Class: Aws::WAFV2::Types::AssociationConfig

Inherits:

Struct

Object
Struct
Aws::WAFV2::Types::AssociationConfig

show all

Defined in:: gems/aws-sdk-wafv2/lib/aws-sdk-wafv2/types.rb

Overview

Specifies custom configurations for the associations between the web ACL and protected resources.

Use this to customize the maximum size of the request body that your protected resources forward to WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see WAF Pricing.

For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes).

You can also use this to have your CloudFront distributions insert the WAF challenge JavaScript SDK into the HTML responses that they return. For more information, see the ChallengeJavascriptSdkInjection setting.

Constant Summary collapse

SENSITIVE =

[]

Instance Attribute Summary collapse

#challenge_javascript_sdk_injection ⇒ Hash<String,Types::ChallengeJavascriptSdkInjectionConfig>
Specifies the CloudFront distributions that insert the WAF challenge JavaScript SDK into the HTML responses that they return.
#request_body ⇒ Hash<String,Types::RequestBodyAssociatedResourceTypeConfig>
Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to WAF for inspection.

Instance Attribute Details

#challenge_javascript_sdk_injection ⇒ `Hash<String,Types::ChallengeJavascriptSdkInjectionConfig>`

Specifies the CloudFront distributions that insert the WAF challenge JavaScript SDK into the HTML responses that they return. When you enable this setting for a distribution, you do not add the SDK to your web pages yourself.

You can configure this setting only for CloudFront distributions, using the CLOUDFRONT map key. WAF rejects any other resource type, and the setting is not available for regional resources. To configure it, use the CloudFront scope.

Your web ACL must also contain at least one of the following qualifying managed rule groups. WAF Bot Control qualifies only at the TARGETED inspection level, not at COMMON:

The WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet, with the inspection level set to TARGETED.
The WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet.
The WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet.

If you remove the last qualifying managed rule group from the web ACL, or lower the WAF Bot Control inspection level from TARGETED to COMMON, you must remove this setting in the same update. Otherwise, WAF rejects the update.

Example JSON: { "CLOUDFRONT": {} }

If you omit this setting, CloudFront does not insert the SDK. When you omit it from a web ACL that previously used it, cached HTML that already contains the SDK is still served until it expires, or until you invalidate the cache for that distribution. For more information, see Automatic SDK integration for CloudFront distributions in the WAF Developer Guide.

Returns:

(Hash<String,Types::ChallengeJavascriptSdkInjectionConfig>)

# File 'gems/aws-sdk-wafv2/lib/aws-sdk-wafv2/types.rb', line 672

class AssociationConfig < Struct.new(
  :request_body,
  :challenge_javascript_sdk_injection)
  SENSITIVE = []
  include Aws::Structure
end

#request_body ⇒ `Hash<String,Types::RequestBodyAssociatedResourceTypeConfig>`

Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to WAF for inspection. The default size is 16 KB (16,384 bytes). You can change the setting for any of the available resource types.