WAF ACL: no way to add association for existing CloudFront distribution

[batrudinych]

Describe the feature

Add controls to either WAF V2 class or CloudFront Distribution class to be able to setup association for an existing CloudFront distribution. Currently only CloudFront distribution constructor accepts webAclId. There is no way to add webAclId if fromDistributionAttributes has been used to import existing distribution.

Use Case

There is an existing CloudFront distribution with a CNAME attached. A new separate CDK template is created with WAF web ACL. I want to establish an association between the ACL and an existing CloudFront distribution that's been imported into the current template via fromDistributionAttributes call.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.114.1

Environment details (OS name and version, etc.)

ManjaroLinux 23.1.4

[khushail]

Hi @batrudinych , thanks for reaching out. Have you checked this Construct prop -which might be helpful in your case ?

[batrudinych]

hey @khushail, as i stated in the description, the webAclId construct prop is helpful in case i'm creating a distribution. However, in the described use case the distribution already exists. WAF is being added on a later stage. In that case construct prop can't be used because Distribution object is not created via constructor, it's imported via fromDistributionAttributes. Does it make sense?

[khushail]

@batrudinych that perfectly makes sense. I see this method has limitation, so marking this request as appropriate.