serverless-appsync-plugin
serverless-appsync-plugin copied to clipboard
Support AWS Oversize handling for default WAF rules
The default disable introspection rule is non compliant with a recent WAF change which makes the OversizeHandling property required.

AWS issued a warning email that after March 31 2023, any updates to WAF Web ACL's without oversize handling, will fail.
In the meanwhile, I have been able to workaround the limitation by defining a new rule manually
wafConfig:
enabled: true
rules:
- name: "DisableIntrospection"
priority: 200
action: Block
statement:
ByteMatchStatement:
FieldToMatch:
Body:
OversizeHandling: "CONTINUE"
PositionalConstraint: "CONTAINS"
SearchString: "__schema"
TextTransformations:
- Type: "COMPRESS_WHITE_SPACE"
Priority: 0
Ideally it would be possible to provide an oversize handling like can be done with Name and Priority. However, a default of "Continue" can be applied in line with the AWS default.
https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-oversize-handling.html