@jaypie/constructs 1.2.46 → 1.2.48

package/dist/cjs/JaypieDistribution.d.ts

@@ -42,6 +42,30 @@ export interface JaypieWafConfig {
      * }
      */
     managedRuleOverrides?: Record<string, wafv2.CfnWebACL.RuleActionOverrideProperty[]>;
+    /**
+     * Optional scope-down statements per managed rule group. When supplied,
+     * the managed rule group only evaluates requests that match the
+     * scope-down statement. Key is the managed rule group name; value is a
+     * `CfnWebACL.StatementProperty`.
+     *
+     * @example
+     * // Only run AWSManagedRulesCommonRuleSet for non-/chat paths
+     * managedRuleScopeDowns: {
+     *   AWSManagedRulesCommonRuleSet: {
+     *     notStatement: {
+     *       statement: {
+     *         byteMatchStatement: {
+     *           fieldToMatch: { uriPath: {} },
+     *           positionalConstraint: "STARTS_WITH",
+     *           searchString: "/chat",
+     *           textTransformations: [{ priority: 0, type: "NONE" }],
+     *         },
+     *       },
+     *     },
+     *   },
+     * }
+     */
+    managedRuleScopeDowns?: Record<string, wafv2.CfnWebACL.StatementProperty>;
     /**
      * Managed rule group names to apply
      * @default ["AWSManagedRulesCommonRuleSet", "AWSManagedRulesKnownBadInputsRuleSet"]

package/dist/cjs/index.cjs

@@ -2655,12 +2655,13 @@ class JaypieDistribution extends constructs.Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRuleOverrides, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
                 for (const ruleName of managedRules) {
                     const ruleActionOverrides = managedRuleOverrides?.[ruleName];
+                    const scopeDownStatement = managedRuleScopeDowns?.[ruleName];
                     rules.push({
                         name: ruleName,
                         priority: priority++,
@@ -2670,6 +2671,7 @@ class JaypieDistribution extends constructs.Construct {
                                 name: ruleName,
                                 vendorName: "AWS",
                                 ...(ruleActionOverrides && { ruleActionOverrides }),
+                                ...(scopeDownStatement && { scopeDownStatement }),
                             },
                         },
                         visibilityConfig: {
@@ -2682,7 +2684,7 @@ class JaypieDistribution extends constructs.Construct {
                 // Add rate-based rule
                 rules.push({
                     name: "RateLimitPerIp",
-                    priority: priority++,
+                    priority,
                     action: { block: {} },
                     statement: {
                         rateBasedStatement: {