feat: add optional web acl configuration for cloudfront (#396)

### Issue

[GSD-3535 Ensure CloudFront distributions have WAF enabled
](NASA-IMPACT/veda-architecture#448)
### What?

- Added env var and construct changes to incorporate optional web acl

### Why?

- security requirement

### Testing?

- tested using mcp-test and checked that setting
`VEDA_SHARED_WEB_ACL_ID` works as expected and omitting
`VEDA_SHARED_WEB_ACL_ID` does not enable firewall to cloudfront

.example.env

@@ -33,3 +33,4 @@ CERT_ARN=
 VEDA_CLOUDFRONT=
 VEDA_CLOUDFRONT_OAC=[OPTIONAL, CONFIGURES ORIGIN ACCESS CONTROL, DEFAULTS TO TRUE]
 VEDA_CUSTOM_HOST=
+VEDA_SHARED_WEB_ACL_ID=[OPTIONAL ID ARN for WEB ACL]

routes/infrastructure/config.py

@@ -44,6 +44,10 @@ class vedaRouteSettings(BaseSettings):
         description="Certificate’s ARN",
     )
 
+    shared_web_acl_id: Optional[str] = Field(
+        None, description="Shared Web ACL ID ARN for CloudFront Distribution"
+    )
+
     class Config:
         """model config"""
 

routes/infrastructure/construct.py

@@ -72,6 +72,7 @@ def __init__(
                     certificate=domain_cert,
                     default_root_object="index.html",
                     enable_logging=True,
+                    web_acl_id=veda_route_settings.shared_web_acl_id,
                     domain_names=[
                         f"{stage}.{veda_route_settings.domain_hosted_zone_name}"
                     ]