Package software.amazon.awscdk.services.wafv2

Class CfnLoggingConfiguration

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.CfnElement
software.amazon.awscdk.CfnRefElement
software.amazon.awscdk.CfnResource
software.amazon.awscdk.services.wafv2.CfnLoggingConfiguration
All Implemented Interfaces:
IInspectable, IEnvironmentAware, ILoggingConfigurationRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.119.0 (build 1634eac)", date="2025-11-13T16:10:15.812Z") @Stability(Stable) public class CfnLoggingConfiguration extends CfnResource implements IInspectable, ILoggingConfigurationRef
Defines an association between logging destinations and a web ACL resource, for logging from AWS WAF .

As part of the association, you can specify parts of the standard logging fields to keep out of the logs and you can specify filters so that you log only a subset of the logging records.

If you configure data protection for the web ACL, the protection applies to the data that AWS WAF sends to the logs.

You can define one logging destination per web ACL.

You can access information about the traffic that AWS WAF inspects using the following steps:

  • Create your logging destination. You can use an Amazon CloudWatch Logs log group, an Amazon Simple Storage Service (Amazon S3) bucket, or an Amazon Kinesis Data Firehose.

The name that you give the destination must start with aws-waf-logs- . Depending on the type of destination, you might need to configure additional settings or permissions.

For configuration requirements and pricing information for each destination type, see Logging web ACL traffic in the AWS WAF Developer Guide .

  • Associate your logging destination to your web ACL using a PutLoggingConfiguration request.

When you successfully enable logging using a PutLoggingConfiguration request, AWS WAF creates an additional role or policy that is required to write logs to the logging destination. For an Amazon CloudWatch Logs log group, AWS WAF creates a resource policy on the log group. For an Amazon S3 bucket, AWS WAF creates a bucket policy. For an Amazon Kinesis Data Firehose, AWS WAF creates a service-linked role.

For additional information about web ACL logging, see Logging web ACL traffic information in the AWS WAF Developer Guide .

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.wafv2.*;
 Object jsonBody;
 Object loggingFilter;
 Object method;
 Object queryString;
 Object singleHeader;
 Object uriPath;
 CfnLoggingConfiguration cfnLoggingConfiguration = CfnLoggingConfiguration.Builder.create(this, "MyCfnLoggingConfiguration")
         .logDestinationConfigs(List.of("logDestinationConfigs"))
         .resourceArn("resourceArn")
         // the properties below are optional
         .loggingFilter(loggingFilter)
         .redactedFields(List.of(FieldToMatchProperty.builder()
                 .jsonBody(jsonBody)
                 .method(method)
                 .queryString(queryString)
                 .singleHeader(singleHeader)
                 .uriPath(uriPath)
                 .build()))
         .build();

See Also:

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnLoggingConfiguration

      protected CfnLoggingConfiguration(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnLoggingConfiguration

      protected CfnLoggingConfiguration(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnLoggingConfiguration

      @Stability(Stable) public CfnLoggingConfiguration(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull CfnLoggingConfigurationProps props)
      Create a new AWS::WAFv2::LoggingConfiguration.

      Parameters:
      scope - Scope in which this resource is defined. This parameter is required.
      id - Construct identifier for this resource (unique in its scope). This parameter is required.
      props - Resource properties. This parameter is required.

  • Method Details

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector - tree inspector to collect and process attributes. This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getAttrManagedByFirewallManager

      @Stability(Stable) @NotNull public IResolvable getAttrManagedByFirewallManager()
      Indicates whether the logging configuration was created by AWS Firewall Manager , as part of an AWS WAF policy configuration.

      If true, only Firewall Manager can modify or delete the configuration.

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getLoggingConfigurationRef

      @Stability(Stable) @NotNull public LoggingConfigurationReference getLoggingConfigurationRef()
      A reference to a LoggingConfiguration resource.
      Specified by:
      getLoggingConfigurationRef in interface ILoggingConfigurationRef

    • getLogDestinationConfigs

      @Stability(Stable) @NotNull public List<String> getLogDestinationConfigs()
      The logging destination configuration that you want to associate with the web ACL.

    • setLogDestinationConfigs

      @Stability(Stable) public void setLogDestinationConfigs(@NotNull List<String> value)
      The logging destination configuration that you want to associate with the web ACL.

    • getResourceArn

      @Stability(Stable) @NotNull public String getResourceArn()
      The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

    • setResourceArn

      @Stability(Stable) public void setResourceArn(@NotNull String value)
      The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

    • getLoggingFilter

      @Stability(Stable) @Nullable public Object getLoggingFilter()
      Filtering that specifies which web requests are kept in the logs and which are dropped.

    • setLoggingFilter

      @Stability(Stable) public void setLoggingFilter(@Nullable Object value)
      Filtering that specifies which web requests are kept in the logs and which are dropped.

    • getRedactedFields

      @Stability(Stable) @Nullable public Object getRedactedFields()
      The parts of the request that you want to keep out of the logs.

      Returns union: either IResolvable or Listinvalid input: '<'either IResolvable or CfnLoggingConfiguration.FieldToMatchProperty>

    • setRedactedFields

      @Stability(Stable) public void setRedactedFields(@Nullable IResolvable value)
      The parts of the request that you want to keep out of the logs.

    • setRedactedFields

      @Stability(Stable) public void setRedactedFields(@Nullable List<Object> value)
      The parts of the request that you want to keep out of the logs.