
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
serverless-associate-waf-v3
Advanced tools
Associate a regional WAF with the AWS API Gateway used by your Serverless stack.
Associate a regional WAF with the AWS API Gateway used by your Serverless stack.
This is based off serverless-associate-waf, essentially all the same code and retains the same licensing. The fork is due to it (seemingly) being abandoned and having many old dependencies. For a project I was working on I needed to update a few things and wanted to upgrade it to the Serverless Plugin architecture v3, thus the naming.
Main changes:
getAccountInfo
to get the partition
of the arn
(required for govcloud to work)ServerlessError
to stop the deploy vs silently failing and allowing to proceednpm install serverless-associate-waf-v3 --save-dev
Add the plugin to your serverless.yml
:
plugins:
- serverless-associate-waf-v3
Add your custom configuration:
custom:
associateWaf:
name: myRegionalWaf
version: Regional #(optional) Regional | V2
Property | Required | Type | Default | Description |
---|---|---|---|---|
name | true | string | The name of the regional WAF to associate the API Gateway with | |
version | false | string | Regional | The AWS WAF version to be used |
You will also need to add extra permissions to the user if it does not already include the following - consider this an example only, you can restrict it further:
provider:
name: aws
runtime: nodejs18.x
region: us-west-1
endpointType: REGIONAL
iam:
role:
statements:
- Effect: Allow
Action:
- apigateway:SetWebACL
Resource:
- 'arn:aws:apigateway:us-west-1::/*/*'
- Effect: Allow
Action:
- wafv2:ListWebACLs
- wafv2:AssociateWebACL
- wafv2:DisassociateWebACL
- wafv2:GetWebACLForResource
Resource:
- 'arn:aws:wafv2:us-west-1:ACCOUNTNUMBER:regional/webacl/*/*'
Remove the name
property from your custom configuration but keep the version
if specified, and then deploy the application. The plugin must stay in the plugins list of serverless.yml
in order for the WAF to be disassociated.
Configuration of your serverless.yml
is all you need.
There are no custom commands, just run: sls deploy
FAQs
Associate a regional WAF with the AWS API Gateway used by your Serverless stack.
The npm package serverless-associate-waf-v3 receives a total of 12 weekly downloads. As such, serverless-associate-waf-v3 popularity was classified as not popular.
We found that serverless-associate-waf-v3 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.