feat(#234): add AWS WAFv2 web ACL (aws_wafv2_web_acl) resource handler - #235
Merged
Conversation
elecnix
marked this pull request as ready for review
July 6, 2026 15:59
Native handler for AWS WAFv2 web ACLs, mirroring the KMS handler (#208): a fixed monthly component (web ACL + per-rule) plus a per-request usage component, priced from the catalog via catalog_metrics instead of a flatOverride escape hatch. - resources/waf.py: WAFv2WebACL(RoutingResource), service AWSWAF. Matches aws_wafv2_web_acl.*, the Pulumi aws.wafv2.WebAcl: form, and the CloudFormation AWS::WAFv2::WebACL form. Classic WAF (aws_waf_web_acl) is a distinct retired product and is intentionally not matched. - registry.py: register the handler. - data/seed/aws_pricelist_seed.json: us-east-1 seed rows — WAF-WebACL-Month $5.00, WAF-Rule-Month $1.00, WAF-Request $0.60/million. - tests/test_waf.py: address/extract/registry/pricing, mirroring test_kms.py. Add-on SKUs (Bot Control, Fraud Control/ATP, CAPTCHA) are separate products and out of scope. Live Infracost _METRIC_DESCRIPTORS wiring is a follow-up (same split as KMS #208 handler / #217 descriptors). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
elecnix
force-pushed
the
feat/234-wafv2-web-acl-handler
branch
from
July 6, 2026 16:00
bce0c96 to
877568c
Compare
elecnix
added a commit
that referenced
this pull request
Jul 6, 2026
* feat(#234): wire live Infracost pricing for WAFv2 web ACL metrics Follow-up to the WAFv2 handler (#235), mirroring the KMS split (handler #214, descriptors #218): add Infracost _METRIC_DESCRIPTORS for the three WAFv2 usage metrics so a live pricing sync populates the catalog. Grounded in Infracost's own resource definition (infracost/infracost, internal/resources/aws/wafv2_web_acl.go): service "awswaf", product family "Web Application Firewall", usagetypes <REGION>-WebACLV2 / -RuleV2 / -RequestV2-Tier1. The region prefix is resolved at query time; the exact-match usagetype naturally excludes the "ShieldProtected-" siblings. Tests mock the HTTP layer (mirroring the KMS descriptor tests): descriptor presence, REGION_PREFIX resolution for us-east-1 (USE1) and ca-central-1 (CAN1), and an end-to-end sync_to_cache upsert. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fixup(#234): remap WAFv2 live prices to "AWSWAF" via store_service Infracost prices WAF under the lowercase service code "awswaf", but the handler and seed rows use the uppercase "AWSWAF" convention (matching AWSKMS / AmazonALB / AWSSecretsManager). Without a remap the live-synced rows land under "awswaf" and the case-sensitive catalog query for "AWSWAF" misses them — silently falling back to embedded rates. `store_service: "AWSWAF"` upserts them under the queried name, the same remap the NAT Gateway descriptor uses (AmazonEC2 → AmazonVPC). Verified against live Infracost (us-east-1 + ca-central-1): each metric resolves to exactly one row and an "AWSWAF" query returns $5.00 web ACL, $1.00/rule, $0.0000006/request. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #234.
What
Native handler for AWS WAFv2 web ACLs (
aws_wafv2_web_acl), so a model with aWAF prices from the catalog (seed + live) instead of falling back to a
flatOverridenode with embedded rates. Same shape as the KMS handler (#208):a fixed monthly component + a usage component.
Changes
infra_cost_model/resources/waf.py—WAFv2WebACL(RoutingResource),service
AWSWAF.valid_metrics:webAcls,rules,requests.catalog_metrics:webAcls → WAF-WebACL-Month,rules → WAF-Rule-Month,requests → WAF-Request(prices from the catalog, Principle 13).from_addressmatchesaws_wafv2_web_acl.*, the Pulumiaws.wafv2.WebAcl:form, and the CloudFormation
AWS::WAFv2::WebACLform. Classic WAF(
aws_waf_web_acl) and rule groups are intentionally not matched.extract_*capturename,scope, and aruleCount(informational; usageis supplied via the model's
usageMetrics, keeping derivation and pricingseparate per Principle 6).
infra_cost_model/resources/registry.py— register the handler.data/seed/aws_pricelist_seed.json— us-east-1 seed rows:WAF-WebACL-Month$5.00,
WAF-Rule-Month$1.00,WAF-Request$0.0000006 ($0.60/million).tests/test_waf.py— address/extract/registry/pricing, mirroringtests/test_kms.py.Scope
Add-on SKUs (Bot Control, Fraud Control / ATP, CAPTCHA, intelligent threat
mitigation) are separate products and out of scope, matching how the ALB handler
defers NLB and the KMS handler defers asymmetric-key requests.
Live Infracost
_METRIC_DESCRIPTORSwiring is a follow-up PR — the samesplit used for KMS (handler in #214, descriptors in #218), since the Infracost
service code and product families need confirming against a live query.
Tests
pytest— full suite green (937 passed) in a pristine pricing cache; 20 newtests in
test_waf.py.