How to update a WebACL in WAFV2 using either PHP SDK or AWS CLI without losing important configuration

Question

When working with WAFV2 and making a call to GetWebACL the CustomResponse configuration is missing.
If this configuration is subsequently used in a call to UpdateWebACL then the CustomResponse is lost.

This appears to be a serious bug that would potentially cause undetected loss of configuration as the response from both API calls is successful.

The API documentation states:

> To modify a web ACL, do the following:
    1) Retrieve it by calling GetWebACL
    2) Update its settings as needed
    3) Provide the complete web ACL specification to UpdateWebACL

https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-wafv2-2019-07-29.html#updatewebacl

For example a WAFV2 Rule with the following configuration:

```
{
   "Name":"RateLimit-3000",
   "Priority":8,
   "Statement":{
      "RateBasedStatement":{
         "Limit":3000,
         "AggregateKeyType":"IP"
      }
   },
   "Action":{
      "Block":{
         "CustomResponse":{
            "ResponseCode":429,
            "CustomResponseBodyKey":"TooManyRequests"
         }
      }
   },
   "VisibilityConfig":{
      "SampledRequestsEnabled":true,
      "CloudWatchMetricsEnabled":true,
      "MetricName":"RateLimit-3000"
   }
}
```

Is returned from an API call to GetWebACL as this:

```
{
   "Name":"RateLimit-3000",
   "Priority":8,
   "VisibilityConfig":{
      "MetricName":"RateLimit-3000",
      "CloudWatchMetricsEnabled":true,
      "SampledRequestsEnabled":true
   },
   "Action":{
      "Block": { }
   },
   "Statement":{
      "RateBasedStatement":{
         "AggregateKeyType":"IP",
         "Limit":3000
      }
   }
}
```

If that configuration is then passed back to an API call to UpdateWebACL then the CustomResponse in the Block Action is removed.

Is this a known bug or is there another way to correctly update a WebACL without loss of configuration?

Accepted Answer

Thanks for all the suggestions. After contacting AWS Support, this issue has now been solved by updating both PHP SDK and AWS CLI to their latest versions. Hopefully this answer will help others as using an older version of either PHP SDK or AWS CLI will still work but using them will be destructive and cause configuration to be inadvertently lost.

Answer

Hi,

Thank you for contacting AWS Re:post .

I understand you have some clarifications regarding updating a WebACL in WAFV2 using either PHP SDK or AWS CLI without losing important configuration

Looking at the issue, This would require further analysis and troubleshooting. I would suggest you to open a case with the WAF premium support team and provide details such as:

--> WAF configuration  
--> Any supported Logs (Access logs)

Thanks and have a nice day!

How to update a WebACL in WAFV2 using either PHP SDK or AWS CLI without losing important configuration

Relevant content