_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
logging_configuration
The LoggingConfiguration for the specified web ACL. | STRUCT(
"resource_arn" VARCHAR,
"log_destination_configs" VARCHAR[],
"redacted_fields" STRUCT(
"single_header" STRUCT(
"name" VARCHAR
),
"single_query_argument" STRUCT(
"name" VARCHAR
),
"all_query_arguments" BOOLEAN,
"uri_path" BOOLEAN,
"query_string" BOOLEAN,
"body" STRUCT(
"oversize_handling" VARCHAR
),
"method" BOOLEAN,
"json_body" STRUCT(
"match_pattern" STRUCT(
"all" BOOLEAN,
"included_paths" VARCHAR[]
),
"match_scope" VARCHAR,
"invalid_fallback_behavior" VARCHAR,
"oversize_handling" VARCHAR
),
"headers" STRUCT(
"match_pattern" STRUCT(
"all" BOOLEAN,
"included_headers" VARCHAR[],
"excluded_headers" VARCHAR[]
),
"match_scope" VARCHAR,
"oversize_handling" VARCHAR
),
"cookies" STRUCT(
"match_pattern" STRUCT(
"all" BOOLEAN,
"included_cookies" VARCHAR[],
"excluded_cookies" VARCHAR[]
),
"match_scope" VARCHAR,
"oversize_handling" VARCHAR
),
"header_order" STRUCT(
"oversize_handling" VARCHAR
),
"ja3_fingerprint" STRUCT(
"fallback_behavior" VARCHAR
)
)[],
"managed_by_firewall_manager" BOOLEAN,
"logging_filter" STRUCT(
"filters" STRUCT(
"behavior" VARCHAR,
"requirement" VARCHAR,
"conditions" STRUCT(
"action_condition" STRUCT(
"action" VARCHAR
),
"label_name_condition" STRUCT(
"label_name" VARCHAR
)
)[]
)[],
"default_behavior" VARCHAR
),
"log_type" VARCHAR,
"log_scope" VARCHAR
) |
Show child fields- logging_configuration.log_destination_configs[]
- logging_configuration.log_scope
The owner of the logging configuration, which must be set to CUSTOMER for the configurations that you manage. The log scope SECURITY_LAKE indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see Collecting data from Amazon Web Services services in the Amazon Security Lake user guide. Default: CUSTOMER - logging_configuration.log_type
Used to distinguish between various logging options. Currently, there is one option. Default: WAF_LOGS - logging_configuration.logging_filter
Filtering that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. Show child fields- logging_configuration.logging_filter.default_behavior
Default handling for logs that don't match any of the specified filtering conditions. - logging_configuration.logging_filter.filters[]
Show child fields- logging_configuration.logging_filter.filters[].behavior
How to handle logs that satisfy the filter's conditions and requirement. - logging_configuration.logging_filter.filters[].conditions[]
Show child fields- logging_configuration.logging_filter.filters[].conditions[].action_condition
A single action condition. This is the action setting that a log record must contain in order to meet the condition. Show child fields- logging_configuration.logging_filter.filters[].conditions[].action_condition.action
The action setting that a log record must contain in order to meet the condition. This is the action that WAF applied to the web request. For rule groups, this is either the configured rule action setting, or if you've applied a rule action override to the rule, it's the override action. The value EXCLUDED_AS_COUNT matches on excluded rules and also on rules that have a rule action override of Count.
- logging_configuration.logging_filter.filters[].conditions[].label_name_condition
A single label name condition. This is the fully qualified label name that a log record must contain in order to meet the condition. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label. Show child fields- logging_configuration.logging_filter.filters[].conditions[].label_name_condition.label_name
The label name that a log record must contain in order to meet the condition. This must be a fully qualified label name. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.
- logging_configuration.logging_filter.filters[].requirement
Logic to apply to the filtering conditions. You can specify that, in order to satisfy the filter, a log must match all conditions or must match at least one condition.
- logging_configuration.managed_by_firewall_manager
Indicates whether the logging configuration was created by Firewall Manager, as part of an WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration. - logging_configuration.redacted_fields[]
Show child fields- logging_configuration.redacted_fields[].all_query_arguments
Inspect all query arguments. - logging_configuration.redacted_fields[].body
Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. -
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). -
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL AssociationConfig, for additional processing fees. For information about how to handle oversized request bodies, see the Body object configuration. Show child fields- logging_configuration.redacted_fields[].body.oversize_handling
What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. -
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). -
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL AssociationConfig, for additional processing fees. The options for oversize handling are the following: -
CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement. You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: CONTINUE
- logging_configuration.redacted_fields[].cookies
Inspect the request cookies. You must configure scope and pattern matching filters in the Cookies object, to define the set of cookies and the parts of the cookies that WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the Cookies object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service. Show child fields- logging_configuration.redacted_fields[].cookies.match_pattern
The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either All, IncludedCookies, or ExcludedCookies. Example JSON: "MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] } Show child fields- logging_configuration.redacted_fields[].cookies.match_pattern.all
Inspect all cookies. - logging_configuration.redacted_fields[].cookies.match_pattern.excluded_cookies[]
- logging_configuration.redacted_fields[].cookies.match_pattern.included_cookies[]
- logging_configuration.redacted_fields[].cookies.match_scope
The parts of the cookies to inspect with the rule inspection criteria. If you specify ALL, WAF inspects both keys and values. All does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical AND statement to combine two match rules, one that inspects the keys and another that inspects the values. - logging_configuration.redacted_fields[].cookies.oversize_handling
What WAF should do if the cookies of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to WAF. The options for oversize handling are the following: -
CONTINUE - Inspect the available cookies normally, according to the rule inspection criteria. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement.
- logging_configuration.redacted_fields[].header_order
Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer. Show child fields- logging_configuration.redacted_fields[].header_order.oversize_handling
What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF. The options for oversize handling are the following: -
CONTINUE - Inspect the available headers normally, according to the rule inspection criteria. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement.
- logging_configuration.redacted_fields[].headers
Inspect the request headers. You must configure scope and pattern matching filters in the Headers object, to define the set of headers to and the parts of the headers that WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the Headers object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service. Show child fields- logging_configuration.redacted_fields[].headers.match_pattern
The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either All, IncludedHeaders, or ExcludedHeaders. Example JSON: "MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] } Show child fields- logging_configuration.redacted_fields[].headers.match_pattern.all
Inspect all headers. - logging_configuration.redacted_fields[].headers.match_pattern.excluded_headers[]
- logging_configuration.redacted_fields[].headers.match_pattern.included_headers[]
- logging_configuration.redacted_fields[].headers.match_scope
The parts of the headers to match with the rule inspection criteria. If you specify ALL, WAF inspects both keys and values. All does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical AND statement to combine two match rules, one that inspects the keys and another that inspects the values. - logging_configuration.redacted_fields[].headers.oversize_handling
What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF. The options for oversize handling are the following: -
CONTINUE - Inspect the available headers normally, according to the rule inspection criteria. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement.
- logging_configuration.redacted_fields[].ja3_fingerprint
Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. You can use this choice only with a string match ByteMatchStatement with the PositionalConstraint set to EXACTLY. You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see Log fields in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. Show child fields- logging_configuration.redacted_fields[].ja3_fingerprint.fallback_behavior
The match status to assign to the web request if the request doesn't have a JA3 fingerprint. You can specify the following fallback behaviors:
- logging_configuration.redacted_fields[].json_body
Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. -
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). -
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL AssociationConfig, for additional processing fees. For information about how to handle oversized request bodies, see the JsonBody object configuration. Show child fields- logging_configuration.redacted_fields[].json_body.invalid_fallback_behavior
What WAF should do if it fails to completely parse the JSON body. The options are the following: -
EVALUATE_AS_STRING - Inspect the body as plain text. WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement. If you don't provide this setting, WAF parses and evaluates the content only up to the first parsing failure that it encounters. WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, WAF doesn't apply the fallback behavior. For more information, see JSON body in the WAF Developer Guide. - logging_configuration.redacted_fields[].json_body.match_pattern
The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. Show child fields- logging_configuration.redacted_fields[].json_body.match_pattern.all
Match all of the elements. See also MatchScope in JsonBody. You must specify either this setting or the IncludedPaths setting, but not both. - logging_configuration.redacted_fields[].json_body.match_pattern.included_paths[]
- logging_configuration.redacted_fields[].json_body.match_scope
The parts of the JSON to match against using the MatchPattern. If you specify ALL, WAF matches against keys and values. All does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical AND statement to combine two match rules, one that inspects the keys and another that inspects the values. - logging_configuration.redacted_fields[].json_body.oversize_handling
What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. -
For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). -
For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL AssociationConfig, for additional processing fees. The options for oversize handling are the following: -
CONTINUE - Inspect the available body contents normally, according to the rule inspection criteria. -
MATCH - Treat the web request as matching the rule statement. WAF applies the rule action to the request. -
NO_MATCH - Treat the web request as not matching the rule statement. You can combine the MATCH or NO_MATCH settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: CONTINUE
- logging_configuration.redacted_fields[].method
Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform. - logging_configuration.redacted_fields[].query_string
Inspect the query string. This is the part of a URL that appears after a ? character, if any. - logging_configuration.redacted_fields[].single_header
Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer. This setting isn't case sensitive. Example JSON: "SingleHeader": { "Name": "haystack" } Alternately, you can filter and inspect all headers with the Headers FieldToMatch setting. Show child fields- logging_configuration.redacted_fields[].single_header.name
The name of the query header to inspect.
- logging_configuration.redacted_fields[].single_query_argument
Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn't case sensitive. Example JSON: "SingleQueryArgument": { "Name": "myArgument" } Show child fields- logging_configuration.redacted_fields[].single_query_argument.name
The name of the query argument to inspect.
- logging_configuration.redacted_fields[].uri_path
Inspect the request URI path. This is the part of the web request that identifies a resource, for example, /images/daily-ad.jpg.
- logging_configuration.resource_arn
The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs.
|