WAFV2 / Client / put_logging_configuration

put_logging_configuration#

WAFV2.Client.put_logging_configuration(**kwargs)#

Enables the specified LoggingConfiguration, to start logging from a web ACL, according to the configuration provided.

Note

This operation completely replaces any mutable specifications that you already have for a logging configuration with the ones that you provide to this call.

To modify an existing logging configuration, do the following:

  • Retrieve it by calling GetLoggingConfiguration

  • Update its settings as needed

  • Provide the complete logging configuration specification to this call

Note

You can define one logging destination per web ACL.

You can access information about the traffic that WAF inspects using the following steps:

  • Create your logging destination. You can use an Amazon CloudWatch Logs log group, an Amazon Simple Storage Service (Amazon S3) bucket, or an Amazon Kinesis Data Firehose. The name that you give the destination must start with aws-waf-logs-. Depending on the type of destination, you might need to configure additional settings or permissions. For configuration requirements and pricing information for each destination type, see Logging web ACL traffic in the WAF Developer Guide.

  • Associate your logging destination to your web ACL using a PutLoggingConfiguration request.

When you successfully enable logging using a PutLoggingConfiguration request, WAF creates an additional role or policy that is required to write logs to the logging destination. For an Amazon CloudWatch Logs log group, WAF creates a resource policy on the log group. For an Amazon S3 bucket, WAF creates a bucket policy. For an Amazon Kinesis Data Firehose, WAF creates a service-linked role.

For additional information about web ACL logging, see Logging web ACL traffic information in the WAF Developer Guide.

See also: AWS API Documentation

Request Syntax

response = client.put_logging_configuration(
    LoggingConfiguration={
        'ResourceArn': 'string',
        'LogDestinationConfigs': [
            'string',
        ],
        'RedactedFields': [
            {
                'SingleHeader': {
                    'Name': 'string'
                },
                'SingleQueryArgument': {
                    'Name': 'string'
                },
                'AllQueryArguments': {}
                ,
                'UriPath': {}
                ,
                'QueryString': {}
                ,
                'Body': {
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Method': {}
                ,
                'JsonBody': {
                    'MatchPattern': {
                        'All': {}
                        ,
                        'IncludedPaths': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'InvalidFallbackBehavior': 'MATCH'|'NO_MATCH'|'EVALUATE_AS_STRING',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Headers': {
                    'MatchPattern': {
                        'All': {}
                        ,
                        'IncludedHeaders': [
                            'string',
                        ],
                        'ExcludedHeaders': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Cookies': {
                    'MatchPattern': {
                        'All': {}
                        ,
                        'IncludedCookies': [
                            'string',
                        ],
                        'ExcludedCookies': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'HeaderOrder': {
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'JA3Fingerprint': {
                    'FallbackBehavior': 'MATCH'|'NO_MATCH'
                }
            },
        ],
        'ManagedByFirewallManager': True|False,
        'LoggingFilter': {
            'Filters': [
                {
                    'Behavior': 'KEEP'|'DROP',
                    'Requirement': 'MEETS_ALL'|'MEETS_ANY',
                    'Conditions': [
                        {
                            'ActionCondition': {
                                'Action': 'ALLOW'|'BLOCK'|'COUNT'|'CAPTCHA'|'CHALLENGE'|'EXCLUDED_AS_COUNT'
                            },
                            'LabelNameCondition': {
                                'LabelName': 'string'
                            }
                        },
                    ]
                },
            ],
            'DefaultBehavior': 'KEEP'|'DROP'
        }
    }
)
Parameters:

LoggingConfiguration (dict) –

[REQUIRED]

  • ResourceArn (string) – [REQUIRED]

    The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs.

  • LogDestinationConfigs (list) – [REQUIRED]

    The logging destination configuration that you want to associate with the web ACL.

    Note

    You can associate one logging destination to a web ACL.

    • (string) –

  • RedactedFields (list) –

    The parts of the request that you want to keep out of the logs.

    For example, if you redact the SingleHeader field, the HEADER field in the logs will be REDACTED for all rules that use the SingleHeader FieldToMatch setting.

    Redaction applies only to the component that’s specified in the rule’s FieldToMatch setting, so the SingleHeader redaction doesn’t apply to rules that use the Headers FieldToMatch.

    Note

    You can specify only the following fields for redaction: UriPath, QueryString, SingleHeader, and Method.

    • (dict) –

      The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component.

      Example JSON for a QueryString field to match:

      "FieldToMatch": { "QueryString": {} }

      Example JSON for a Method field to match specification:

      "FieldToMatch": { "Method": { "Name": "DELETE" } }

      • SingleHeader (dict) –

        Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer. This setting isn’t case sensitive.

        Example JSON: "SingleHeader": { "Name": "haystack" }

        Alternately, you can filter and inspect all headers with the Headers FieldToMatch setting.

        • Name (string) – [REQUIRED]

          The name of the query header to inspect.

      • SingleQueryArgument (dict) –

        Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn’t case sensitive.

        Example JSON: "SingleQueryArgument": { "Name": "myArgument" }

        • Name (string) – [REQUIRED]

          The name of the query argument to inspect.

      • AllQueryArguments (dict) –

        Inspect all query arguments.

      • UriPath (dict) –

        Inspect the request URI path. This is the part of the web request that identifies a resource, for example, /images/daily-ad.jpg.

      • QueryString (dict) –

        Inspect the query string. This is the part of a URL that appears after a ? character, if any.

      • Body (dict) –

        Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

        A limited amount of the request body is forwarded to WAF for inspection by the underlying host service. For regional resources, the limit is 8 KB (8,192 bytes) and for CloudFront distributions, the limit is 16 KB (16,384 bytes). For CloudFront distributions, you can increase the limit in the web ACL’s AssociationConfig, for additional processing fees.

        For information about how to handle oversized request bodies, see the Body object configuration.

        • OversizeHandling (string) –

          What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. If the body is larger than the limit, the underlying host service only forwards the contents that are below the limit to WAF for inspection.

          The default limit is 8 KB (8,192 bytes) for regional resources and 16 KB (16,384 bytes) for CloudFront distributions. For CloudFront distributions, you can increase the limit in the web ACL AssociationConfig, for additional processing fees.

          The options for oversize handling are the following:

          • CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

          You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.

          Default: CONTINUE

      • Method (dict) –

        Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.

      • JsonBody (dict) –

        Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

        A limited amount of the request body is forwarded to WAF for inspection by the underlying host service. For regional resources, the limit is 8 KB (8,192 bytes) and for CloudFront distributions, the limit is 16 KB (16,384 bytes). For CloudFront distributions, you can increase the limit in the web ACL’s AssociationConfig, for additional processing fees.

        For information about how to handle oversized request bodies, see the JsonBody object configuration.

        • MatchPattern (dict) – [REQUIRED]

          The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria.

          • All (dict) –

            Match all of the elements. See also MatchScope in JsonBody.

            You must specify either this setting or the IncludedPaths setting, but not both.

          • IncludedPaths (list) –

            Match only the specified include paths. See also MatchScope in JsonBody.

            Provide the include paths using JSON Pointer syntax. For example, "IncludedPaths": ["/dogs/0/name", "/dogs/1/name"]. For information about this syntax, see the Internet Engineering Task Force (IETF) documentation JavaScript Object Notation (JSON) Pointer.

            You must specify either this setting or the All setting, but not both.

            Note

            Don’t use this option to include all paths. Instead, use the All setting.

            • (string) –

        • MatchScope (string) – [REQUIRED]

          The parts of the JSON to match against using the MatchPattern. If you specify All, WAF matches against keys and values.

        • InvalidFallbackBehavior (string) –

          What WAF should do if it fails to completely parse the JSON body. The options are the following:

          • EVALUATE_AS_STRING - Inspect the body as plain text. WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

          If you don’t provide this setting, WAF parses and evaluates the content only up to the first parsing failure that it encounters.

          WAF does its best to parse the entire JSON body, but might be forced to stop for reasons such as invalid characters, duplicate keys, truncation, and any content whose root node isn’t an object or an array.

          WAF parses the JSON in the following examples as two valid key, value pairs:

          • Missing comma: {"key1":"value1""key2":"value2"}

          • Missing colon: {"key1":"value1","key2""value2"}

          • Extra colons: {"key1"::"value1","key2""value2"}

        • OversizeHandling (string) –

          What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. If the body is larger than the limit, the underlying host service only forwards the contents that are below the limit to WAF for inspection.

          The default limit is 8 KB (8,192 bytes) for regional resources and 16 KB (16,384 bytes) for CloudFront distributions. For CloudFront distributions, you can increase the limit in the web ACL AssociationConfig, for additional processing fees.

          The options for oversize handling are the following:

          • CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

          You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.

          Default: CONTINUE

      • Headers (dict) –

        Inspect the request headers. You must configure scope and pattern matching filters in the Headers object, to define the set of headers to and the parts of the headers that WAF inspects.

        Only the first 8 KB (8192 bytes) of a request’s headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the Headers object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service.

        • MatchPattern (dict) – [REQUIRED]

          The filter to use to identify the subset of headers to inspect in a web request.

          You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders.

          Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] }

          • All (dict) –

            Inspect all headers.

          • IncludedHeaders (list) –

            Inspect only the headers that have a key that matches one of the strings specified here.

            • (string) –

          • ExcludedHeaders (list) –

            Inspect only the headers whose keys don’t match any of the strings specified here.

            • (string) –

        • MatchScope (string) – [REQUIRED]

          The parts of the headers to match with the rule inspection criteria. If you specify All, WAF inspects both keys and values.

        • OversizeHandling (string) – [REQUIRED]

          What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF.

          The options for oversize handling are the following:

          • CONTINUE - Inspect the available headers normally, according to the rule inspection criteria.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

      • Cookies (dict) –

        Inspect the request cookies. You must configure scope and pattern matching filters in the Cookies object, to define the set of cookies and the parts of the cookies that WAF inspects.

        Only the first 8 KB (8192 bytes) of a request’s cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the Cookies object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.

        • MatchPattern (dict) – [REQUIRED]

          The filter to use to identify the subset of cookies to inspect in a web request.

          You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies.

          Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] }

          • All (dict) –

            Inspect all cookies.

          • IncludedCookies (list) –

            Inspect only the cookies that have a key that matches one of the strings specified here.

            • (string) –

          • ExcludedCookies (list) –

            Inspect only the cookies whose keys don’t match any of the strings specified here.

            • (string) –

        • MatchScope (string) – [REQUIRED]

          The parts of the cookies to inspect with the rule inspection criteria. If you specify All, WAF inspects both keys and values.

        • OversizeHandling (string) – [REQUIRED]

          What WAF should do if the cookies of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to WAF.

          The options for oversize handling are the following:

          • CONTINUE - Inspect the available cookies normally, according to the rule inspection criteria.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

      • HeaderOrder (dict) –

        Inspect a string containing the list of the request’s header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer.

        • OversizeHandling (string) – [REQUIRED]

          What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF.

          The options for oversize handling are the following:

          • CONTINUE - Inspect the available headers normally, according to the rule inspection criteria.

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

      • JA3Fingerprint (dict) –

        Match against the request’s JA3 fingerprint header. The header contains a hash fingerprint of the TLS Client Hello packet for the request.

        Note

        You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY.

        • FallbackBehavior (string) – [REQUIRED]

          The match status to assign to the web request if the request doesn’t have a JA3 fingerprint.

          You can specify the following fallback behaviors:

          • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

          • NO_MATCH - Treat the web request as not matching the rule statement.

  • ManagedByFirewallManager (boolean) –

    Indicates whether the logging configuration was created by Firewall Manager, as part of an WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration.

  • LoggingFilter (dict) –

    Filtering that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation.

    • Filters (list) – [REQUIRED]

      The filters that you want to apply to the logs.

      • (dict) –

        A single logging filter, used in LoggingFilter.

        • Behavior (string) – [REQUIRED]

          How to handle logs that satisfy the filter’s conditions and requirement.

        • Requirement (string) – [REQUIRED]

          Logic to apply to the filtering conditions. You can specify that, in order to satisfy the filter, a log must match all conditions or must match at least one condition.

        • Conditions (list) – [REQUIRED]

          Match conditions for the filter.

          • (dict) –

            A single match condition for a Filter.

            • ActionCondition (dict) –

              A single action condition. This is the action setting that a log record must contain in order to meet the condition.

              • Action (string) – [REQUIRED]

                The action setting that a log record must contain in order to meet the condition. This is the action that WAF applied to the web request.

                For rule groups, this is either the configured rule action setting, or if you’ve applied a rule action override to the rule, it’s the override action. The value EXCLUDED_AS_COUNT matches on excluded rules and also on rules that have a rule action override of Count.

            • LabelNameCondition (dict) –

              A single label name condition. This is the fully qualified label name that a log record must contain in order to meet the condition. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.

              • LabelName (string) – [REQUIRED]

                The label name that a log record must contain in order to meet the condition. This must be a fully qualified label name. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.

    • DefaultBehavior (string) – [REQUIRED]

      Default handling for logs that don’t match any of the specified filtering conditions.

Return type:

dict

Returns:

Response Syntax

{
    'LoggingConfiguration': {
        'ResourceArn': 'string',
        'LogDestinationConfigs': [
            'string',
        ],
        'RedactedFields': [
            {
                'SingleHeader': {
                    'Name': 'string'
                },
                'SingleQueryArgument': {
                    'Name': 'string'
                },
                'AllQueryArguments': {},
                'UriPath': {},
                'QueryString': {},
                'Body': {
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Method': {},
                'JsonBody': {
                    'MatchPattern': {
                        'All': {},
                        'IncludedPaths': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'InvalidFallbackBehavior': 'MATCH'|'NO_MATCH'|'EVALUATE_AS_STRING',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Headers': {
                    'MatchPattern': {
                        'All': {},
                        'IncludedHeaders': [
                            'string',
                        ],
                        'ExcludedHeaders': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'Cookies': {
                    'MatchPattern': {
                        'All': {},
                        'IncludedCookies': [
                            'string',
                        ],
                        'ExcludedCookies': [
                            'string',
                        ]
                    },
                    'MatchScope': 'ALL'|'KEY'|'VALUE',
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'HeaderOrder': {
                    'OversizeHandling': 'CONTINUE'|'MATCH'|'NO_MATCH'
                },
                'JA3Fingerprint': {
                    'FallbackBehavior': 'MATCH'|'NO_MATCH'
                }
            },
        ],
        'ManagedByFirewallManager': True|False,
        'LoggingFilter': {
            'Filters': [
                {
                    'Behavior': 'KEEP'|'DROP',
                    'Requirement': 'MEETS_ALL'|'MEETS_ANY',
                    'Conditions': [
                        {
                            'ActionCondition': {
                                'Action': 'ALLOW'|'BLOCK'|'COUNT'|'CAPTCHA'|'CHALLENGE'|'EXCLUDED_AS_COUNT'
                            },
                            'LabelNameCondition': {
                                'LabelName': 'string'
                            }
                        },
                    ]
                },
            ],
            'DefaultBehavior': 'KEEP'|'DROP'
        }
    }
}

Response Structure

  • (dict) –

    • LoggingConfiguration (dict) –

      • ResourceArn (string) –

        The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs.

      • LogDestinationConfigs (list) –

        The logging destination configuration that you want to associate with the web ACL.

        Note

        You can associate one logging destination to a web ACL.

        • (string) –

      • RedactedFields (list) –

        The parts of the request that you want to keep out of the logs.

        For example, if you redact the SingleHeader field, the HEADER field in the logs will be REDACTED for all rules that use the SingleHeader FieldToMatch setting.

        Redaction applies only to the component that’s specified in the rule’s FieldToMatch setting, so the SingleHeader redaction doesn’t apply to rules that use the Headers FieldToMatch.

        Note

        You can specify only the following fields for redaction: UriPath, QueryString, SingleHeader, and Method.

        • (dict) –

          The part of the web request that you want WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component.

          Example JSON for a QueryString field to match:

          "FieldToMatch": { "QueryString": {} }

          Example JSON for a Method field to match specification:

          "FieldToMatch": { "Method": { "Name": "DELETE" } }

          • SingleHeader (dict) –

            Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer. This setting isn’t case sensitive.

            Example JSON: "SingleHeader": { "Name": "haystack" }

            Alternately, you can filter and inspect all headers with the Headers FieldToMatch setting.

            • Name (string) –

              The name of the query header to inspect.

          • SingleQueryArgument (dict) –

            Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn’t case sensitive.

            Example JSON: "SingleQueryArgument": { "Name": "myArgument" }

            • Name (string) –

              The name of the query argument to inspect.

          • AllQueryArguments (dict) –

            Inspect all query arguments.

          • UriPath (dict) –

            Inspect the request URI path. This is the part of the web request that identifies a resource, for example, /images/daily-ad.jpg.

          • QueryString (dict) –

            Inspect the query string. This is the part of a URL that appears after a ? character, if any.

          • Body (dict) –

            Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

            A limited amount of the request body is forwarded to WAF for inspection by the underlying host service. For regional resources, the limit is 8 KB (8,192 bytes) and for CloudFront distributions, the limit is 16 KB (16,384 bytes). For CloudFront distributions, you can increase the limit in the web ACL’s AssociationConfig, for additional processing fees.

            For information about how to handle oversized request bodies, see the Body object configuration.

            • OversizeHandling (string) –

              What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. If the body is larger than the limit, the underlying host service only forwards the contents that are below the limit to WAF for inspection.

              The default limit is 8 KB (8,192 bytes) for regional resources and 16 KB (16,384 bytes) for CloudFront distributions. For CloudFront distributions, you can increase the limit in the web ACL AssociationConfig, for additional processing fees.

              The options for oversize handling are the following:

              • CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

              You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.

              Default: CONTINUE

          • Method (dict) –

            Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.

          • JsonBody (dict) –

            Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

            A limited amount of the request body is forwarded to WAF for inspection by the underlying host service. For regional resources, the limit is 8 KB (8,192 bytes) and for CloudFront distributions, the limit is 16 KB (16,384 bytes). For CloudFront distributions, you can increase the limit in the web ACL’s AssociationConfig, for additional processing fees.

            For information about how to handle oversized request bodies, see the JsonBody object configuration.

            • MatchPattern (dict) –

              The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria.

              • All (dict) –

                Match all of the elements. See also MatchScope in JsonBody.

                You must specify either this setting or the IncludedPaths setting, but not both.

              • IncludedPaths (list) –

                Match only the specified include paths. See also MatchScope in JsonBody.

                Provide the include paths using JSON Pointer syntax. For example, "IncludedPaths": ["/dogs/0/name", "/dogs/1/name"]. For information about this syntax, see the Internet Engineering Task Force (IETF) documentation JavaScript Object Notation (JSON) Pointer.

                You must specify either this setting or the All setting, but not both.

                Note

                Don’t use this option to include all paths. Instead, use the All setting.

                • (string) –

            • MatchScope (string) –

              The parts of the JSON to match against using the MatchPattern. If you specify All, WAF matches against keys and values.

            • InvalidFallbackBehavior (string) –

              What WAF should do if it fails to completely parse the JSON body. The options are the following:

              • EVALUATE_AS_STRING - Inspect the body as plain text. WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

              If you don’t provide this setting, WAF parses and evaluates the content only up to the first parsing failure that it encounters.

              WAF does its best to parse the entire JSON body, but might be forced to stop for reasons such as invalid characters, duplicate keys, truncation, and any content whose root node isn’t an object or an array.

              WAF parses the JSON in the following examples as two valid key, value pairs:

              • Missing comma: {"key1":"value1""key2":"value2"}

              • Missing colon: {"key1":"value1","key2""value2"}

              • Extra colons: {"key1"::"value1","key2""value2"}

            • OversizeHandling (string) –

              What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. If the body is larger than the limit, the underlying host service only forwards the contents that are below the limit to WAF for inspection.

              The default limit is 8 KB (8,192 bytes) for regional resources and 16 KB (16,384 bytes) for CloudFront distributions. For CloudFront distributions, you can increase the limit in the web ACL AssociationConfig, for additional processing fees.

              The options for oversize handling are the following:

              • CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

              You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.

              Default: CONTINUE

          • Headers (dict) –

            Inspect the request headers. You must configure scope and pattern matching filters in the Headers object, to define the set of headers to and the parts of the headers that WAF inspects.

            Only the first 8 KB (8192 bytes) of a request’s headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the Headers object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service.

            • MatchPattern (dict) –

              The filter to use to identify the subset of headers to inspect in a web request.

              You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders.

              Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] }

              • All (dict) –

                Inspect all headers.

              • IncludedHeaders (list) –

                Inspect only the headers that have a key that matches one of the strings specified here.

                • (string) –

              • ExcludedHeaders (list) –

                Inspect only the headers whose keys don’t match any of the strings specified here.

                • (string) –

            • MatchScope (string) –

              The parts of the headers to match with the rule inspection criteria. If you specify All, WAF inspects both keys and values.

            • OversizeHandling (string) –

              What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF.

              The options for oversize handling are the following:

              • CONTINUE - Inspect the available headers normally, according to the rule inspection criteria.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

          • Cookies (dict) –

            Inspect the request cookies. You must configure scope and pattern matching filters in the Cookies object, to define the set of cookies and the parts of the cookies that WAF inspects.

            Only the first 8 KB (8192 bytes) of a request’s cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the Cookies object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.

            • MatchPattern (dict) –

              The filter to use to identify the subset of cookies to inspect in a web request.

              You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies.

              Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] }

              • All (dict) –

                Inspect all cookies.

              • IncludedCookies (list) –

                Inspect only the cookies that have a key that matches one of the strings specified here.

                • (string) –

              • ExcludedCookies (list) –

                Inspect only the cookies whose keys don’t match any of the strings specified here.

                • (string) –

            • MatchScope (string) –

              The parts of the cookies to inspect with the rule inspection criteria. If you specify All, WAF inspects both keys and values.

            • OversizeHandling (string) –

              What WAF should do if the cookies of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to WAF.

              The options for oversize handling are the following:

              • CONTINUE - Inspect the available cookies normally, according to the rule inspection criteria.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

          • HeaderOrder (dict) –

            Inspect a string containing the list of the request’s header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer.

            • OversizeHandling (string) –

              What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF.

              The options for oversize handling are the following:

              • CONTINUE - Inspect the available headers normally, according to the rule inspection criteria.

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

          • JA3Fingerprint (dict) –

            Match against the request’s JA3 fingerprint header. The header contains a hash fingerprint of the TLS Client Hello packet for the request.

            Note

            You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY.

            • FallbackBehavior (string) –

              The match status to assign to the web request if the request doesn’t have a JA3 fingerprint.

              You can specify the following fallback behaviors:

              • MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request.

              • NO_MATCH - Treat the web request as not matching the rule statement.

      • ManagedByFirewallManager (boolean) –

        Indicates whether the logging configuration was created by Firewall Manager, as part of an WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration.

      • LoggingFilter (dict) –

        Filtering that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation.

        • Filters (list) –

          The filters that you want to apply to the logs.

          • (dict) –

            A single logging filter, used in LoggingFilter.

            • Behavior (string) –

              How to handle logs that satisfy the filter’s conditions and requirement.

            • Requirement (string) –

              Logic to apply to the filtering conditions. You can specify that, in order to satisfy the filter, a log must match all conditions or must match at least one condition.

            • Conditions (list) –

              Match conditions for the filter.

              • (dict) –

                A single match condition for a Filter.

                • ActionCondition (dict) –

                  A single action condition. This is the action setting that a log record must contain in order to meet the condition.

                  • Action (string) –

                    The action setting that a log record must contain in order to meet the condition. This is the action that WAF applied to the web request.

                    For rule groups, this is either the configured rule action setting, or if you’ve applied a rule action override to the rule, it’s the override action. The value EXCLUDED_AS_COUNT matches on excluded rules and also on rules that have a rule action override of Count.

                • LabelNameCondition (dict) –

                  A single label name condition. This is the fully qualified label name that a log record must contain in order to meet the condition. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.

                  • LabelName (string) –

                    The label name that a log record must contain in order to meet the condition. This must be a fully qualified label name. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.

        • DefaultBehavior (string) –

          Default handling for logs that don’t match any of the specified filtering conditions.

Exceptions

  • WAFV2.Client.exceptions.WAFInternalErrorException

  • WAFV2.Client.exceptions.WAFNonexistentItemException

  • WAFV2.Client.exceptions.WAFOptimisticLockException

  • WAFV2.Client.exceptions.WAFServiceLinkedRoleErrorException

  • WAFV2.Client.exceptions.WAFInvalidParameterException

  • WAFV2.Client.exceptions.WAFInvalidOperationException

  • WAFV2.Client.exceptions.WAFLimitsExceededException

  • WAFV2.Client.exceptions.WAFLogDestinationPermissionIssueException