AwsWafv2WebAclArgs

interface AwsWafv2WebAclArgs extends Omit<aws.wafv2.WebAclArgs, 'name' | 'ruleJson' | 'tags' | 'visibilityConfig'> {
associationConfig?: Input<WebAclAssociationConfig | undefined>;
captchaConfig?: Input<WebAclCaptchaConfig | undefined>;
challengeConfig?: Input<WebAclChallengeConfig | undefined>;
customResponseBodies?: Input<Input<WebAclCustomResponseBody>[] | undefined>;
dataProtectionConfig?: Input<WebAclDataProtectionConfig | undefined>;
defaultAction: Input<WebAclDefaultAction>;
description?: Input<string | undefined>;
logging?: AwsWafv2WebAclLoggingArgs;
name: string;
namePrefix?: Input<string | undefined>;
region?: Input<string | undefined>;
rules?: Input<Input<WebAclRule>[] | undefined>;
rulesTemplate: AwsWafv2WebAclRulesTemplate;
scope: Input<string>;
tags?: Input<Record<string, Input<string>>>;
tokenDomains?: Input<Input<string>[] | undefined>;
visibilityConfig: Input<AwsWafv2WebAclVisibilityConfigInput>;
}

Input arguments for the WAFv2 web ACL capability.

Remarks

Rules are accepted from a JSON template file only through rulesTemplate. Inline rules JSON is intentionally not part of this API.

visibilityConfig.metricName is derived from the resolved AWS name built from args.webAcl.name and is not consumer-settable.

Logging is enabled by default and keeps only BLOCK actions unless loggingFilter is explicitly overridden. When logging is enabled, this component always creates and manages a CloudWatch log group named aws-waf-logs-<resolved-web-acl-name> and wires it as the log destination.

Example

CODE

const webAclArgs: AwsWafv2WebAclArgs = {
  name: 'applicationWebAcl',
  scope: 'REGIONAL',
  defaultAction: {
    allow: {},
  },
  visibilityConfig: {
    cloudwatchMetricsEnabled: true,
    sampledRequestsEnabled: true,
  },
  rulesTemplate: {
    path: 'templates/waf/web-acl-rules.json',
  },
  logging: {
    enabled: true,
  },
};

Hierarchy

WebAclArgs, "name" | "ruleJson" | "tags" | "visibilityConfig">
AwsWafv2WebAclArgs

Properties

`associationConfig: Input<WebAclAssociationConfig | undefined>`

Inherited from associationConfig

Specifies custom configurations for the associations between the web ACL and protected resources. See associationConfig below for details.

`captchaConfig: Input<WebAclCaptchaConfig | undefined>`

Inherited from captchaConfig

Specifies how AWS WAF should handle CAPTCHA evaluations on the ACL level (used by AWS Bot Control). See captchaConfig below for details.

`challengeConfig: Input<WebAclChallengeConfig | undefined>`

Inherited from challengeConfig

Specifies how AWS WAF should handle Challenge evaluations on the ACL level (used by AWS Bot Control). See challengeConfig below for details.

`customResponseBodies: Input<Input<WebAclCustomResponseBody>[] | undefined>`

Inherited from customResponseBodies

Defines custom response bodies that can be referenced by customResponse actions. See customResponseBody below for details.

`dataProtectionConfig: Input<WebAclDataProtectionConfig | undefined>`

Inherited from dataProtectionConfig

Specifies data protection to apply to the web request data for the web ACL. This is a web ACL level data protection option. See dataProtectionConfig below for details.

`defaultAction: Input<WebAclDefaultAction>`

Inherited from defaultAction

Action to perform if none of the rules contained in the WebACL match. See defaultAction below for details.

`description: Input<string | undefined>`

Inherited from description

Friendly description of the WebACL.

`logging: AwsWafv2WebAclLoggingArgs`

Optional logging settings. Defaults to enabled with BLOCK-only filter.

`name: string`

Required purpose name used to derive the AWS resource name.

Remarks

This value is also used as the Pulumi logical identity and must be a plain, non-empty synchronous value resolved at preview time (not Input/Output/promise-derived).

`namePrefix: Input<string | undefined>`

Inherited from namePrefix

Creates a unique name beginning with the specified prefix. Conflicts with name.

`region: Input<string | undefined>`

Inherited from region

Region where this resource will be managed. Defaults to the Region set in the provider configuration.

`rules: Input<Input<WebAclRule>[] | undefined>`

Inherited from rules

rule blocks in this resource have several known limitations. Consider using aws.wafv2.WebAclRule to manage rules as separate resources instead. Rule blocks used to identify the web requests that you want to allow, block, or count. See rule below for details.

`rulesTemplate: AwsWafv2WebAclRulesTemplate`

JSON template input used to render the final rules array.

`scope: Input<string>`

Inherited from scope

Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are CLOUDFRONT or REGIONAL. To work with CloudFront, you must also specify the region us-east-1 (N. Virginia) on the AWS provider.

`tags: Input<Record<string, Input<string>>>`

Additional tags merged with default project/environment tags.

`tokenDomains: Input<Input<string>[] | undefined>`

Inherited from tokenDomains

Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.

`visibilityConfig: Input<AwsWafv2WebAclVisibilityConfigInput>`

Visibility configuration; metricName is derived from args.webAcl.name and cannot be set by consumers.