Package software.amazon.awscdk.services.wafv2

Class CfnWebACL

java.lang.Object

software.amazon.jsii.JsiiObject

software.constructs.Construct

software.amazon.awscdk.CfnElement

software.amazon.awscdk.CfnRefElement

software.amazon.awscdk.CfnResource

software.amazon.awscdk.services.wafv2.CfnWebACL

All Implemented Interfaces:

IInspectable, IEnvironmentAware, IWebACLRef, ITaggable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable

@Generated(value="jsii-pacmak/1.120.0 (build 192dc88)",
           date="2025-12-05T22:26:47.335Z")
@Stability(Stable)
public class CfnWebACL
extends CfnResource
implements IInspectable, IWebACLRef, ITaggable

This is the latest version of AWS WAF , named AWS WAF V2, released in November, 2019.

For information, including how to migrate your AWS WAF resources from the prior release, see the AWS WAF developer guide .

Use an WebACL to define a collection of rules to use to inspect and control web requests. Each rule in a web ACL has a statement that defines what to look for in web requests and an action that AWS WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that doesn't match any of the rules.

The rules in a web ACL can be a combination of explicitly defined rules and rule groups that you reference from the web ACL. The rule groups can be rule groups that you manage or rule groups that are managed by others.

You can associate a web ACL with one or more AWS resources to protect. The resources can be an Amazon CloudFront distribution, an REST API, an Application Load Balancer , an AWS AppSync GraphQL API , an Amazon Cognito user pool, an AWS App Runner service, an AWS Amplify application, or an AWS Verified Access instance.

For more information, see Web access control lists (web ACLs) in the AWS WAF developer guide .

Web ACLs used in AWS Shield Advanced automatic application layer DDoS mitigation

If you use Shield Advanced automatic application layer DDoS mitigation, the web ACLs that you use with automatic mitigation have a rule group rule whose name starts with ShieldMitigationRuleGroup . This rule is used for automatic mitigations and it's managed for you in the web ACL by Shield Advanced and AWS WAF . You'll see the rule listed among the web ACL rules when you view the web ACL through the AWS WAF interfaces.

When you manage the web ACL through CloudFormation interfaces, you won't see the Shield Advanced rule. CloudFormation doesn't include this type of rule in the stack drift status between the actual configuration of the web ACL and your web ACL template.

Don't add the Shield Advanced rule group rule to your web ACL template. The rule shouldn't be in your template. When you update the web ACL template in a stack, the Shield Advanced rule is maintained for you by AWS WAF in the resulting web ACL.

For more information, see Shield Advanced automatic application layer DDoS mitigation in the AWS Shield Advanced developer guide .

Example:

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	CfnWebACL.AllowActionProperty	Specifies that AWS WAF should allow the request and optionally defines additional custom handling for the request.
static interface	CfnWebACL.AndStatementProperty	A logical rule statement used to combine other rule statements with AND logic.
static interface	CfnWebACL.ApplicationAttributeProperty	Application details defined during the web ACL creation process.
static interface	CfnWebACL.ApplicationConfigProperty	A list of ApplicationAttribute s that contains information about the application.
static interface	CfnWebACL.AsnMatchStatementProperty	A rule statement that inspects web traffic based on the Autonomous System Number (ASN) associated with the request's IP address.
static interface	CfnWebACL.AssociationConfigProperty	Specifies custom configurations for the associations between the web ACL and protected resources.
static interface	CfnWebACL.AWSManagedRulesACFPRuleSetProperty	Details for your use of the account creation fraud prevention managed rule group, AWSManagedRulesACFPRuleSet .
static interface	CfnWebACL.AWSManagedRulesAntiDDoSRuleSetProperty	Configures the use of the anti-DDoS managed rule group, AWSManagedRulesAntiDDoSRuleSet .
static interface	CfnWebACL.AWSManagedRulesATPRuleSetProperty	Details for your use of the account takeover prevention managed rule group, AWSManagedRulesATPRuleSet .
static interface	CfnWebACL.AWSManagedRulesBotControlRuleSetProperty	Details for your use of the Bot Control managed rule group, AWSManagedRulesBotControlRuleSet .
static interface	CfnWebACL.BlockActionProperty	Specifies that AWS WAF should block the request and optionally defines additional custom handling for the response to the web request.
static interface	CfnWebACL.BodyProperty	Inspect the body of the web request.
static final class	CfnWebACL.Builder	A fluent builder for CfnWebACL.
static interface	CfnWebACL.ByteMatchStatementProperty	A rule statement that defines a string match search for AWS WAF to apply to web requests.
static interface	CfnWebACL.CaptchaActionProperty	Specifies that AWS WAF should run a CAPTCHA check against the request:.
static interface	CfnWebACL.CaptchaConfigProperty	Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.
static interface	CfnWebACL.ChallengeActionProperty	Specifies that AWS WAF should run a Challenge check against the request to verify that the request is coming from a legitimate client session: - If the request includes a valid, unexpired challenge token, AWS WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a CountAction .
static interface	CfnWebACL.ChallengeConfigProperty	Specifies how AWS WAF should handle Challenge evaluations.
static interface	CfnWebACL.ClientSideActionConfigProperty	This is part of the configuration for the managed rules AWSManagedRulesAntiDDoSRuleSet in ManagedRuleGroupConfig .
static interface	CfnWebACL.ClientSideActionProperty	This is part of the AWSManagedRulesAntiDDoSRuleSet ClientSideActionConfig configuration in ManagedRuleGroupConfig .
static interface	CfnWebACL.CookieMatchPatternProperty	The filter to use to identify the subset of cookies to inspect in a web request.
static interface	CfnWebACL.CookiesProperty	Inspect the cookies in the web request.
static interface	CfnWebACL.CountActionProperty	Specifies that AWS WAF should count the request.
static interface	CfnWebACL.CustomHTTPHeaderProperty	A custom header for custom request and response handling.
static interface	CfnWebACL.CustomRequestHandlingProperty	Custom request handling behavior that inserts custom headers into a web request.
static interface	CfnWebACL.CustomResponseBodyProperty	The response body to use in a custom response to a web request.
static interface	CfnWebACL.CustomResponseProperty	A custom response to send to the client.
static interface	CfnWebACL.DataProtectionConfigProperty	Specifies data protection to apply to the web request data for the web ACL.
static interface	CfnWebACL.DataProtectProperty	Example:
static interface	CfnWebACL.DefaultActionProperty	In a WebACL , this is the action that you want AWS WAF to perform when a web request doesn't match any of the rules in the WebACL .
static interface	CfnWebACL.ExcludedRuleProperty	Specifies a single rule in a rule group whose action you want to override to Count .
static interface	CfnWebACL.FieldIdentifierProperty	The identifier of a field in the web request payload that contains customer data.
static interface	CfnWebACL.FieldToMatchProperty	Specifies a web request component to be used in a rule match statement or in a logging configuration.
static interface	CfnWebACL.FieldToProtectProperty	Specifies a field type and keys to protect in stored web request data.
static interface	CfnWebACL.ForwardedIPConfigurationProperty	The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin.
static interface	CfnWebACL.GeoMatchStatementProperty	A rule statement that labels web requests by country and region and that matches against web requests based on country code.
static interface	CfnWebACL.HeaderMatchPatternProperty	The filter to use to identify the subset of headers to inspect in a web request.
static interface	CfnWebACL.HeadersProperty	Inspect all headers in the web request.
static interface	CfnWebACL.ImmunityTimePropertyProperty	Used for CAPTCHA and challenge token settings.
static interface	CfnWebACL.IPSetForwardedIPConfigurationProperty	The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin.
static interface	CfnWebACL.IPSetReferenceStatementProperty	A rule statement used to detect web requests coming from particular IP addresses or address ranges.
static interface	CfnWebACL.JA3FingerprintProperty	Available for use with Amazon CloudFront distributions and Application Load Balancers.
static interface	CfnWebACL.JA4FingerprintProperty	Available for use with Amazon CloudFront distributions and Application Load Balancers.
static interface	CfnWebACL.JsonBodyProperty	Inspect the body of the web request as JSON.
static interface	CfnWebACL.JsonMatchPatternProperty	The patterns to look for in the JSON body.
static interface	CfnWebACL.LabelMatchStatementProperty	A rule statement to match against labels that have been added to the web request by rules that have already run in the web ACL.
static interface	CfnWebACL.LabelProperty	A single label container.
static interface	CfnWebACL.ManagedRuleGroupConfigProperty	Additional information that's used by a managed rule group.
static interface	CfnWebACL.ManagedRuleGroupStatementProperty	A rule statement used to run the rules that are defined in a managed rule group.
static interface	CfnWebACL.NotStatementProperty	A logical rule statement used to negate the results of another rule statement.
static interface	CfnWebACL.OnSourceDDoSProtectionConfigProperty	Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
static interface	CfnWebACL.OrStatementProperty	A logical rule statement used to combine other rule statements with OR logic.
static interface	CfnWebACL.OverrideActionProperty	The action to use in the place of the action that results from the rule group evaluation.
static interface	CfnWebACL.RateBasedStatementCustomKeyProperty	Specifies a single custom aggregate key for a rate-base rule.
static interface	CfnWebACL.RateBasedStatementProperty	A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate.
static interface	CfnWebACL.RateLimitCookieProperty	Specifies a cookie as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RateLimitHeaderProperty	Specifies a header as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RateLimitJA3FingerprintProperty	Use the request's JA3 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
static interface	CfnWebACL.RateLimitJA4FingerprintProperty	Use the request's JA4 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
static interface	CfnWebACL.RateLimitLabelNamespaceProperty	Specifies a label namespace to use as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RateLimitQueryArgumentProperty	Specifies a query argument in the request as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RateLimitQueryStringProperty	Specifies the request's query string as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RateLimitUriPathProperty	Specifies the request's URI path as an aggregate key for a rate-based rule.
static interface	CfnWebACL.RegexMatchStatementProperty	A rule statement used to search web request components for a match against a single regular expression.
static interface	CfnWebACL.RegexPatternSetReferenceStatementProperty	A rule statement used to search web request components for matches with regular expressions.
static interface	CfnWebACL.RegexProperty	A single regular expression.
static interface	CfnWebACL.RequestBodyAssociatedResourceTypeConfigProperty	Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to AWS WAF for inspection.
static interface	CfnWebACL.RequestInspectionACFPProperty	The criteria for inspecting account creation requests, used by the ACFP rule group to validate and track account creation attempts.
static interface	CfnWebACL.RequestInspectionProperty	The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage.
static interface	CfnWebACL.ResponseInspectionBodyContainsProperty	Configures inspection of the response body.
static interface	CfnWebACL.ResponseInspectionHeaderProperty	Configures inspection of the response header.
static interface	CfnWebACL.ResponseInspectionJsonProperty	Configures inspection of the response JSON.
static interface	CfnWebACL.ResponseInspectionProperty	The criteria for inspecting responses to login requests and account creation requests, used by the ATP and ACFP rule groups to track login and account creation success and failure rates.
static interface	CfnWebACL.ResponseInspectionStatusCodeProperty	Configures inspection of the response status code.
static interface	CfnWebACL.RuleActionOverrideProperty	Action setting to use in the place of a rule action that is configured inside the rule group.
static interface	CfnWebACL.RuleActionProperty	The action that AWS WAF should take on a web request when it matches a rule's statement.
static interface	CfnWebACL.RuleGroupReferenceStatementProperty	A rule statement used to run the rules that are defined in a RuleGroup .
static interface	CfnWebACL.RuleProperty	A single rule, which you can use in a WebACL or RuleGroup to identify web requests that you want to manage in some way.
static interface	CfnWebACL.SingleHeaderProperty	Inspect one of the headers in the web request, identified by name, for example, User-Agent or Referer .
static interface	CfnWebACL.SingleQueryArgumentProperty	Inspect one query argument in the web request, identified by name, for example UserName or SalesRegion .
static interface	CfnWebACL.SizeConstraintStatementProperty	A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<).
static interface	CfnWebACL.SqliMatchStatementProperty	A rule statement that inspects for malicious SQL code.
static interface	CfnWebACL.StatementProperty	The processing guidance for a rule, used by AWS WAF to determine whether a web request matches the rule.
static interface	CfnWebACL.TextTransformationProperty	Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
static interface	CfnWebACL.UriFragmentProperty	Inspect fragments of the request URI.
static interface	CfnWebACL.VisibilityConfigProperty	Defines and enables Amazon CloudWatch metrics and web request sample collection.
static interface	CfnWebACL.XssMatchStatementProperty	A rule statement that inspects for cross-site scripting (XSS) attacks.

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Nested classes/interfaces inherited from interface software.constructs.IConstruct

software.constructs.IConstruct.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.IInspectable

IInspectable.Jsii$Default, IInspectable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.ITaggable

ITaggable.Jsii$Default, ITaggable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.interfaces.wafv2.IWebACLRef

IWebACLRef.Jsii$Default, IWebACLRef.Jsii$Proxy

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CFN_RESOURCE_TYPE_NAME	The CloudFormation resource type name for this resource class.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CfnWebACL(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	CfnWebACL(software.amazon.jsii.JsiiObjectRef objRef)
	CfnWebACL(software.constructs.Construct scope, String id, CfnWebACLProps props)	Create a new AWS::WAFv2::WebACL.

Method Summary

Modifier and Type	Method	Description
static String	arnForWebACL(IWebACLRef resource)
Object	getApplicationConfig()	Returns a list of ApplicationAttribute s.
Object	getAssociationConfig()	Specifies custom configurations for the associations between the web ACL and protected resources.
String	getAttrArn()	The Amazon Resource Name (ARN) of the web ACL.
Number	getAttrCapacity()	The web ACL capacity units (WCUs) currently being used by this web ACL.
String	getAttrId()	The ID of the web ACL.
String	getAttrLabelNamespace()	The label namespace prefix for this web ACL.
Object	getCaptchaConfig()	Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.
protected Map<String,Object>	getCfnProperties()
Object	getChallengeConfig()	Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.
Object	getCustomResponseBodies()	A map of custom response keys and content bodies.
Object	getDataProtectionConfig()	Specifies data protection to apply to the web request data for the web ACL.
Object	getDefaultAction()	The action to perform if none of the Rules contained in the WebACL match.
String	getDescription()	A description of the web ACL that helps with identification.
String	getName()	The name of the web ACL.
Object	getOnSourceDDoSProtectionConfig()	Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
Object	getRules()	The rule statements used to identify the web requests that you want to manage.
String	getScope()	Specifies whether this is for an Amazon CloudFront distribution or for a regional application.
TagManager	getTags()	Tag Manager which manages the tags for this resource.
List<CfnTag>	getTagsRaw()	Key:value pairs associated with an AWS resource.
List<String>	getTokenDomains()	Specifies the domains that AWS WAF should accept in a web request token.
Object	getVisibilityConfig()	Defines and enables Amazon CloudWatch metrics and web request sample collection.
WebACLReference	getWebAclRef()	A reference to a WebACL resource.
void	inspect(TreeInspector inspector)	Examines the CloudFormation resource and discloses attributes.
static Boolean	isCfnWebACL(Object x)	Checks whether the given object is a CfnWebACL.
protected Map<String,Object>	renderProperties(Map<String,Object> props)
void	setApplicationConfig(IResolvable value)	Returns a list of ApplicationAttribute s.
void	setApplicationConfig(CfnWebACL.ApplicationConfigProperty value)	Returns a list of ApplicationAttribute s.
void	setAssociationConfig(IResolvable value)	Specifies custom configurations for the associations between the web ACL and protected resources.
void	setAssociationConfig(CfnWebACL.AssociationConfigProperty value)	Specifies custom configurations for the associations between the web ACL and protected resources.
void	setCaptchaConfig(IResolvable value)	Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.
void	setCaptchaConfig(CfnWebACL.CaptchaConfigProperty value)	Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.
void	setChallengeConfig(IResolvable value)	Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.
void	setChallengeConfig(CfnWebACL.ChallengeConfigProperty value)	Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.
void	setCustomResponseBodies(Map<String,Object> value)	A map of custom response keys and content bodies.
void	setCustomResponseBodies(IResolvable value)	A map of custom response keys and content bodies.
void	setDataProtectionConfig(IResolvable value)	Specifies data protection to apply to the web request data for the web ACL.
void	setDataProtectionConfig(CfnWebACL.DataProtectionConfigProperty value)	Specifies data protection to apply to the web request data for the web ACL.
void	setDefaultAction(IResolvable value)	The action to perform if none of the Rules contained in the WebACL match.
void	setDefaultAction(CfnWebACL.DefaultActionProperty value)	The action to perform if none of the Rules contained in the WebACL match.
void	setDescription(String value)	A description of the web ACL that helps with identification.
void	setName(String value)	The name of the web ACL.
void	setOnSourceDDoSProtectionConfig(IResolvable value)	Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
void	setOnSourceDDoSProtectionConfig(CfnWebACL.OnSourceDDoSProtectionConfigProperty value)	Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
void	setRules(List<Object> value)	The rule statements used to identify the web requests that you want to manage.
void	setRules(IResolvable value)	The rule statements used to identify the web requests that you want to manage.
void	setScope(String value)	Specifies whether this is for an Amazon CloudFront distribution or for a regional application.
void	setTagsRaw(List<CfnTag> value)	Key:value pairs associated with an AWS resource.
void	setTokenDomains(List<String> value)	Specifies the domains that AWS WAF should accept in a web request token.
void	setVisibilityConfig(IResolvable value)	Defines and enables Amazon CloudWatch metrics and web request sample collection.
void	setVisibilityConfig(CfnWebACL.VisibilityConfigProperty value)	Defines and enables Amazon CloudWatch metrics and web request sample collection.

Methods inherited from class software.amazon.awscdk.CfnResource

addDeletionOverride, addDependency, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getAtt, getCfnOptions, getCfnResourceType, getEnv, getMetadata, getUpdatedProperites, getUpdatedProperties, isCfnResource, obtainDependencies, obtainResourceDependencies, removeDependency, replaceDependency, shouldSynthesize, toString, validateProperties

Methods inherited from class software.amazon.awscdk.CfnRefElement

getRef

Methods inherited from class software.amazon.awscdk.CfnElement

getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId

Methods inherited from class software.constructs.Construct

getNode, isConstruct

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.constructs.IConstruct

getNode

Methods inherited from interface software.amazon.awscdk.interfaces.IEnvironmentAware

getEnv

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

CFN_RESOURCE_TYPE_NAME

@Stability(Stable)
public static final String CFN_RESOURCE_TYPE_NAME

The CloudFormation resource type name for this resource class.

Constructor Details

CfnWebACL

protected CfnWebACL(software.amazon.jsii.JsiiObjectRef objRef)

CfnWebACL

protected CfnWebACL(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

CfnWebACL

@Stability(Stable)
public CfnWebACL(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 CfnWebACLProps props)

Create a new AWS::WAFv2::WebACL.

Parameters:

scope - Scope in which this resource is defined. This parameter is required.

id - Construct identifier for this resource (unique in its scope). This parameter is required.

props - Resource properties. This parameter is required.

Method Details

arnForWebACL

@Stability(Stable)
@NotNull
public static String arnForWebACL(@NotNull
 IWebACLRef resource)

Parameters:

resource - This parameter is required.

isCfnWebACL

@Stability(Stable)
@NotNull
public static Boolean isCfnWebACL(@NotNull
 Object x)

Checks whether the given object is a CfnWebACL.

Parameters:

x - This parameter is required.

inspect

@Stability(Stable)
public void inspect(@NotNull
 TreeInspector inspector)

Examines the CloudFormation resource and discloses attributes.

Specified by:

inspect in interface IInspectable

Parameters:

inspector - tree inspector to collect and process attributes. This parameter is required.

renderProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> renderProperties(@NotNull
 Map<String,Object> props)

Overrides:

renderProperties in class CfnResource

Parameters:

props - This parameter is required.

getAttrArn

@Stability(Stable)
@NotNull
public String getAttrArn()

The Amazon Resource Name (ARN) of the web ACL.

getAttrCapacity

@Stability(Stable)
@NotNull
public Number getAttrCapacity()

The web ACL capacity units (WCUs) currently being used by this web ACL.

AWS WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.

getAttrId

@Stability(Stable)
@NotNull
public String getAttrId()

The ID of the web ACL.

getAttrLabelNamespace

@Stability(Stable)
@NotNull
public String getAttrLabelNamespace()

The label namespace prefix for this web ACL.

All labels added by rules in this web ACL have this prefix.

The syntax for the label namespace prefix for a web ACL is the following: awswaf:<account ID>:webacl:<web ACL name>:

When a rule with a label matches a web request, AWS WAF adds the fully qualified label to the request. A fully qualified label is made up of the label namespace from the rule group or web ACL where the rule is defined and the label from the rule, separated by a colon.

getCfnProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> getCfnProperties()

Overrides:

getCfnProperties in class CfnResource

getTags

@Stability(Stable)
@NotNull
public TagManager getTags()

Tag Manager which manages the tags for this resource.

Specified by:

getTags in interface ITaggable

getWebAclRef

@Stability(Stable)
@NotNull
public WebACLReference getWebAclRef()

A reference to a WebACL resource.

Specified by:

getWebAclRef in interface IWebACLRef

getDefaultAction

@Stability(Stable)
@NotNull
public Object getDefaultAction()

The action to perform if none of the Rules contained in the WebACL match.

Returns union: either IResolvable or CfnWebACL.DefaultActionProperty

setDefaultAction

@Stability(Stable)
public void setDefaultAction(@NotNull
 IResolvable value)

The action to perform if none of the Rules contained in the WebACL match.

setDefaultAction

@Stability(Stable)
public void setDefaultAction(@NotNull
 CfnWebACL.DefaultActionProperty value)

The action to perform if none of the Rules contained in the WebACL match.

getScope

@Stability(Stable)
@NotNull
public String getScope()

Specifies whether this is for an Amazon CloudFront distribution or for a regional application.

setScope

@Stability(Stable)
public void setScope(@NotNull
 String value)

Specifies whether this is for an Amazon CloudFront distribution or for a regional application.

getVisibilityConfig

@Stability(Stable)
@NotNull
public Object getVisibilityConfig()

Defines and enables Amazon CloudWatch metrics and web request sample collection.

Returns union: either IResolvable or CfnWebACL.VisibilityConfigProperty

setVisibilityConfig

@Stability(Stable)
public void setVisibilityConfig(@NotNull
 IResolvable value)

Defines and enables Amazon CloudWatch metrics and web request sample collection.

setVisibilityConfig

@Stability(Stable)
public void setVisibilityConfig(@NotNull
 CfnWebACL.VisibilityConfigProperty value)

Defines and enables Amazon CloudWatch metrics and web request sample collection.

getApplicationConfig

@Stability(Stable)
@Nullable
public Object getApplicationConfig()

Returns a list of ApplicationAttribute s.

Returns union: either IResolvable or CfnWebACL.ApplicationConfigProperty

setApplicationConfig

@Stability(Stable)
public void setApplicationConfig(@Nullable
 IResolvable value)

Returns a list of ApplicationAttribute s.

setApplicationConfig

@Stability(Stable)
public void setApplicationConfig(@Nullable
 CfnWebACL.ApplicationConfigProperty value)

Returns a list of ApplicationAttribute s.

getAssociationConfig

@Stability(Stable)
@Nullable
public Object getAssociationConfig()

Specifies custom configurations for the associations between the web ACL and protected resources.

Returns union: either IResolvable or CfnWebACL.AssociationConfigProperty

setAssociationConfig

@Stability(Stable)
public void setAssociationConfig(@Nullable
 IResolvable value)

Specifies custom configurations for the associations between the web ACL and protected resources.

setAssociationConfig

@Stability(Stable)
public void setAssociationConfig(@Nullable
 CfnWebACL.AssociationConfigProperty value)

Specifies custom configurations for the associations between the web ACL and protected resources.

getCaptchaConfig

@Stability(Stable)
@Nullable
public Object getCaptchaConfig()

Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.

Returns union: either IResolvable or CfnWebACL.CaptchaConfigProperty

setCaptchaConfig

@Stability(Stable)
public void setCaptchaConfig(@Nullable
 IResolvable value)

Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.

setCaptchaConfig

@Stability(Stable)
public void setCaptchaConfig(@Nullable
 CfnWebACL.CaptchaConfigProperty value)

Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don't have their own CaptchaConfig settings.

getChallengeConfig

@Stability(Stable)
@Nullable
public Object getChallengeConfig()

Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.

Returns union: either IResolvable or CfnWebACL.ChallengeConfigProperty

setChallengeConfig

@Stability(Stable)
public void setChallengeConfig(@Nullable
 IResolvable value)

Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.

setChallengeConfig

@Stability(Stable)
public void setChallengeConfig(@Nullable
 CfnWebACL.ChallengeConfigProperty value)

Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own ChallengeConfig settings.

getCustomResponseBodies

@Stability(Stable)
@Nullable
public Object getCustomResponseBodies()

A map of custom response keys and content bodies.

Returns union: either IResolvable or Mapinvalid input: '<'String, either IResolvable or CfnWebACL.CustomResponseBodyProperty>

setCustomResponseBodies

@Stability(Stable)
public void setCustomResponseBodies(@Nullable
 IResolvable value)

A map of custom response keys and content bodies.

setCustomResponseBodies

@Stability(Stable)
public void setCustomResponseBodies(@Nullable
 Map<String,Object> value)

A map of custom response keys and content bodies.

getDataProtectionConfig

@Stability(Stable)
@Nullable
public Object getDataProtectionConfig()

Specifies data protection to apply to the web request data for the web ACL.

Returns union: either IResolvable or CfnWebACL.DataProtectionConfigProperty

setDataProtectionConfig

@Stability(Stable)
public void setDataProtectionConfig(@Nullable
 IResolvable value)

Specifies data protection to apply to the web request data for the web ACL.

setDataProtectionConfig

@Stability(Stable)
public void setDataProtectionConfig(@Nullable
 CfnWebACL.DataProtectionConfigProperty value)

Specifies data protection to apply to the web request data for the web ACL.

getDescription

@Stability(Stable)
@Nullable
public String getDescription()

A description of the web ACL that helps with identification.

setDescription

@Stability(Stable)
public void setDescription(@Nullable
 String value)

A description of the web ACL that helps with identification.

getName

@Stability(Stable)
@Nullable
public String getName()

The name of the web ACL.

setName

@Stability(Stable)
public void setName(@Nullable
 String value)

The name of the web ACL.

getOnSourceDDoSProtectionConfig

@Stability(Stable)
@Nullable
public Object getOnSourceDDoSProtectionConfig()

Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.

Returns union: either IResolvable or CfnWebACL.OnSourceDDoSProtectionConfigProperty

setOnSourceDDoSProtectionConfig

@Stability(Stable)
public void setOnSourceDDoSProtectionConfig(@Nullable
 IResolvable value)

Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.

setOnSourceDDoSProtectionConfig

@Stability(Stable)
public void setOnSourceDDoSProtectionConfig(@Nullable
 CfnWebACL.OnSourceDDoSProtectionConfigProperty value)

Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.

getRules

@Stability(Stable)
@Nullable
public Object getRules()

The rule statements used to identify the web requests that you want to manage.

Returns union: either IResolvable or Listinvalid input: '<'either IResolvable or CfnWebACL.RuleProperty>

setRules

@Stability(Stable)
public void setRules(@Nullable
 IResolvable value)

The rule statements used to identify the web requests that you want to manage.

setRules

@Stability(Stable)
public void setRules(@Nullable
 List<Object> value)

The rule statements used to identify the web requests that you want to manage.

getTagsRaw

@Stability(Stable)
@Nullable
public List<CfnTag> getTagsRaw()

Key:value pairs associated with an AWS resource.

setTagsRaw

@Stability(Stable)
public void setTagsRaw(@Nullable
 List<CfnTag> value)

Key:value pairs associated with an AWS resource.

getTokenDomains

@Stability(Stable)
@Nullable
public List<String> getTokenDomains()

Specifies the domains that AWS WAF should accept in a web request token.

setTokenDomains

@Stability(Stable)
public void setTokenDomains(@Nullable
 List<String> value)

Specifies the domains that AWS WAF should accept in a web request token.