CloudFront の AWS WAF SDK 自動統合を有効にして、HTML への script タグ挿入と応答の変化を確認してみた

[
  {
    "Name": "BotControlTargeted",
    "Priority": 0,
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesBotControlRuleSet",
        "ManagedRuleGroupConfigs": [
          { "AWSManagedRulesBotControlRuleSet": { "InspectionLevel": "TARGETED" } }
        ]
      }
    },
    "OverrideAction": { "Count": {} },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "BotControlTargeted"
    }
  }
]

AWSTemplateFormatVersion: "2010-09-09"
Description: waf-sdk-verify - fixed-response ALB + CloudFront (verification only, delete after use)
Parameters:
  VpcId: { Type: AWS::EC2::VPC::Id }
  SubnetIds: { Type: List<AWS::EC2::Subnet::Id> }
  WebAclArn: { Type: String }
  CloudFrontPrefixListId: { Type: String }
Resources:
  AlbSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: waf-sdk-verify ALB (HTTP 80 from CloudFront origin-facing only)
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - { IpProtocol: tcp, FromPort: 80, ToPort: 80, SourcePrefixListId: !Ref CloudFrontPrefixListId }
  Alb:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Scheme: internet-facing
      Subnets: !Ref SubnetIds
      SecurityGroups: [!Ref AlbSg]
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - { Effect: Allow, Principal: { Service: lambda.amazonaws.com }, Action: "sts:AssumeRole" }
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  Fn:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.13
      Handler: index.handler
      Role: !GetAtt LambdaRole.Arn
      Code:
        ZipFile: |
          HTML = "<!DOCTYPE html>\n<html>\n<head>\n<title>WAF SDK verify</title>\n</head>\n<body>\n<h1>lambda response</h1>\n</body>\n</html>\n"
          TEXT = "0123456789abcdefghijklmnopqrstuvwxyz\n"

          def resp(status, desc, ctype, body, extra=None):
              h = {"Content-Type": ctype}
              h.update(extra or {})
              return {"statusCode": status, "statusDescription": desc, "headers": h,
                      "body": body, "isBase64Encoded": False}

          def handler(event, context):
              path = event.get("path")
              headers = {k.lower(): v for k, v in (event.get("headers") or {}).items()}
              if path == "/no-transform":
                  return resp(200, "200 OK", "text/html", HTML, {"Cache-Control": "no-transform"})
              if path == "/etag":
                  return resp(200, "200 OK", "text/html", HTML, {"ETag": '"strong-etag-1"'})
              if path == "/range":
                  rng = headers.get("range", "")
                  if rng.startswith("bytes="):
                      s, e = rng[6:].split("-")
                      s = int(s)
                      e = int(e) if e else len(TEXT) - 1
                      return resp(206, "206 Partial Content", "text/plain", TEXT[s:e + 1],
                                  {"Accept-Ranges": "bytes", "Content-Range": "bytes %d-%d/%d" % (s, e, len(TEXT))})
                  return resp(200, "200 OK", "text/plain", TEXT, {"Accept-Ranges": "bytes"})
              return resp(404, "404 Not Found", "text/plain", "not found\n")
  FnTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: FnPermission
    Properties:
      TargetType: lambda
      Targets:
        - Id: !GetAtt Fn.Arn
  FnPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt Fn.Arn
      Principal: elasticloadbalancing.amazonaws.com
  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref Alb
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: fixed-response
          FixedResponseConfig:
            StatusCode: "200"
            ContentType: text/html
            MessageBody: "<!DOCTYPE html>\n<html>\n<head>\n<title>WAF SDK verify</title>\n</head>\n<body>\n<h1>fixed response</h1>\n</body>\n</html>\n"
  RuleJson:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref Listener
      Priority: 10
      Conditions: [{ Field: path-pattern, Values: [/json] }]
      Actions:
        - Type: fixed-response
          FixedResponseConfig: { StatusCode: "200", ContentType: application/json, MessageBody: '{"ok":true}' }
  RuleNoTransform:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref Listener
      Priority: 20
      Conditions: [{ Field: path-pattern, Values: [/no-transform] }]
      Actions: [{ Type: forward, TargetGroupArn: !Ref FnTargetGroup }]
  RuleRange:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref Listener
      Priority: 30
      Conditions: [{ Field: path-pattern, Values: [/range] }]
      Actions: [{ Type: forward, TargetGroupArn: !Ref FnTargetGroup }]
  RuleEtag:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref Listener
      Priority: 40
      Conditions: [{ Field: path-pattern, Values: [/etag] }]
      Actions: [{ Type: forward, TargetGroupArn: !Ref FnTargetGroup }]
  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Comment: waf-sdk-verify (delete after use)
        HttpVersion: http2
        WebACLId: !Ref WebAclArn
        Origins:
          - Id: alb
            DomainName: !GetAtt Alb.DNSName
            CustomOriginConfig: { OriginProtocolPolicy: http-only, HTTPPort: 80 }
        DefaultCacheBehavior:
          TargetOriginId: alb
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods: [GET, HEAD]
          Compress: false
          CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad
          OriginRequestPolicyId: b689b0a8-53d0-40ab-baf2-68738e2966ac
Outputs:
  DomainName: { Value: !GetAtt Distribution.DomainName }
  DistributionId: { Value: !Ref Distribution }
  AlbDns: { Value: !GetAtt Alb.DNSName }