (-not $?) {
Write-Host "Getting web ACL associated with the resource failed,
check the Resource ARN" -ForegroundColor Red;
return $null;
}
if ($jsonObjects) {
$strJsonObjects = [string]$jsonObjects;
$awsObjects = ConvertFrom-Json -InputObject $strJsonObjects;
$existObject = ($awsObjects.Count -gt 0);
}
if ($existObject) {
$webAclARN = $awsObjects.WebACL.ARN;
Write-Verbose "Web ACL ARN=$webAclARN is associated with the resource";
return $webAclARN;
}
else {
Write-Verbose "The resource doesn't have associated web ACL";
return $null;
}
}
Parameters
Functions has the following parameters:
- string
$ResourceARN – ARN of the resource that is checked for associated web ACL. Mandatory parameter with not empty value; - string
$RegionName – the name of AWS Region where resource and associated web ACL is searched. Optional parameter with default value us-west-1; - string
$AwsProfile – the name of user AWS profile name from .aws config file. Optional parameter with default value default.
Return value
Function returns $null or ARN of associated web ACL.
Workflow
Function is a wrapper to AWS CLI method aws wafv2 get-web-acl-for-resource.
Let’s note that this method returns an error if the call is not successful or resource ARN doesn’t define the existent AWS resource. Function doesn’t distinct these cases and error check at lines 61-64 always returns $null.
At lines 66-70 output is convert to the array of objects. At lines 71-79, result is checked and $null or ARN of found web ACL is returned.
- All used IP-addresses, names of servers, workstations, domains, are fictional and are used exclusively as a demonstration only.
- Information is provided «AS IS».
