@jaypie/constructs 1.2.39 → 1.2.41

package/dist/esm/JaypieDistribution.d.ts

@@ -22,6 +22,17 @@ export interface JaypieWafConfig {
      * @default true
      */
     logBucket?: boolean | s3.IBucket;
+    /**
+     * Override actions for specific rules within managed rule groups.
+     * Key is the managed rule group name; value is an array of rule action overrides.
+     * @example
+     * managedRuleOverrides: {
+     *   AWSManagedRulesCommonRuleSet: [
+     *     { name: "SizeRestrictions_BODY", actionToUse: { count: {} } },
+     *   ],
+     * }
+     */
+    managedRuleOverrides?: Record<string, wafv2.CfnWebACL.RuleActionOverrideProperty[]>;
     /**
      * Managed rule group names to apply
      * @default ["AWSManagedRulesCommonRuleSet", "AWSManagedRulesKnownBadInputsRuleSet"]

package/dist/esm/index.js

@@ -2612,11 +2612,12 @@ class JaypieDistribution extends Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                const { managedRuleOverrides, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
                 for (const ruleName of managedRules) {
+                    const ruleActionOverrides = managedRuleOverrides?.[ruleName];
                     rules.push({
                         name: ruleName,
                         priority: priority++,
@@ -2625,6 +2626,7 @@ class JaypieDistribution extends Construct {
                             managedRuleGroupStatement: {
                                 name: ruleName,
                                 vendorName: "AWS",
+                                ...(ruleActionOverrides && { ruleActionOverrides }),
                             },
                         },
                         visibilityConfig: {
@@ -3917,6 +3919,7 @@ class JaypieSsoPermissions extends Construct {
                             "dynamodb:*",
                             "ec2:*",
                             "ecr:*",
+                            "ecs:*",
                             "iam:Get*",
                             "iam:List*",
                             "iam:PassRole",