[BUG] Unable to retrieve CloudFront WAF metrics

[thameezb]

Is there an existing issue for this?

• I have searched the existing issues

YACE version

0.55.0

Config file

  apiVersion: v1alpha1
  sts-region: eu-central-1
  static:
    - namespace: AWS/WAFV2
      name: cloudfront_waf_metrics
      regions:
        - us-east-1
      dimensions:
      - name: Rule
        value: ALL
      metrics:
        - name: BlockedRequests
          statistics: [Sum]
          period: 60
          length: 60
        - name: AllowedRequests
          statistics: [Sum]
          period: 60
          length: 60
  discovery:
    jobs:
      - type: AWS/WAFV2
        regions:
          - eu-central-1
          - us-east-1
        period: 300
        length: 300
        metrics:
          - name: BlockedRequests
            statistics: [Sum]
          - name: AllowedRequests
            statistics: [Sum]

Current Behavior

Metrics are found for standard WAF in eu-central-1. However Cloudfront WAF metrics are not available.

When using dynamic config, No tagged resources made it through filtering error log is thrown.
When using static config, 0 metric is returned

Expected Behavior

Cloudfront WAF metrics are scraped as are standard WAF metrics

Steps To Reproduce

• Deploy YACE with the current config file
• Ensure a WAF is created for a CF distribution
• Watch for metrics

Anything else?

I see the metrics in Cloudwatch UI and if I query Cloudwatch from Grafana

[municharan7]

Hi ,
Iam using waf for ALB and below is my config file

apiVersion: v1alpha1
discovery:
jobs:
- type: AWS/WAF
regions: - eu-central-1
period: 300 length: 300
metrics: - name: WebACLCount
statistics: [Sum] - name: RuleCount
statistics: [Sum]
- name: ActiveRuleCount
statistics: [Sum] - name: AllowedRequests
statistics: [Sum]
- name: BlockedRequests
statistics: [Sum]
- name: ByteMatchSetCount
statistics: [Sum] - type: AWS/Shield
regions: - eu-central-1 period: 300 length: 300
metrics:
- name: DDoSDetected
statistics: [Sum]
- name: DDoSAttackBitsPerSecond
statistics: [Sum]
- name: DDoSAttackRequestsPerSecond
statistics: [Sum]
- name: DDoSAttackViolations
statistics: [Sum]

      and getting this error
      {"caller":"main.go:211","level":"info","msg":"Parsing config","ts":"2024-02-01T09:13:00.496456327Z","version":"v0.55.0"}

{"caller":"main.go:68","err":"Couldn't read /tmp/config.yml: Discovery job [0]: Service is not in known list!: AWS/WAF","level":"error","msg":"Error running yace","ts":"2024-02-01T09:13:00.496871671Z","version":"v0.55.0"}

even i tried with changing type to AWS/WAFV2
then error is like no tagged resource

can anyone help me in this

[obrienrobert]

I was also getting the No tagged resources made it through filtering error. According to the WAFV2 docs: You can't manage or view tags through the AWS WAF console.. Tagging the associated web ACL's using the AWS CLI allowed me to retrieve metrics. (v0.55.0)