Possible to override a static website Web ACL rule?

[bhrutledge]

I need to set one of the rules in AWS-AWSManagedRulesCommonRuleSet to "Override to Count". Is that possible? I don't seen any hooks in the public API of the StaticWebsite construct. IIRC the CDK provides an "escape hatch" to directly modify the CF template, but I don't remember what that is. I'm hoping that I don't have to build a Web ACL from scratch.

Here's how I'm using the construct:

self.website = static_website.StaticWebsite(
    self,
    "StaticWebsite",
    website_content_path=str(self.dist_path.resolve()),
    distribution_props=cloudfront.DistributionProps(
        domain_names=[self.domain_name],
        certificate=self.certificate,
    ),
)

[bhrutledge]

And/or, more generally, is it possible to expose the generated Web ACL (e.g. from StaticWebsite.cloud_front_distribution), to support additional customization (like enabling logging)?

[agdimech]

Hi mate.

Unfortunately the WebACL is not a CDK construct and is actually a custom resource under the covers. The reason for this is that there is a limitation with the CDK currently where the ACL can only be created in the same region as the stack being deployed. Given we want to host on Cloudfront, the WebACL must be deployed to us-east-1, hence why we need to use a custom resource.