diff --git a/clients/client-wafv2/src/commands/CheckCapacityCommand.ts b/clients/client-wafv2/src/commands/CheckCapacityCommand.ts
index 2946f276f7526..761e9fef7ef89 100644
--- a/clients/client-wafv2/src/commands/CheckCapacityCommand.ts
+++ b/clients/client-wafv2/src/commands/CheckCapacityCommand.ts
@@ -646,6 +646,70 @@ export interface CheckCapacityCommandOutput extends CheckCapacityResponse, __Met
* ],
* },
* },
+ * EnableRegexInPath: true || false,
+ * },
+ * AWSManagedRulesACFPRuleSet: { // AWSManagedRulesACFPRuleSet
+ * CreationPath: "STRING_VALUE", // required
+ * RegistrationPagePath: "STRING_VALUE", // required
+ * RequestInspection: { // RequestInspectionACFP
+ * PayloadType: "JSON" || "FORM_ENCODED", // required
+ * UsernameField: {
+ * Identifier: "STRING_VALUE", // required
+ * },
+ * PasswordField: {
+ * Identifier: "STRING_VALUE", // required
+ * },
+ * EmailField: { // EmailField
+ * Identifier: "STRING_VALUE", // required
+ * },
+ * PhoneNumberFields: [ // PhoneNumberFields
+ * { // PhoneNumberField
+ * Identifier: "STRING_VALUE", // required
+ * },
+ * ],
+ * AddressFields: [ // AddressFields
+ * { // AddressField
+ * Identifier: "STRING_VALUE", // required
+ * },
+ * ],
+ * },
+ * ResponseInspection: {
+ * StatusCode: {
+ * SuccessCodes: [ // required
+ * Number("int"),
+ * ],
+ * FailureCodes: [ // required
+ * Number("int"),
+ * ],
+ * },
+ * Header: {
+ * Name: "STRING_VALUE", // required
+ * SuccessValues: [ // required
+ * "STRING_VALUE",
+ * ],
+ * FailureValues: [ // required
+ * "STRING_VALUE",
+ * ],
+ * },
+ * BodyContains: {
+ * SuccessStrings: [ // required
+ * "STRING_VALUE",
+ * ],
+ * FailureStrings: [ // required
+ * "STRING_VALUE",
+ * ],
+ * },
+ * Json: {
+ * Identifier: "STRING_VALUE", // required
+ * SuccessValues: [ // required
+ * "STRING_VALUE",
+ * ],
+ * FailureValues: [ // required
+ * "STRING_VALUE",
+ * ],
+ * },
+ * },
+ * EnableRegexInPath: true || false,
* },
* },
* ],
@@ -791,6 +855,66 @@ export interface CheckCapacityCommandOutput extends CheckCapacityResponse, __Met
* ],
* },
* },
+ * EnableRegexInPath: true || false,
+ * },
+ * AWSManagedRulesACFPRuleSet: {
+ * CreationPath: "STRING_VALUE", // required
+ * RegistrationPagePath: "STRING_VALUE", // required
+ * RequestInspection: {
+ * PayloadType: "JSON" || "FORM_ENCODED", // required
+ * UsernameField: " The name of a field in the request payload that contains part or all of your customer's primary physical address. This data type is used in the The name of a single primary address field. How you specify the address fields depends on the request inspection payload type. For JSON payloads, specify the field identifiers in JSON
+ * pointer syntax. For information about the JSON Pointer
+ * syntax, see the Internet Engineering Task Force (IETF)
+ * documentation JavaScript
+ * Object Notation (JSON) Pointer. For example, for the JSON payload For form encoded payload types, use the HTML form names. For example, for an HTML form with input elements
+ * named Inspect all of the elements that WAF has parsed and extracted from the web request
@@ -259,8 +288,7 @@ export interface Cookies {
* Inspect a string containing the list of the request's header names, ordered as they appear in the web request
* that WAF receives for inspection.
* WAF generates the string and then uses that as the field to match component in its inspection.
- * WAF separates the header names in the string using commas and no added spaces. Matches against the header order string are case insensitive.RequestInspectionACFP
data type.
+ *
+ */
+ Identifier: string | undefined;
+}
+
/**
* @public
* \{ "form": \{ "primaryaddressline1": "THE_ADDRESS1", "primaryaddressline2": "THE_ADDRESS2", "primaryaddressline3": "THE_ADDRESS3" \} \}
,
+ * the address field idenfiers are /form/primaryaddressline1
, /form/primaryaddressline2
, and /form/primaryaddressline3
.primaryaddressline1
, primaryaddressline2
, and primaryaddressline3
, the address fields identifiers are primaryaddressline1
, primaryaddressline2
, and primaryaddressline3
. host:user-agent:accept:authorization:referer
.
Inspect a string containing the list of the request's header names, ordered as they appear in the web request * that WAF receives for inspection. * WAF generates the string and then uses that as the field to match component in its inspection. - * WAF separates the header names in the string using commas and no added spaces.
- *Matches against the header order string are case insensitive.
+ * WAF separates the header names in the string using colons and no added spaces, for examplehost:user-agent:accept:authorization:referer
.
*/
HeaderOrder?: HeaderOrder;
}
@@ -1558,13 +1585,58 @@ export interface ExcludedRule {
/**
* @public
- * Details about your login page password field for request inspection, used in the
- * AWSManagedRulesATPRuleSet
- * RequestInspection
configuration.
The name of the field in the request payload that contains your customer's email.
+ *This data type is used in the RequestInspectionACFP
data type.
The name of the email field.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "email": "THE_EMAIL" \} \}
,
+ * the email field specification is /form/email
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named email1
, the email field specification is email1
.
The name of the field in the request payload that contains your customer's password.
+ *This data type is used in the RequestInspection
and RequestInspectionACFP
data types.
The name of the password field. For example /form/password
.
The name of the password field.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "password": "THE_PASSWORD" \} \}
,
+ * the password field specification is /form/password
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named password1
, the password field specification is password1
.
Details about your login page username field for request inspection, used in the
- * AWSManagedRulesATPRuleSet
- * RequestInspection
configuration.
The name of a field in the request payload that contains part or all of your customer's primary phone number.
+ *This data type is used in the RequestInspectionACFP
data type.
The name of a single primary phone number field.
+ *How you specify the phone number fields depends on the request inspection payload type.
+ *For JSON payloads, specify the field identifiers in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "primaryphoneline1": "THE_PHONE1", "primaryphoneline2": "THE_PHONE2", "primaryphoneline3": "THE_PHONE3" \} \}
,
+ * the phone number field identifiers are /form/primaryphoneline1
, /form/primaryphoneline2
, and /form/primaryphoneline3
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with input elements
+ * named primaryphoneline1
, primaryphoneline2
, and primaryphoneline3
, the phone number field identifiers are primaryphoneline1
, primaryphoneline2
, and primaryphoneline3
.
The name of the field in the request payload that contains your customer's username.
+ *This data type is used in the RequestInspection
and RequestInspectionACFP
data types.
The name of the username field. For example /form/username
.
The name of the username field.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "username": "THE_USERNAME" \} \}
,
+ * the username field specification is /form/username
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named username1
, the username field specification is
+ * username1
+ *
The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage.
- *This is part of the AWSManagedRulesATPRuleSet
configuration in ManagedRuleGroupConfig
.
In these settings, you specify how your application accepts login attempts + *
The criteria for inspecting account creation requests, used by the ACFP rule group to validate and track account creation attempts.
+ *This is part of the AWSManagedRulesACFPRuleSet
configuration in ManagedRuleGroupConfig
.
In these settings, you specify how your application accepts account creation attempts * by providing the request payload type and the names of the fields - * within the request body where the username and password are provided.
+ * within the request body where the username, password, email, and primary address and phone number fields are provided. */ -export interface RequestInspection { +export interface RequestInspectionACFP { /** - *The payload type for your login endpoint, either JSON or form encoded.
+ *The payload type for your account creation endpoint, either JSON or form encoded.
*/ PayloadType: PayloadType | string | undefined; /** - *Details about your login page username field.
- *How you specify this depends on the payload type.
+ *The name of the field in the request payload that contains your customer's username.
+ *How you specify this depends on the request inspection payload type.
*For JSON payloads, specify the field name in JSON @@ -1620,26 +1739,45 @@ export interface RequestInspection { * syntax, see the Internet Engineering Task Force (IETF) * documentation JavaScript * Object Notation (JSON) Pointer.
- *For example, for the JSON payload \{ "login": \{ "username": "THE_USERNAME", "password": "THE_PASSWORD" \} \}
,
- * the username field specification is
- * /login/username
and the password field
- * specification is /login/password
.
For example, for the JSON payload \{ "form": \{ "username": "THE_USERNAME" \} \}
,
+ * the username field specification is /form/username
.
For form encoded payload types, use the HTML form names.
- *For example, for an HTML form with input elements
- * named username1
and password1
,
- * the username field specification is
- * username1
and the password field
- * specification is password1
.
For example, for an HTML form with the input element
+ * named username1
, the username field specification is
+ * username1
+ *
The name of the field in the request payload that contains your customer's password.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "password": "THE_PASSWORD" \} \}
,
+ * the password field specification is /form/password
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named password1
, the password field specification is password1
.
Details about your login page password field.
- *How you specify this depends on the payload type.
+ *The name of the field in the request payload that contains your customer's email.
+ *How you specify this depends on the request inspection payload type.
*For JSON payloads, specify the field name in JSON @@ -1647,42 +1785,84 @@ export interface RequestInspection { * syntax, see the Internet Engineering Task Force (IETF) * documentation JavaScript * Object Notation (JSON) Pointer.
- *For example, for the JSON payload \{ "login": \{ "username": "THE_USERNAME", "password": "THE_PASSWORD" \} \}
,
- * the username field specification is
- * /login/username
and the password field
- * specification is /login/password
.
For example, for the JSON payload \{ "form": \{ "email": "THE_EMAIL" \} \}
,
+ * the email field specification is /form/email
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named email1
, the email field specification is email1
.
The names of the fields in the request payload that contain your customer's primary phone number.
+ *Order the phone number fields in the array exactly as they are ordered in the request payload.
+ *How you specify the phone number fields depends on the request inspection payload type.
+ *For JSON payloads, specify the field identifiers in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "primaryphoneline1": "THE_PHONE1", "primaryphoneline2": "THE_PHONE2", "primaryphoneline3": "THE_PHONE3" \} \}
,
+ * the phone number field identifiers are /form/primaryphoneline1
, /form/primaryphoneline2
, and /form/primaryphoneline3
.
For form encoded payload types, use the HTML form names.
*For example, for an HTML form with input elements
- * named username1
and password1
,
- * the username field specification is
- * username1
and the password field
- * specification is password1
.
primaryphoneline1
, primaryphoneline2
, and primaryphoneline3
, the phone number field identifiers are primaryphoneline1
, primaryphoneline2
, and primaryphoneline3
.
* The names of the fields in the request payload that contain your customer's primary physical address.
+ *Order the address fields in the array exactly as they are ordered in the request payload.
+ *How you specify the address fields depends on the request inspection payload type.
+ *For JSON payloads, specify the field identifiers in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "primaryaddressline1": "THE_ADDRESS1", "primaryaddressline2": "THE_ADDRESS2", "primaryaddressline3": "THE_ADDRESS3" \} \}
,
+ * the address field idenfiers are /form/primaryaddressline1
, /form/primaryaddressline2
, and /form/primaryaddressline3
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with input elements
+ * named primaryaddressline1
, primaryaddressline2
, and primaryaddressline3
, the address fields identifiers are primaryaddressline1
, primaryaddressline2
, and primaryaddressline3
.
Configures inspection of the response body. WAF can inspect the first 65,536 bytes (64 KB) of the response body. This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
.
Configures inspection of the response body. WAF can inspect the first 65,536 bytes (64 KB) of the response body.
+ * This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
and AWSManagedRulesACFPRuleSet
.
Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*Strings in the body of the response that indicate a successful login attempt. To be counted as a successful login, the string can be anywhere in the body and must be an exact match, including case. Each string must be unique among the success and failure strings.
- *JSON example: "SuccessStrings": [ "Login successful", "Welcome to our site!" ]
+ *
Strings in the body of the response that indicate a successful login or account creation attempt. To be counted as a success, the string can be anywhere in the body and must be an exact match, including case. Each string must be unique among the success and failure strings.
+ *JSON examples: "SuccessStrings": [ "Login successful" ]
and "SuccessStrings": [ "Account creation successful", "Welcome to our site!" ]
*
Strings in the body of the response that indicate a failed login attempt. To be counted as a failed login, the string can be anywhere in the body and must be an exact match, including case. Each string must be unique among the success and failure strings.
- *JSON example: "FailureStrings": [ "Login failed" ]
+ *
Strings in the body of the response that indicate a failed login or account creation attempt. To be counted as a failure, the string can be anywhere in the body and must be an exact match, including case. Each string must be unique among the success and failure strings.
+ *JSON example: "FailureStrings": [ "Request failed" ]
*
Configures inspection of the response header. This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
.
Configures inspection of the response header.
+ * This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
and AWSManagedRulesACFPRuleSet
.
Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*The name of the header to match against. The name must be an exact match, including case.
- *JSON example: "Name": [ "LoginResult" ]
+ *
JSON example: "Name": [ "RequestResult" ]
*
Values in the response header with the specified name that indicate a successful login attempt. To be counted as a successful login, the value must be an exact match, including case. Each value must be unique among the success and failure values.
- *JSON example: "SuccessValues": [ "LoginPassed", "Successful login" ]
+ *
Values in the response header with the specified name that indicate a successful login or account creation attempt. To be counted as a success, the value must be an exact match, including case. Each value must be unique among the success and failure values.
+ *JSON examples: "SuccessValues": [ "LoginPassed", "Successful login" ]
and "SuccessValues": [ "AccountCreated", "Successful account creation" ]
*
Values in the response header with the specified name that indicate a failed login attempt. To be counted as a failed login, the value must be an exact match, including case. Each value must be unique among the success and failure values.
- *JSON example: "FailureValues": [ "LoginFailed", "Failed login" ]
+ *
Values in the response header with the specified name that indicate a failed login or account creation attempt. To be counted as a failure, the value must be an exact match, including case. Each value must be unique among the success and failure values.
+ *JSON examples: "FailureValues": [ "LoginFailed", "Failed login" ]
and "FailureValues": [ "AccountCreationFailed" ]
*
Configures inspection of the response JSON. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON. This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
.
Configures inspection of the response JSON. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON.
+ * This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
and AWSManagedRulesACFPRuleSet
.
Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*The identifier for the value to match against in the JSON. The identifier must be an exact match, including case.
- *JSON example: "Identifier": [ "/login/success" ]
+ *
JSON examples: "Identifier": [ "/login/success" ]
and "Identifier": [ "/sign-up/success" ]
*
Values for the specified identifier in the response JSON that indicate a successful login attempt. To be counted as a successful login, the value must be an exact match, including case. Each value must be unique among the success and failure values.
+ *Values for the specified identifier in the response JSON that indicate a successful login or account creation attempt. To be counted as a success, the value must be an exact match, including case. Each value must be unique among the success and failure values.
*JSON example: "SuccessValues": [ "True", "Succeeded" ]
*
Values for the specified identifier in the response JSON that indicate a failed login attempt. To be counted as a failed login, the value must be an exact match, including case. Each value must be unique among the success and failure values.
+ *Values for the specified identifier in the response JSON that indicate a failed login or account creation attempt. To be counted as a failure, the value must be an exact match, including case. Each value must be unique among the success and failure values.
*JSON example: "FailureValues": [ "False", "Failed" ]
*
Configures inspection of the response status code. This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
.
Configures inspection of the response status code.
+ * This is part of the ResponseInspection
configuration for AWSManagedRulesATPRuleSet
and AWSManagedRulesACFPRuleSet
.
Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*Status codes in the response that indicate a successful login attempt. To be counted as a successful login, the response status code must match one of these. Each code must be unique among the success and failure status codes.
+ *Status codes in the response that indicate a successful login or account creation attempt. To be counted as a success, the response status code must match one of these. Each code must be unique among the success and failure status codes.
*JSON example: "SuccessCodes": [ 200, 201 ]
*
Status codes in the response that indicate a failed login attempt. To be counted as a failed login, the response status code must match one of these. Each code must be unique among the success and failure status codes.
+ *Status codes in the response that indicate a failed login or account creation attempt. To be counted as a failure, the response status code must match one of these. Each code must be unique among the success and failure status codes.
*JSON example: "FailureCodes": [ 400, 404 ]
*
The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates.
- *The ATP rule group evaluates the responses that your protected resources send back to client login attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels - * and mitigates requests from client sessions and IP addresses that submit too many failed login attempts in a short amount of time.
+ *The criteria for inspecting responses to login requests and account creation requests, used by the ATP and ACFP rule groups to track login and account creation success and failure rates.
*Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*This is part of the AWSManagedRulesATPRuleSet
configuration in ManagedRuleGroupConfig
.
Enable login response inspection by configuring exactly one component of the response to inspect. You can't configure more than one. If you don't configure any of the response inspection options, response inspection is disabled.
+ *The rule groups evaluates the responses that your protected resources send back to client login and account creation attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels + * and mitigates requests from client sessions and IP addresses with too much suspicious activity in a short amount of time.
+ *This is part of the AWSManagedRulesATPRuleSet
and AWSManagedRulesACFPRuleSet
configurations in ManagedRuleGroupConfig
.
Enable response inspection by configuring exactly one component of the response to inspect, for example, Header
or StatusCode
. You can't configure more than one component for inspection. If you don't configure any of the response inspection options, response inspection is disabled.
Configures inspection of the response status code.
+ *Configures inspection of the response status code for success and failure indicators.
*/ StatusCode?: ResponseInspectionStatusCode; /** - *Configures inspection of the response header.
+ *Configures inspection of the response header for success and failure indicators.
*/ Header?: ResponseInspectionHeader; /** - *Configures inspection of the response body. WAF can inspect the first 65,536 bytes (64 KB) of the response body.
+ *Configures inspection of the response body for success and failure indicators. WAF can inspect the first 65,536 bytes (64 KB) of the response body.
*/ BodyContains?: ResponseInspectionBodyContains; /** - *Configures inspection of the response JSON. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON.
+ *Configures inspection of the response JSON for success and failure indicators. WAF can inspect the first 65,536 bytes (64 KB) of the response JSON.
*/ Json?: ResponseInspectionJson; } +/** + * @public + *Details for your use of the account creation fraud prevention managed rule group, AWSManagedRulesACFPRuleSet
. This configuration is used in ManagedRuleGroupConfig
.
The path of the account creation endpoint for your application. This is the page on your website that accepts the completed registration form for a new user. This page must accept POST
requests.
For example, for the URL https://example.com/web/signup
, you would provide the path /web/signup
.
The path of the account registration endpoint for your application. This is the page on your website that presents the registration form to new users.
+ *This page must accept GET
text/html requests.
For example, for the URL https://example.com/web/register
, you would provide the path /web/register
.
The criteria for inspecting account creation requests, used by the ACFP rule group to validate and track account creation attempts.
+ */ + RequestInspection: RequestInspectionACFP | undefined; + + /** + *The criteria for inspecting responses to account creation requests, used by the ACFP rule group to track account creation success rates.
+ *Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
+ *The ACFP rule group evaluates the responses that your protected resources send back to client account creation attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels + * and mitigates requests from client sessions and IP addresses that have had too many successful account creation attempts in a short amount of time.
+ */ + ResponseInspection?: ResponseInspection; + + /** + *Allow the use of regular expressions in the registration page path and the account creation path.
+ */ + EnableRegexInPath?: boolean; +} + +/** + * @public + *The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage.
+ *This is part of the AWSManagedRulesATPRuleSet
configuration in ManagedRuleGroupConfig
.
In these settings, you specify how your application accepts login attempts + * by providing the request payload type and the names of the fields + * within the request body where the username and password are provided.
+ */ +export interface RequestInspection { + /** + *The payload type for your login endpoint, either JSON or form encoded.
+ */ + PayloadType: PayloadType | string | undefined; + + /** + *The name of the field in the request payload that contains your customer's username.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "username": "THE_USERNAME" \} \}
,
+ * the username field specification is /form/username
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named username1
, the username field specification is
+ * username1
+ *
The name of the field in the request payload that contains your customer's password.
+ *How you specify this depends on the request inspection payload type.
+ *For JSON payloads, specify the field name in JSON + * pointer syntax. For information about the JSON Pointer + * syntax, see the Internet Engineering Task Force (IETF) + * documentation JavaScript + * Object Notation (JSON) Pointer.
+ *For example, for the JSON payload \{ "form": \{ "password": "THE_PASSWORD" \} \}
,
+ * the password field specification is /form/password
.
For form encoded payload types, use the HTML form names.
+ *For example, for an HTML form with the input element
+ * named password1
, the password field specification is password1
.
Details for your use of the account takeover prevention managed rule group, AWSManagedRulesATPRuleSet
. This configuration is used in ManagedRuleGroupConfig
.
The criteria for inspecting responses to login requests, used by the ATP rule group to track login failure rates.
- *The ATP rule group evaluates the responses that your protected resources send back to client login attempts, keeping count of successful and failed attempts from each IP address and client session. Using this information, the rule group labels - * and mitigates requests from client sessions and IP addresses that submit too many failed login attempts in a short amount of time.
*Response inspection is available only in web ACLs that protect Amazon CloudFront distributions.
*The ATP rule group evaluates the responses that your protected resources send back to client login attempts, keeping count of successful and failed attempts for each IP address and client session. Using this information, the rule group labels + * and mitigates requests from client sessions and IP addresses that have had too many failed login attempts in a short amount of time.
*/ ResponseInspection?: ResponseInspection; + + /** + *Allow the use of regular expressions in the login page path.
+ */ + EnableRegexInPath?: boolean; } /** @@ -1864,9 +2154,19 @@ export interface AWSManagedRulesBotControlRuleSet { /** * @public *Additional information that's used by a managed rule group. Many managed rule groups don't require this.
- *Use the AWSManagedRulesATPRuleSet
configuration object for the account takeover prevention managed rule group, to provide information such as the sign-in page of your application and the type of content to accept or reject from the client.
Use the AWSManagedRulesBotControlRuleSet
configuration object to configure the
+ *
The rule groups used for intelligent threat mitigation require additional configuration:
+ *Use the AWSManagedRulesACFPRuleSet
configuration object to configure the account creation fraud prevention managed rule group. The configuration includes the registration and sign-up pages of your application and the locations in the account creation request payload of data, such as the user email and phone number fields.
Use the AWSManagedRulesATPRuleSet
configuration object to configure the account takeover prevention managed rule group. The configuration includes the sign-in page of your application and the locations in the login request payload of data such as the username and password.
Use the AWSManagedRulesBotControlRuleSet
configuration object to configure the
* protection level that you want the Bot Control rule group to use.
For example specifications, see the examples section of CreateWebACL.
*/ export interface ManagedRuleGroupConfig { @@ -1883,8 +2183,7 @@ export interface ManagedRuleGroupConfig { * @deprecated * *Instead of this setting, provide your configuration under AWSManagedRulesATPRuleSet
- * RequestInspection
.
Instead of this setting, provide your configuration under the request inspection configuration for AWSManagedRulesATPRuleSet
or AWSManagedRulesACFPRuleSet
.
Instead of this setting, provide your configuration under AWSManagedRulesATPRuleSet
- * RequestInspection
.
Instead of this setting, provide your configuration under the request inspection configuration for AWSManagedRulesATPRuleSet
or AWSManagedRulesACFPRuleSet
.
Instead of this setting, provide your configuration under AWSManagedRulesATPRuleSet
- * RequestInspection
.
Instead of this setting, provide your configuration under the request inspection configuration for AWSManagedRulesATPRuleSet
or AWSManagedRulesACFPRuleSet
.
Additional configuration for using the account creation fraud prevention (ACFP) managed rule group, AWSManagedRulesACFPRuleSet
.
+ * Use this to provide account creation request information to the rule group. For web ACLs that protect CloudFront distributions, use this to also provide
+ * the information about how your distribution responds to account creation requests.
For information + * about using the ACFP managed rule group, see WAF Fraud Control account creation fraud prevention (ACFP) rule group + * and WAF Fraud Control account creation fraud prevention (ACFP) + * in the WAF Developer Guide.
+ */ + AWSManagedRulesACFPRuleSet?: AWSManagedRulesACFPRuleSet; } /** @@ -2648,6 +2956,7 @@ export class WAFInvalidOperationException extends __BaseException { * @enum */ export const ParameterExceptionField = { + ACP_RULE_SET_RESPONSE_INSPECTION: "ACP_RULE_SET_RESPONSE_INSPECTION", AND_STATEMENT: "AND_STATEMENT", ASSOCIABLE_RESOURCE: "ASSOCIABLE_RESOURCE", ASSOCIATED_RESOURCE_TYPE: "ASSOCIATED_RESOURCE_TYPE", @@ -4573,13 +4882,17 @@ export interface LoggingConfiguration { LogDestinationConfigs: string[] | undefined; /** - *The parts of the request that you want to keep out of the logs. For example, if you + *
The parts of the request that you want to keep out of the logs.
+ *For example, if you
* redact the SingleHeader
field, the HEADER
field in the logs will
- * be REDACTED
.
REDACTED
for all rules that use the SingleHeader
+ * FieldToMatch
setting.
+ * Redaction applies only to the component that's specified in the rule's FieldToMatch
setting, so the SingleHeader
redaction
+ * doesn't apply to rules that use the Headers
+ * FieldToMatch
.
You can specify only the following fields for redaction: UriPath
,
- * QueryString
, SingleHeader
, Method
, and
- * JsonBody
.
QueryString
, SingleHeader
, and Method
.
* A rule statement used to run the rules that are defined in a managed rule group. To use this, provide the vendor name and the name of the rule group in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups.
*You cannot nest a ManagedRuleGroupStatement
, for example for use inside a NotStatement
or OrStatement
. It can only be referenced as a top-level statement within a rule.
You are charged additional fees when you use the WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet
or the WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet
. For more information, see WAF Pricing.
You are charged additional fees when you use the WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet
, the WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet
, or the WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet
. For more information, see WAF Pricing.
A rule statement used to run the rules that are defined in a managed rule group. To use this, provide the vendor name and the name of the rule group in this statement. You can retrieve the required names by calling ListAvailableManagedRuleGroups.
*You cannot nest a ManagedRuleGroupStatement
, for example for use inside a NotStatement
or OrStatement
. It can only be referenced as a top-level statement within a rule.
You are charged additional fees when you use the WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet
or the WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet
. For more information, see WAF Pricing.
You are charged additional fees when you use the WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet
, the WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet
, or the WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet
. For more information, see WAF Pricing.
Additional information that's used by a managed rule group. Many managed rule groups don't require this.
- *Use the AWSManagedRulesATPRuleSet
configuration object for the account takeover prevention managed rule group, to provide information such as the sign-in page of your application and the type of content to accept or reject from the client.
Use the AWSManagedRulesBotControlRuleSet
configuration object to configure the
+ *
The rule groups used for intelligent threat mitigation require additional configuration:
+ *Use the AWSManagedRulesACFPRuleSet
configuration object to configure the account creation fraud prevention managed rule group. The configuration includes the registration and sign-up pages of your application and the locations in the account creation request payload of data, such as the user email and phone number fields.
Use the AWSManagedRulesATPRuleSet
configuration object to configure the account takeover prevention managed rule group. The configuration includes the sign-in page of your application and the locations in the login request payload of data such as the username and password.
Use the AWSManagedRulesBotControlRuleSet
configuration object to configure the
* protection level that you want the Bot Control rule group to use.
The URL to use in SDK integrations with Amazon Web Services managed rule groups. For example, you can use the integration SDKs with the account takeover prevention managed rule group AWSManagedRulesATPRuleSet
. This is only populated if you are using a rule group in your web ACL that integrates with your applications in this way. For more information, see WAF client application integration
+ *
The URL to use in SDK integrations with Amazon Web Services managed rule groups. For example, you can use the integration SDKs with the account takeover prevention managed rule group AWSManagedRulesATPRuleSet
and the account creation fraud prevention managed rule group AWSManagedRulesACFPRuleSet
. This is only populated if you are using a rule group in your web ACL that integrates with your applications in this way. For more information, see WAF client application integration
* in the WAF Developer Guide.