This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.
AWS::WAFv2::RuleGroup XssMatchStatement
A rule statement that inspects for cross-site scripting (XSS) attacks. In XSS attacks, the attacker uses vulnerabilities in a benign website as a vehicle to inject malicious client-site scripts into other legitimate web browsers.
Syntax
To declare this entity in your CloudFormation template, use the following syntax:
JSON
{ "FieldToMatch" :FieldToMatch, "PreParseTextTransformations" :[ PreParseTextTransformation, ... ], "TextTransformations" :[ TextTransformation, ... ]}
YAML
FieldToMatch:FieldToMatchPreParseTextTransformations:- PreParseTextTransformationTextTransformations:- TextTransformation
Properties
FieldToMatch-
The part of the web request that you want AWS WAF to inspect.
Required: Yes
Type: FieldToMatch
Update requires: No interruption
PreParseTextTransformations-
Pre-parse text transformations normalize the raw query string before AWS WAF parses it into individual query arguments. They are applied before the standard text transformations. Pre-parse text transformations are only supported when
FieldToMatchisSingleQueryArgumentorAllQueryArguments. You can specify up to 10 pre-parse text transformations per rule statement.Required: No
Type: Array of PreParseTextTransformation
Update requires: No interruption
TextTransformations-
Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, AWS WAF performs all transformations on the content of the request component identified by
FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.Required: Yes
Type: Array of TextTransformation
Minimum:
1Update requires: No interruption
