--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.0 name: webacls.wafv2.aws.crossplane.io spec: group: wafv2.aws.crossplane.io names: categories: - crossplane - managed - aws kind: WebACL listKind: WebACLList plural: webacls singular: webacl scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .status.conditions[?(@.type=='Ready')].status name: READY type: string - jsonPath: .status.conditions[?(@.type=='Synced')].status name: SYNCED type: string - jsonPath: .metadata.annotations.crossplane\.io/external-name name: EXTERNAL-NAME type: string - jsonPath: .metadata.creationTimestamp name: AGE type: date name: v1alpha1 schema: openAPIV3Schema: description: WebACL is the Schema for the WebACLS API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: WebACLSpec defines the desired state of WebACL properties: deletionPolicy: default: Delete description: |- DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. This field is planned to be deprecated in favor of the ManagementPolicies field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 enum: - Orphan - Delete type: string forProvider: description: WebACLParameters defines the desired state of WebACL properties: associatedAWSResources: description: |- A list of the Amazon Resource Name (ARN) of the resources to associate with the web ACL. The association is implemented only for REGIONAL scope yet. The resources will be ignored if the scope is CLOUDFRONT items: properties: resourceARN: type: string type: object type: array associationConfig: description: |- Specifies custom configurations for the associations between the web ACL and protected resources. Use this to customize the maximum size of the request body that your protected CloudFront distributions forward to WAF for inspection. The default is 16 KB (16,384 bytes). You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see WAF Pricing (http://aws.amazon.com/waf/pricing/). properties: requestBody: additionalProperties: properties: defaultSizeInspectionLimit: type: string type: object type: object type: object captchaConfig: description: |- Specifies how WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings. If you don't specify this, WAF uses its default settings for CaptchaConfig. properties: immunityTimeProperty: description: |- Used for CAPTCHA and challenge token settings. Determines how long a CAPTCHA or challenge timestamp remains valid after WAF updates it for a successful CAPTCHA or challenge response. properties: immunityTime: format: int64 type: integer type: object type: object challengeConfig: description: |- Specifies how WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings. If you don't specify this, WAF uses its default settings for ChallengeConfig. properties: immunityTimeProperty: description: |- Used for CAPTCHA and challenge token settings. Determines how long a CAPTCHA or challenge timestamp remains valid after WAF updates it for a successful CAPTCHA or challenge response. properties: immunityTime: format: int64 type: integer type: object type: object customResponseBodies: additionalProperties: properties: content: type: string contentType: type: string type: object description: |- A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the web ACL, and then use them in the rules and default actions that you define in the web ACL. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. For information about the limits on count and size for custom request and response settings, see WAF quotas (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the WAF Developer Guide. type: object defaultAction: description: The action to perform if none of the Rules contained in the WebACL match. properties: allow: description: |- Specifies that WAF should allow the request and optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object block: description: |- Specifies that WAF should block the request and optionally defines additional custom handling for the response to the web request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customResponse: description: |- A custom response to send to the client. You can define a custom response for rule actions and default web ACL actions that are set to BlockAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: customResponseBodyKey: type: string responseCode: format: int64 type: integer responseHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object type: object description: description: A description of the web ACL that helps with identification. type: string region: description: Region is which region the WebACL will be created. type: string regionalResourceTypeAssociation: description: |- Used for regional scoped configuration. Specifies the types of resources which the provider checks while in the reconciliation loop Each type requires additional request to aws api and appropriate permissions Only enableApplicationLoadBalancer is enabled by default properties: enableApiGateway: type: boolean enableApplicationLoadBalancer: type: boolean enableAppsync: type: boolean enableCognitoUserPool: type: boolean enableVerifiedAccessInstance: type: boolean enabledAppRunnerService: type: boolean type: object rules: description: |- The Rule statements used to identify the web requests that you want to manage. Each rule includes one top-level statement that WAF uses to identify matching web requests, and parameters that govern how WAF handles them. items: properties: action: description: |- The action that WAF should take on a web request when it matches a rule's statement. Settings at the web ACL level can override the rule action setting. properties: allow: description: |- Specifies that WAF should allow the request and optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object block: description: |- Specifies that WAF should block the request and optionally defines additional custom handling for the response to the web request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customResponse: description: |- A custom response to send to the client. You can define a custom response for rule actions and default web ACL actions that are set to BlockAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: customResponseBodyKey: type: string responseCode: format: int64 type: integer responseHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object captcha: description: |- Specifies that WAF should run a CAPTCHA check against the request: * If the request includes a valid, unexpired CAPTCHA token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF generates a response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of captcha. The HTTP status code 405 Method Not Allowed. If the request contains an Accept header with a value of text/html, the response includes a CAPTCHA JavaScript page interstitial. You can configure the expiration time in the CaptchaConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object challenge: description: |- Specifies that WAF should run a Challenge check against the request to verify that the request is coming from a legitimate client session: * If the request includes a valid, unexpired challenge token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired challenge token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF then generates a challenge response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of challenge. The HTTP status code 202 Request Accepted. If the request contains an Accept header with a value of text/html, the response includes a JavaScript page interstitial with a challenge script. Challenges run silent browser interrogations in the background, and don't generally affect the end user experience. A challenge enforces token acquisition using an interstitial JavaScript challenge that inspects the client session for legitimate behavior. The challenge blocks bots or at least increases the cost of operating sophisticated bots. After the client session successfully responds to the challenge, it receives a new token from WAF, which the challenge script uses to resubmit the original request. You can configure the expiration time in the ChallengeConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object count: description: |- Specifies that WAF should count the request. Optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object type: object captchaConfig: description: |- Specifies how WAF should handle CAPTCHA evaluations. This is available at the web ACL level and in each rule. properties: immunityTimeProperty: description: |- Used for CAPTCHA and challenge token settings. Determines how long a CAPTCHA or challenge timestamp remains valid after WAF updates it for a successful CAPTCHA or challenge response. properties: immunityTime: format: int64 type: integer type: object type: object challengeConfig: description: |- Specifies how WAF should handle Challenge evaluations. This is available at the web ACL level and in each rule. properties: immunityTimeProperty: description: |- Used for CAPTCHA and challenge token settings. Determines how long a CAPTCHA or challenge timestamp remains valid after WAF updates it for a successful CAPTCHA or challenge response. properties: immunityTime: format: int64 type: integer type: object type: object name: type: string overrideAction: description: |- The action to use in the place of the action that results from the rule group evaluation. Set the override action to none to leave the result of the rule group alone. Set it to count to override the result to count only. You can only use this for rule statements that reference a rule group, like RuleGroupReferenceStatement and ManagedRuleGroupStatement. This option is usually set to none. It does not affect how the rules in the rule group are evaluated. If you want the rules in the rule group to only count matches, do not use this and instead use the rule action override option, with Count action, in your rule group reference statement settings. properties: count: description: |- Specifies that WAF should count the request. Optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object none: additionalProperties: type: string description: |- Specifies that WAF should do nothing. This is used for the OverrideAction setting on a Rule when the rule uses a rule group reference statement. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. JSON specification: "None": {} type: object type: object priority: format: int64 type: integer ruleLabels: items: properties: name: type: string type: object type: array statement: description: |- The processing guidance for a Rule, used by WAF to determine whether a web request matches the rule. For example specifications, see the examples section of CreateWebACL. properties: andStatement: description: |- A logical rule statement used to combine other rule statements with AND logic. You provide more than one Statement within the AndStatement as json string. type: string byteMatchStatement: description: |- A rule statement that defines a string match search for WAF to apply to web requests. The byte match statement provides the bytes to search for, the location in requests that you want WAF to search, and other settings. The bytes to search for are typically a string that corresponds with ASCII characters. In the WAF console and the developer guide, this is called a string match statement. properties: fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object positionalConstraint: type: string searchString: description: |- A string value that you want WAF to search for. WAF searches only in the part of web requests that you designate for inspection in FieldToMatch. The maximum length of the value is 200 bytes. type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object geoMatchStatement: description: |- A rule statement that labels web requests by country and region and that matches against web requests based on country code. A geo match rule labels every request that it inspects regardless of whether it finds a match. * To manage requests only by country, you can use this statement by itself and specify the countries that you want to match against in the CountryCodes array. * Otherwise, configure your geo match rule with Count action so that it only labels requests. Then, add one or more label match rules to run after the geo match rule and configure them to match against the geographic labels and handle the requests as needed. WAF labels requests using the alpha-2 country and region codes from the International Organization for Standardization (ISO) 3166 standard. WAF determines the codes using either the IP address in the web request origin or, if you specify it, the address in the geo match ForwardedIPConfig. If you use the web request origin, the label formats are awswaf:clientip:geo:region:- and awswaf:clientip:geo:country:. If you use a forwarded IP address, the label formats are awswaf:forwardedip:geo:region:- and awswaf:forwardedip:geo:country:. For additional details, see Geographic match rule statement (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-geo-match.html) in the WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). properties: countryCodes: items: type: string type: array forwardedIPConfig: description: |- The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all. This configuration is used for GeoMatchStatement and RateBasedStatement. For IPSetReferenceStatement, use IPSetForwardedIPConfig instead. WAF only evaluates the first IP address found in the specified HTTP header. properties: fallbackBehavior: type: string headerName: type: string type: object type: object ipSetReferenceStatement: description: |- A rule statement used to detect web requests coming from particular IP addresses or address ranges. To use this, create an IPSet that specifies the addresses you want to detect, then use the ARN of that set in this statement. To create an IP set, see CreateIPSet. Each IP set rule statement references an IP set. You create and maintain the set independent of your rules. This allows you to use the single set in multiple rules. When you update the referenced set, WAF automatically updates all rules that reference it. properties: arn: type: string ipSetForwardedIPConfig: description: |- The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all. This configuration is used only for IPSetReferenceStatement. For GeoMatchStatement and RateBasedStatement, use ForwardedIPConfig instead. properties: fallbackBehavior: type: string headerName: type: string position: type: string type: object type: object labelMatchStatement: description: |- A rule statement to match against labels that have been added to the web request by rules that have already run in the web ACL. The label match statement provides the label or namespace string to search for. The label string can represent a part or all of the fully qualified label name that had been added to the web request. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label. If you do not provide the fully qualified name in your label match string, WAF performs the search for labels that were added in the same context as the label match statement. properties: key: type: string scope: type: string type: object managedRuleGroupStatement: description: |- A rule statement used to run the rules that are defined in a managed rule group. To use this, provide the vendor name and the name of the rule group in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups. You cannot nest a ManagedRuleGroupStatement, for example for use inside a NotStatement or OrStatement. You cannot use a managed rule group inside another rule group. You can only reference a managed rule group as a top-level statement within a rule that you define in a web ACL. You are charged additional fees when you use the WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet, the WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet, or the WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet. For more information, see WAF Pricing (http://aws.amazon.com/waf/pricing/). properties: excludedRules: items: properties: name: type: string type: object type: array managedRuleGroupConfigs: items: properties: awsManagedRulesACFPRuleSet: description: |- Details for your use of the account creation fraud prevention managed rule group, AWSManagedRulesACFPRuleSet. This configuration is used in ManagedRuleGroupConfig. properties: creationPath: type: string enableRegexInPath: type: boolean registrationPagePath: type: string requestInspection: description: |- The criteria for inspecting account creation requests, used by the ACFP rule group to validate and track account creation attempts. This is part of the AWSManagedRulesACFPRuleSet configuration in ManagedRuleGroupConfig. In these settings, you specify how your application accepts account creation attempts by providing the request payload type and the names of the fields within the request body where the username, password, email, and primary address and phone number fields are provided. properties: addressFields: items: properties: identifier: type: string type: object type: array emailField: description: |- The name of the field in the request payload that contains your customer's email. This data type is used in the RequestInspectionACFP data type. properties: identifier: type: string type: object passwordField: description: |- The name of the field in the request payload that contains your customer's password. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object payloadType: type: string phoneNumberFields: items: properties: identifier: type: string type: object type: array usernameField: description: |- The name of the field in the request payload that contains your customer's username. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object type: object responseInspection: description: |- The criteria for inspecting responses to login requests and account creation requests, used by the ATP and ACFP rule groups to track login and account creation success and failure rates. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. The rule groups evaluates the responses that your protected resources send back to client login and account creation attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels and mitigates requests from client sessions and IP addresses with too much suspicious activity in a short amount of time. This is part of the AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet configurations in ManagedRuleGroupConfig. Enable response inspection by configuring exactly one component of the response to inspect, for example, Header or StatusCode. You can't configure more than one component for inspection. If you don't configure any of the response inspection options, response inspection is disabled. properties: bodyContains: description: |- Configures inspection of the response body. WAF can inspect the first 65,536 bytes (64 KB) of the response body. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureStrings: items: type: string type: array successStrings: items: type: string type: array type: object header: description: |- Configures inspection of the response header. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureValues: items: type: string type: array name: type: string successValues: items: type: string type: array type: object json: description: |- Configures inspection of the response JSON. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureValues: items: type: string type: array identifier: type: string successValues: items: type: string type: array type: object statusCode: description: |- Configures inspection of the response status code. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureCodes: items: format: int64 type: integer type: array successCodes: items: format: int64 type: integer type: array type: object type: object type: object awsManagedRulesATPRuleSet: description: |- Details for your use of the account takeover prevention managed rule group, AWSManagedRulesATPRuleSet. This configuration is used in ManagedRuleGroupConfig. properties: enableRegexInPath: type: boolean loginPath: type: string requestInspection: description: |- The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. This is part of the AWSManagedRulesATPRuleSet configuration in ManagedRuleGroupConfig. In these settings, you specify how your application accepts login attempts by providing the request payload type and the names of the fields within the request body where the username and password are provided. properties: passwordField: description: |- The name of the field in the request payload that contains your customer's password. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object payloadType: type: string usernameField: description: |- The name of the field in the request payload that contains your customer's username. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object type: object responseInspection: description: |- The criteria for inspecting responses to login requests and account creation requests, used by the ATP and ACFP rule groups to track login and account creation success and failure rates. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. The rule groups evaluates the responses that your protected resources send back to client login and account creation attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels and mitigates requests from client sessions and IP addresses with too much suspicious activity in a short amount of time. This is part of the AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet configurations in ManagedRuleGroupConfig. Enable response inspection by configuring exactly one component of the response to inspect, for example, Header or StatusCode. You can't configure more than one component for inspection. If you don't configure any of the response inspection options, response inspection is disabled. properties: bodyContains: description: |- Configures inspection of the response body. WAF can inspect the first 65,536 bytes (64 KB) of the response body. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureStrings: items: type: string type: array successStrings: items: type: string type: array type: object header: description: |- Configures inspection of the response header. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureValues: items: type: string type: array name: type: string successValues: items: type: string type: array type: object json: description: |- Configures inspection of the response JSON. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureValues: items: type: string type: array identifier: type: string successValues: items: type: string type: array type: object statusCode: description: |- Configures inspection of the response status code. This is part of the ResponseInspection configuration for AWSManagedRulesATPRuleSet and AWSManagedRulesACFPRuleSet. Response inspection is available only in web ACLs that protect Amazon CloudFront distributions. properties: failureCodes: items: format: int64 type: integer type: array successCodes: items: format: int64 type: integer type: array type: object type: object type: object awsManagedRulesBotControlRuleSet: description: |- Details for your use of the Bot Control managed rule group, AWSManagedRulesBotControlRuleSet. This configuration is used in ManagedRuleGroupConfig. properties: enableMachineLearning: type: boolean inspectionLevel: type: string type: object loginPath: type: string passwordField: description: |- The name of the field in the request payload that contains your customer's password. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object payloadType: type: string usernameField: description: |- The name of the field in the request payload that contains your customer's username. This data type is used in the RequestInspection and RequestInspectionACFP data types. properties: identifier: type: string type: object type: object type: array name: type: string ruleActionOverrides: items: properties: actionToUse: description: |- The action that WAF should take on a web request when it matches a rule's statement. Settings at the web ACL level can override the rule action setting. properties: allow: description: |- Specifies that WAF should allow the request and optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object block: description: |- Specifies that WAF should block the request and optionally defines additional custom handling for the response to the web request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customResponse: description: |- A custom response to send to the client. You can define a custom response for rule actions and default web ACL actions that are set to BlockAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: customResponseBodyKey: type: string responseCode: format: int64 type: integer responseHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object captcha: description: |- Specifies that WAF should run a CAPTCHA check against the request: * If the request includes a valid, unexpired CAPTCHA token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF generates a response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of captcha. The HTTP status code 405 Method Not Allowed. If the request contains an Accept header with a value of text/html, the response includes a CAPTCHA JavaScript page interstitial. You can configure the expiration time in the CaptchaConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object challenge: description: |- Specifies that WAF should run a Challenge check against the request to verify that the request is coming from a legitimate client session: * If the request includes a valid, unexpired challenge token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired challenge token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF then generates a challenge response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of challenge. The HTTP status code 202 Request Accepted. If the request contains an Accept header with a value of text/html, the response includes a JavaScript page interstitial with a challenge script. Challenges run silent browser interrogations in the background, and don't generally affect the end user experience. A challenge enforces token acquisition using an interstitial JavaScript challenge that inspects the client session for legitimate behavior. The challenge blocks bots or at least increases the cost of operating sophisticated bots. After the client session successfully responds to the challenge, it receives a new token from WAF, which the challenge script uses to resubmit the original request. You can configure the expiration time in the ChallengeConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object count: description: |- Specifies that WAF should count the request. Optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object type: object name: type: string type: object type: array scopeDownStatement: type: string vendorName: type: string version: type: string type: object notStatement: description: |- A logical rule statement used to negate the results of another rule statement. You provide one Statement within the NotStatement as json string type: string orStatement: description: |- A logical rule statement used to combine other rule statements with OR logic. You provide more than one Statement within the OrStatement as json string type: string rateBasedStatement: description: |- A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. The rule categorizes requests according to your aggregation criteria, collects them into aggregation instances, and counts and rate limits the requests for each instance. You can specify individual aggregation keys, like IP address or HTTP method. You can also specify aggregation key combinations, like IP address and HTTP method, or HTTP method, query argument, and cookie. Each unique set of values for the aggregation keys that you specify is a separate aggregation instance, with the value from each key contributing to the aggregation instance definition. For example, assume the rule evaluates web requests with the following IP address and HTTP method values: * IP address 10.1.1.1, HTTP method POST * IP address 10.1.1.1, HTTP method GET * IP address 127.0.0.0, HTTP method POST * IP address 10.1.1.1, HTTP method GET The rule would create different aggregation instances according to your aggregation criteria, for example: * If the aggregation criteria is just the IP address, then each individual address is an aggregation instance, and WAF counts requests separately for each. The aggregation instances and request counts for our example would be the following: IP address 10.1.1.1: count 3 IP address 127.0.0.0: count 1 * If the aggregation criteria is HTTP method, then each individual HTTP method is an aggregation instance. The aggregation instances and request counts for our example would be the following: HTTP method POST: count 2 HTTP method GET: count 2 * If the aggregation criteria is IP address and HTTP method, then each IP address and each HTTP method would contribute to the combined aggregation instance. The aggregation instances and request counts for our example would be the following: IP address 10.1.1.1, HTTP method POST: count 1 IP address 10.1.1.1, HTTP method GET: count 2 IP address 127.0.0.0, HTTP method POST: count 1 For any n-tuple of aggregation keys, each unique combination of values for the keys defines a separate aggregation instance, which WAF counts and rate-limits individually. You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts and rate limits requests that match the nested statement. You can use this nested scope-down statement in conjunction with your aggregation key specifications or you can just count and rate limit all requests that match the scope-down statement, without additional aggregation. When you choose to just manage all requests that match a scope-down statement, the aggregation instance is singular for the rule. You cannot nest a RateBasedStatement inside another statement, for example inside a NotStatement or OrStatement. You can define a RateBasedStatement inside a web ACL and inside a rule group. For additional information about the options, see Rate limiting web requests using rate-based rules (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rate-based-rules.html) in the WAF Developer Guide. If you only aggregate on the individual IP address or forwarded IP address, you can retrieve the list of IP addresses that WAF is currently rate limiting for a rule through the API call GetRateBasedStatementManagedKeys. This option is not available for other aggregation configurations. WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by WAF. properties: aggregateKeyType: type: string customKeys: items: properties: cookie: description: |- Specifies a cookie as an aggregate key for a rate-based rule. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance. properties: name: type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object forwardedIP: additionalProperties: type: string description: |- Specifies the first IP address in an HTTP header as an aggregate key for a rate-based rule. Each distinct forwarded IP address contributes to the aggregation instance. This setting is used only in the RateBasedStatementCustomKey specification of a rate-based rule statement. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying FORWARDED_IP in your rate-based statement's AggregateKeyType. This data type supports using the forwarded IP address in the web request aggregation for a rate-based rule, in RateBasedStatementCustomKey. The JSON specification for using the forwarded IP address doesn't explicitly use this data type. JSON specification: "ForwardedIP": {} When you use this specification, you must also configure the forwarded IP address in the rate-based statement's ForwardedIPConfig. type: object header: description: |- Specifies a header as an aggregate key for a rate-based rule. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance. properties: name: type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object httpMethod: additionalProperties: type: string description: |- Specifies the request's HTTP method as an aggregate key for a rate-based rule. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance. JSON specification: "RateLimitHTTPMethod": {} type: object iP: additionalProperties: type: string description: |- Specifies the IP address in the web request as an aggregate key for a rate-based rule. Each distinct IP address contributes to the aggregation instance. This setting is used only in the RateBasedStatementCustomKey specification of a rate-based rule statement. To use this in the custom key settings, you must specify at least one other key to use, along with the IP address. To aggregate on only the IP address, in your rate-based statement's AggregateKeyType, specify IP. JSON specification: "RateLimitIP": {} type: object labelNamespace: description: |- Specifies a label namespace to use as an aggregate key for a rate-based rule. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see Label syntax and naming requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) in the WAF Developer Guide. properties: namespace: type: string type: object queryArgument: description: |- Specifies a query argument in the request as an aggregate key for a rate-based rule. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance. properties: name: type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object queryString: description: |- Specifies the request's query string as an aggregate key for a rate-based rule. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance. properties: textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object uriPath: description: |- Specifies the request's URI path as an aggregate key for a rate-based rule. Each distinct URI path contributes to the aggregation instance. If you use just the URI path as your custom key, then each URI path fully defines an aggregation instance. properties: textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object type: object type: array forwardedIPConfig: description: |- The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name. If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all. This configuration is used for GeoMatchStatement and RateBasedStatement. For IPSetReferenceStatement, use IPSetForwardedIPConfig instead. WAF only evaluates the first IP address found in the specified HTTP header. properties: fallbackBehavior: type: string headerName: type: string type: object limit: format: int64 type: integer scopeDownStatement: type: string type: object regexMatchStatement: description: |- A rule statement used to search web request components for a match against a single regular expression. properties: fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object regexString: type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object regexPatternSetReferenceStatement: description: |- A rule statement used to search web request components for matches with regular expressions. To use this, create a RegexPatternSet that specifies the expressions that you want to detect, then use the ARN of that set in this statement. A web request matches the pattern set rule statement if the request component matches any of the patterns in the set. To create a regex pattern set, see CreateRegexPatternSet. Each regex pattern set rule statement references a regex pattern set. You create and maintain the set independent of your rules. This allows you to use the single set in multiple rules. When you update the referenced set, WAF automatically updates all rules that reference it. properties: arn: type: string fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object ruleGroupReferenceStatement: description: |- A rule statement used to run the rules that are defined in a RuleGroup. To use this, create a rule group with your rules, then provide the ARN of the rule group in this statement. You cannot nest a RuleGroupReferenceStatement, for example for use inside a NotStatement or OrStatement. You cannot use a rule group reference statement inside another rule group. You can only reference a rule group as a top-level statement within a rule that you define in a web ACL. properties: arn: type: string excludedRules: items: properties: name: type: string type: object type: array ruleActionOverrides: items: properties: actionToUse: description: |- The action that WAF should take on a web request when it matches a rule's statement. Settings at the web ACL level can override the rule action setting. properties: allow: description: |- Specifies that WAF should allow the request and optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object block: description: |- Specifies that WAF should block the request and optionally defines additional custom handling for the response to the web request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customResponse: description: |- A custom response to send to the client. You can define a custom response for rule actions and default web ACL actions that are set to BlockAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: customResponseBodyKey: type: string responseCode: format: int64 type: integer responseHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object captcha: description: |- Specifies that WAF should run a CAPTCHA check against the request: * If the request includes a valid, unexpired CAPTCHA token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF generates a response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of captcha. The HTTP status code 405 Method Not Allowed. If the request contains an Accept header with a value of text/html, the response includes a CAPTCHA JavaScript page interstitial. You can configure the expiration time in the CaptchaConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object challenge: description: |- Specifies that WAF should run a Challenge check against the request to verify that the request is coming from a legitimate client session: * If the request includes a valid, unexpired challenge token, WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction. * If the request doesn't include a valid, unexpired challenge token, WAF discontinues the web ACL evaluation of the request and blocks it from going to its intended destination. WAF then generates a challenge response that it sends back to the client, which includes the following: The header x-amzn-waf-action with a value of challenge. The HTTP status code 202 Request Accepted. If the request contains an Accept header with a value of text/html, the response includes a JavaScript page interstitial with a challenge script. Challenges run silent browser interrogations in the background, and don't generally affect the end user experience. A challenge enforces token acquisition using an interstitial JavaScript challenge that inspects the client session for legitimate behavior. The challenge blocks bots or at least increases the cost of operating sophisticated bots. After the client session successfully responds to the challenge, it receives a new token from WAF, which the challenge script uses to resubmit the original request. You can configure the expiration time in the ChallengeConfig ImmunityTimeProperty setting at the rule and web ACL level. The rule setting overrides the web ACL setting. This action option is available for rules. It isn't available for web ACL default actions. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object count: description: |- Specifies that WAF should count the request. Optionally defines additional custom handling for the request. This is used in the context of other settings, for example to specify values for RuleAction and web ACL DefaultAction. properties: customRequestHandling: description: |- Custom request handling behavior that inserts custom headers into a web request. You can add custom request handling for WAF to use when the rule action doesn't block the request. For example, CaptchaAction for requests with valid t okens, and AllowAction. For information about customizing web requests and responses, see Customizing web requests and responses in WAF (https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. properties: insertHeaders: items: properties: name: type: string value: type: string type: object type: array type: object type: object type: object name: type: string type: object type: array type: object sizeConstraintStatement: description: |- A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). For example, you can use a size constraint statement to look for query strings that are longer than 100 bytes. If you configure WAF to inspect the request body, WAF inspects only the number of bytes of the body up to the limit for the web ACL. By default, for regional web ACLs, this limit is 8 KB (8,192 bytes) and for CloudFront web ACLs, this limit is 16 KB (16,384 bytes). For CloudFront web ACLs, you can increase the limit in the web ACL AssociationConfig, for additional fees. If you know that the request body for your web requests should never exceed the inspection limit, you could use a size constraint statement to block requests that have a larger request body size. If you choose URI for the value of Part of the request to filter on, the slash (/) in the URI counts as one character. For example, the URI /logo.jpg is nine characters long. properties: comparisonOperator: type: string fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object size: format: int64 type: integer textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object sqliMatchStatement: description: |- A rule statement that inspects for malicious SQL code. Attackers insert malicious SQL code into web requests to do things like modify your database or extract data from it. properties: fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object sensitivityLevel: type: string textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object xssMatchStatement: description: |- A rule statement that inspects for cross-site scripting (XSS) attacks. In XSS attacks, the attacker uses vulnerabilities in a benign website as a vehicle to inject malicious client-site scripts into other legitimate web browsers. properties: fieldToMatch: description: |- The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component. Example JSON for a QueryString field to match: "FieldToMatch": { "QueryString": {} } Example JSON for a Method field to match specification: "FieldToMatch": { "Method": { "Name": "DELETE" } } properties: allQueryArguments: additionalProperties: type: string description: |- Inspect all query arguments of the web request. This is used in the FieldToMatch specification for some web request component types. JSON specification: "AllQueryArguments": {} type: object body: description: |- Inspect the body of the web request. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. properties: oversizeHandling: type: string type: object cookies: description: |- Inspect the cookies in the web request. You can specify the parts of the cookies to inspect and you can narrow the set of cookies to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "Cookies": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedCookies: items: type: string type: array includedCookies: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object headerOrder: description: |- Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. properties: oversizeHandling: type: string type: object headers: description: |- Inspect all headers in the web request. You can specify the parts of the headers to inspect and you can narrow the set of headers to inspect by including or excluding specific keys. This is used to indicate the web request component to inspect, in the FieldToMatch specification. If you want to inspect just the value of a single header, use the SingleHeader FieldToMatch setting instead. Example JSON: "Headers": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" } properties: matchPattern: description: |- The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object excludedHeaders: items: type: string type: array includedHeaders: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object ja3Fingerprint: description: |- Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields (https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. properties: fallbackBehavior: type: string type: object jsonBody: description: |- Inspect the body of the web request as JSON. The body immediately follows the request headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Use the specifications in this object to indicate which parts of the JSON body to inspect using the rule's inspection criteria. WAF inspects only the parts of the JSON that result from the matches that you indicate. Example JSON: "JsonBody": { "MatchPattern": { "All": {} }, "MatchScope": "ALL" } properties: invalidFallbackBehavior: type: string matchPattern: description: |- The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. This is used with the FieldToMatch option JsonBody. properties: all: additionalProperties: type: string description: |- Inspect all of the elements that WAF has parsed and extracted from the web request component that you've identified in your FieldToMatch specifications. This is used in the FieldToMatch specification for some web request component types. JSON specification: "All": {} type: object includedPaths: items: type: string type: array type: object matchScope: type: string oversizeHandling: type: string type: object method: additionalProperties: type: string description: |- Inspect the HTTP method of the web request. The method indicates the type of operation that the request is asking the origin to perform. This is used in the FieldToMatch specification for some web request component types. JSON specification: "Method": {} type: object queryString: additionalProperties: type: string description: |- Inspect the query string of the web request. This is the part of a URL that appears after a ? character, if any. This is used in the FieldToMatch specification for some web request component types. JSON specification: "QueryString": {} type: object singleHeader: description: |- Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer. The name isn't case sensitive. You can filter and inspect all headers with the FieldToMatch setting Headers. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleHeader": { "Name": "haystack" } properties: name: type: string type: object singleQueryArgument: description: |- Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion. The name isn't case sensitive. This is used to indicate the web request component to inspect, in the FieldToMatch specification. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } properties: name: type: string type: object uriPath: additionalProperties: type: string description: |- Inspect the path component of the URI of the web request. This is the part of the web request that identifies a resource. For example, /images/daily-ad.jpg. This is used in the FieldToMatch specification for some web request component types. JSON specification: "UriPath": {} type: object type: object textTransformations: items: properties: priority: format: int64 type: integer type_: type: string type: object type: array type: object type: object visibilityConfig: description: Defines and enables Amazon CloudWatch metrics and web request sample collection. properties: cloudWatchMetricsEnabled: type: boolean metricName: type: string sampledRequestsEnabled: type: boolean type: object type: object type: array scope: description: |- Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: * CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT --region=us-east-1. * API and SDKs - For all calls, use the Region endpoint us-east-1. type: string tags: description: An array of key:value pairs to associate with the resource. items: properties: key: type: string value: type: string type: object type: array tokenDomains: description: |- Specifies the domains that WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When WAF provides a token, it uses the domain of the Amazon Web Services resource that the web ACL is protecting. If you don't specify a list of token domains, WAF accepts tokens only for the domain of the protected resource. With a token domain list, WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains. Example JSON: "TokenDomains": { "mywebsite.com", "myotherwebsite.com" } Public suffixes aren't allowed. For example, you can't use usa.gov or co.uk as token domains. items: type: string type: array visibilityConfig: description: Defines and enables Amazon CloudWatch metrics and web request sample collection. properties: cloudWatchMetricsEnabled: type: boolean metricName: type: string sampledRequestsEnabled: type: boolean type: object required: - defaultAction - region - scope - visibilityConfig type: object managementPolicies: default: - '*' description: |- THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md items: description: |- A ManagementAction represents an action that the Crossplane controllers can take on an external resource. enum: - Observe - Create - Update - Delete - LateInitialize - '*' type: string type: array providerConfigRef: default: name: default description: |- ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object publishConnectionDetailsTo: description: |- PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. properties: configRef: default: name: default description: |- SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object metadata: description: Metadata is the metadata for connection secret. properties: annotations: additionalProperties: type: string description: |- Annotations are the annotations to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.annotations". - It is up to Secret Store implementation for others store types. type: object labels: additionalProperties: type: string description: |- Labels are the labels/tags to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.labels". - It is up to Secret Store implementation for others store types. type: object type: description: |- Type is the SecretType for the connection secret. - Only valid for Kubernetes Secret Stores. type: string type: object name: description: Name is the name of the connection secret. type: string required: - name type: object writeConnectionSecretToRef: description: |- WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other. properties: name: description: Name of the secret. type: string namespace: description: Namespace of the secret. type: string required: - name - namespace type: object required: - forProvider type: object status: description: WebACLStatus defines the observed state of WebACL. properties: atProvider: description: WebACLObservation defines the observed state of WebACL properties: arn: description: The Amazon Resource Name (ARN) of the entity. type: string id: description: |- The unique identifier for the web ACL. This ID is returned in the responses to create and list commands. You provide it to operations like update and delete. type: string lockToken: description: |- A token used for optimistic locking. WAF returns a token to your get and list requests, to mark the state of the entity at the time of the request. To make changes to the entity associated with the token, you provide the token to operations like update and delete. WAF uses the token to ensure that no changes have been made to the entity since you last retrieved it. If a change has been made, the update fails with a WAFOptimisticLockException. If this happens, perform another get, and use the new token returned by that operation. type: string name: description: |- The name of the web ACL. You cannot change the name of a web ACL after you create it. type: string type: object conditions: description: Conditions of the resource. items: description: A Condition that may apply to a resource. properties: lastTransitionTime: description: |- LastTransitionTime is the last time this condition transitioned from one status to another. format: date-time type: string message: description: |- A Message containing details about this condition's last transition from one status to another, if any. type: string observedGeneration: description: |- ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 type: integer reason: description: A Reason for this condition's last transition from one status to another. type: string status: description: Status of this condition; is it currently True, False, or Unknown? type: string type: description: |- Type of this condition. At most one of each condition type may apply to a resource at any point in time. type: string required: - lastTransitionTime - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map observedGeneration: description: |- ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention. format: int64 type: integer type: object required: - spec type: object served: true storage: true subresources: status: {}