get_rate_based_statement_managed_keys

get_rate_based_statement_managed_keys(**kwargs)

Retrieves the keys that are currently blocked by a rate-based rule instance. The maximum number of managed keys that can be blocked for a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, those with the highest rates are blocked.

For a rate-based rule that you've defined inside a rule group, provide the name of the rule group reference statement in your request, in addition to the rate-based rule name and the web ACL name.

WAF monitors web requests and manages keys independently for each unique combination of web ACL, optional rule group, and rate-based rule. For example, if you define a rate-based rule inside a rule group, and then use the rule group in a web ACL, WAF monitors web requests and manages keys for that web ACL, rule group reference statement, and rate-based rule instance. If you use the same rule group in a second web ACL, WAF monitors web requests and manages keys for this second usage completely independent of your first.

See also: AWS API Documentation

Request Syntax

response = client.get_rate_based_statement_managed_keys(
    Scope='CLOUDFRONT'|'REGIONAL',
    WebACLName='string',
    WebACLId='string',
    RuleGroupRuleName='string',
    RuleName='string'
)

Parameters

• Scope (string) --

  [REQUIRED]

  Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, a Amazon Cognito user pool, or an App Runner service.

  To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows:

  • CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT --region=us-east-1 .
  • API and SDKs - For all calls, use the Region endpoint us-east-1.
• WebACLName (string) --

  [REQUIRED]

  The name of the web ACL. You cannot change the name of a web ACL after you create it.

• WebACLId (string) --

  [REQUIRED]

  The unique identifier for the web ACL. This ID is returned in the responses to create and list commands. You provide it to operations like update and delete.

• RuleGroupRuleName (string) -- The name of the rule group reference statement in your web ACL. This is required only when you have the rate-based rule nested inside a rule group.
• RuleName (string) --

  [REQUIRED]

  The name of the rate-based rule to get the keys for. If you have the rule defined inside a rule group that you're using in your web ACL, also provide the name of the rule group reference statement in the request parameter RuleGroupRuleName .

Return type

dict

Returns

Response Syntax

{
    'ManagedKeysIPV4': {
        'IPAddressVersion': 'IPV4'|'IPV6',
        'Addresses': [
            'string',
        ]
    },
    'ManagedKeysIPV6': {
        'IPAddressVersion': 'IPV4'|'IPV6',
        'Addresses': [
            'string',
        ]
    }
}

Response Structure

• (dict) --

  • ManagedKeysIPV4 (dict) --

    The keys that are of Internet Protocol version 4 (IPv4).

    • IPAddressVersion (string) --

      The version of the IP addresses, either IPV4 or IPV6 .

    • Addresses (list) --

      The IP addresses that are currently blocked.

      • (string) --

  • ManagedKeysIPV6 (dict) --

    The keys that are of Internet Protocol version 6 (IPv6).

    • IPAddressVersion (string) --

      The version of the IP addresses, either IPV4 or IPV6 .

    • Addresses (list) --

      The IP addresses that are currently blocked.

      • (string) --

Exceptions

• WAFV2.Client.exceptions.WAFInternalErrorException
• WAFV2.Client.exceptions.WAFInvalidParameterException
• WAFV2.Client.exceptions.WAFNonexistentItemException
• WAFV2.Client.exceptions.WAFInvalidOperationException