Chicken-egg scenario when removing WAF resources #7

New issue

Open

opened 2024-06-01 21:23:46 +00:00 by santiagon610 · 0 comments

santiagon610 commented

2024-06-01 21:23:46 +00:00

(Migrated from github.com)

Since the introduction of var.ip_allow_list in v0.2.0, removing the IP allow list to remove the WAF policy leads to the following error:

│ Error: deleting WAFv2 WebACL (UUID REDACTED): WAFAssociatedItemException: AWS WAF couldn’t perform the operation because your resource is being used by another resource or it’s associated with another resource.

Manual workaround:

Disassociate the WebACL from the distribution in the console
Plan/apply

Proposed workaround:

Remove the count feature flag in the WebACL configuration
Default var.ip_allow_list to 0.0.0.0/24

Since the introduction of `var.ip_allow_list` in v0.2.0, removing the IP allow list to remove the WAF policy leads to the following error: ``` │ Error: deleting WAFv2 WebACL (UUID REDACTED): WAFAssociatedItemException: AWS WAF couldn’t perform the operation because your resource is being used by another resource or it’s associated with another resource. ``` Manual workaround: - Disassociate the WebACL from the distribution in the console - Plan/apply Proposed workaround: - Remove the `count` feature flag in the WebACL configuration - Default `var.ip_allow_list` to `0.0.0.0/24`