@jaypie/constructs 1.2.39 → 1.2.40

package/dist/cjs/JaypieDistribution.d.ts

@@ -22,6 +22,17 @@ export interface JaypieWafConfig {
      * @default true
      */
     logBucket?: boolean | s3.IBucket;
+    /**
+     * Override actions for specific rules within managed rule groups.
+     * Key is the managed rule group name; value is an array of rule action overrides.
+     * @example
+     * managedRuleOverrides: {
+     *   AWSManagedRulesCommonRuleSet: [
+     *     { name: "SizeRestrictions_BODY", actionToUse: { count: {} } },
+     *   ],
+     * }
+     */
+    managedRuleOverrides?: Record<string, wafv2.CfnWebACL.RuleActionOverrideProperty[]>;
     /**
      * Managed rule group names to apply
      * @default ["AWSManagedRulesCommonRuleSet", "AWSManagedRulesKnownBadInputsRuleSet"]

package/dist/cjs/index.cjs

@@ -2648,11 +2648,12 @@ class JaypieDistribution extends constructs.Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                const { managedRuleOverrides, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
                 for (const ruleName of managedRules) {
+                    const ruleActionOverrides = managedRuleOverrides?.[ruleName];
                     rules.push({
                         name: ruleName,
                         priority: priority++,
@@ -2661,6 +2662,7 @@ class JaypieDistribution extends constructs.Construct {
                             managedRuleGroupStatement: {
                                 name: ruleName,
                                 vendorName: "AWS",
+                                ...(ruleActionOverrides && { ruleActionOverrides }),
                             },
                         },
                         visibilityConfig: {