feat(#234): wire live Infracost pricing for WAFv2 web ACL metrics - #236
Merged
Conversation
Follow-up to the WAFv2 handler (#235), mirroring the KMS split (handler #214, descriptors #218): add Infracost _METRIC_DESCRIPTORS for the three WAFv2 usage metrics so a live pricing sync populates the catalog. Grounded in Infracost's own resource definition (infracost/infracost, internal/resources/aws/wafv2_web_acl.go): service "awswaf", product family "Web Application Firewall", usagetypes <REGION>-WebACLV2 / -RuleV2 / -RequestV2-Tier1. The region prefix is resolved at query time; the exact-match usagetype naturally excludes the "ShieldProtected-" siblings. Tests mock the HTTP layer (mirroring the KMS descriptor tests): descriptor presence, REGION_PREFIX resolution for us-east-1 (USE1) and ca-central-1 (CAN1), and an end-to-end sync_to_cache upsert. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
elecnix
marked this pull request as ready for review
July 6, 2026 16:22
Infracost prices WAF under the lowercase service code "awswaf", but the handler and seed rows use the uppercase "AWSWAF" convention (matching AWSKMS / AmazonALB / AWSSecretsManager). Without a remap the live-synced rows land under "awswaf" and the case-sensitive catalog query for "AWSWAF" misses them — silently falling back to embedded rates. `store_service: "AWSWAF"` upserts them under the queried name, the same remap the NAT Gateway descriptor uses (AmazonEC2 → AmazonVPC). Verified against live Infracost (us-east-1 + ca-central-1): each metric resolves to exactly one row and an "AWSWAF" query returns $5.00 web ACL, $1.00/rule, $0.0000006/request. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #235 (the WAFv2 web ACL handler). Wires live Infracost pricing for
the three WAFv2 usage metrics, so the catalog is populated from a live sync
instead of relying on the seed rows. Same split as the KMS handler (handler in
#214, descriptors in #218).
Changes
infra_cost_model/pricing/sources/infracost.py— add_METRIC_DESCRIPTORSentries for
WAF-WebACL-Month,WAF-Rule-Month,WAF-Request.tests/test_infracost_client.py— descriptor presence, REGION_PREFIXresolution (us-east-1 → USE1, ca-central-1 → CAN1), and an end-to-end mocked
sync_to_cacheupsert.Grounding
Values come from Infracost's own resource definition
(
internal/resources/aws/wafv2_web_acl.go):awswaf, product familyWeb Application Firewall.<REGION>-WebACLV2,<REGION>-RuleV2,<REGION>-RequestV2-Tier1.Exact-match on the resolved usagetype naturally excludes the
ShieldProtected-siblings that Infracost filters out with a(?!ShieldProtected-)regex.No
unitfilter: each usagetype resolves to a single price row, so filtering byunitwould only risk a spurious miss on an unverified unit string. The enginecomputes
quantity × pricedirectly, and Infracost returns WAF request pricingper single request (the "1M requests" label upstream is only a display
UnitMultiplier), so it matches the handler's per-request seed row.Tests
pytest tests/test_infracost_client.py— 45 passed. Full suite green.The HTTP layer is mocked (as with every descriptor test), so CI validates the
request shape, not live values — the live sync is exercised by the downstream
consumer's cost-model CI, which runs a real Infracost sync and prints a per-node
breakdown.