Skip to content

Commit 04209f9

Browse files
author
awstools
committed
feat(client-wafv2): The WAFv2 API now supports configuring data protection in webACLs.
1 parent 5b15ad8 commit 04209f9

19 files changed

+576
-150
lines changed

‎clients/client-wafv2/README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
AWS SDK for JavaScript WAFV2 Client for Node.js, Browser and React Native.
88

9-
<fullname>WAF</fullname>
9+
<fullname>WAF </fullname>
1010
<note>
1111

1212
<p>This is the latest version of the <b>WAF</b> API,
@@ -20,8 +20,8 @@ WAF resources that you created before. WAF Classic support will end on September
2020
see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
2121
</note>
2222
<p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
23-
requests that are forwarded to an Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
24-
GraphQL API, Amazon Cognito user pool, App Runner service, or Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
23+
requests that are forwarded to a protected resource. Protected resource types include Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
24+
GraphQL API, Amazon Cognito user pool, App Runner service, and Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
2525
to protect the Amazon Web Services resource that WAF is monitoring. Based on conditions that
2626
you specify, such as the IP addresses that requests originate from or the values of query
2727
strings, the protected resource responds to requests with either the requested content, an HTTP 403 status code
@@ -33,11 +33,11 @@ Guide</a>.</p>
3333
<p>You can make calls using the endpoints listed in <a href="https://docs.aws.amazon.com/general/latest/gr/waf.html">WAF endpoints and quotas</a>. </p>
3434
<ul>
3535
<li>
36-
<p>For regional applications, you can use any of the endpoints in the list.
36+
<p>For regional resources, you can use any of the endpoints in the list.
3737
A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
3838
</li>
3939
<li>
40-
<p>For Amazon CloudFront applications, you must use the API endpoint listed for
40+
<p>For Amazon CloudFront, you must use the API endpoint listed for
4141
US East (N. Virginia): us-east-1.</p>
4242
</li>
4343
</ul>

‎clients/client-wafv2/src/WAFV2.ts

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1100,7 +1100,7 @@ export interface WAFV2 {
11001100
}
11011101

11021102
/**
1103-
* <fullname>WAF</fullname>
1103+
* <fullname>WAF </fullname>
11041104
* <note>
11051105
* <p>This is the latest version of the <b>WAF</b> API,
11061106
* released in November, 2019. The names of the entities that you use to access this API,
@@ -1113,8 +1113,8 @@ export interface WAFV2 {
11131113
* see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
11141114
* </note>
11151115
* <p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
1116-
* requests that are forwarded to an Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
1117-
* GraphQL API, Amazon Cognito user pool, App Runner service, or Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
1116+
* requests that are forwarded to a protected resource. Protected resource types include Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
1117+
* GraphQL API, Amazon Cognito user pool, App Runner service, and Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
11181118
* to protect the Amazon Web Services resource that WAF is monitoring. Based on conditions that
11191119
* you specify, such as the IP addresses that requests originate from or the values of query
11201120
* strings, the protected resource responds to requests with either the requested content, an HTTP 403 status code
@@ -1126,11 +1126,11 @@ export interface WAFV2 {
11261126
* <p>You can make calls using the endpoints listed in <a href="https://docs.aws.amazon.com/general/latest/gr/waf.html">WAF endpoints and quotas</a>. </p>
11271127
* <ul>
11281128
* <li>
1129-
* <p>For regional applications, you can use any of the endpoints in the list.
1129+
* <p>For regional resources, you can use any of the endpoints in the list.
11301130
* A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
11311131
* </li>
11321132
* <li>
1133-
* <p>For Amazon CloudFront applications, you must use the API endpoint listed for
1133+
* <p>For Amazon CloudFront, you must use the API endpoint listed for
11341134
* US East (N. Virginia): us-east-1.</p>
11351135
* </li>
11361136
* </ul>

‎clients/client-wafv2/src/WAFV2Client.ts

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,7 @@ export type WAFV2ClientResolvedConfigType = __SmithyResolvedConfiguration<__Http
508508
export interface WAFV2ClientResolvedConfig extends WAFV2ClientResolvedConfigType {}
509509

510510
/**
511-
* <fullname>WAF</fullname>
511+
* <fullname>WAF </fullname>
512512
* <note>
513513
* <p>This is the latest version of the <b>WAF</b> API,
514514
* released in November, 2019. The names of the entities that you use to access this API,
@@ -521,8 +521,8 @@ export interface WAFV2ClientResolvedConfig extends WAFV2ClientResolvedConfigType
521521
* see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
522522
* </note>
523523
* <p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
524-
* requests that are forwarded to an Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
525-
* GraphQL API, Amazon Cognito user pool, App Runner service, or Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
524+
* requests that are forwarded to a protected resource. Protected resource types include Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync
525+
* GraphQL API, Amazon Cognito user pool, App Runner service, and Amazon Web Services Verified Access instance. WAF also lets you control access to your content,
526526
* to protect the Amazon Web Services resource that WAF is monitoring. Based on conditions that
527527
* you specify, such as the IP addresses that requests originate from or the values of query
528528
* strings, the protected resource responds to requests with either the requested content, an HTTP 403 status code
@@ -534,11 +534,11 @@ export interface WAFV2ClientResolvedConfig extends WAFV2ClientResolvedConfigType
534534
* <p>You can make calls using the endpoints listed in <a href="https://docs.aws.amazon.com/general/latest/gr/waf.html">WAF endpoints and quotas</a>. </p>
535535
* <ul>
536536
* <li>
537-
* <p>For regional applications, you can use any of the endpoints in the list.
537+
* <p>For regional resources, you can use any of the endpoints in the list.
538538
* A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
539539
* </li>
540540
* <li>
541-
* <p>For Amazon CloudFront applications, you must use the API endpoint listed for
541+
* <p>For Amazon CloudFront, you must use the API endpoint listed for
542542
* US East (N. Virginia): us-east-1.</p>
543543
* </li>
544544
* </ul>

‎clients/client-wafv2/src/commands/AssociateWebACLCommand.ts

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,8 @@ export interface AssociateWebACLCommandInput extends AssociateWebACLRequest {}
2828
export interface AssociateWebACLCommandOutput extends AssociateWebACLResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Associates a web ACL with a regional application resource, to protect the resource.
32-
* A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
33-
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
34-
* associate a web ACL, in the CloudFront call <code>UpdateDistribution</code>, set the web ACL ID
35-
* to the Amazon Resource Name (ARN) of the web ACL. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a> in the <i>Amazon CloudFront Developer Guide</i>. </p>
31+
* <p>Associates a web ACL with a resource, to protect the resource. </p>
32+
* <p>Use this for all resource types except for Amazon CloudFront distributions. For Amazon CloudFront, call <code>UpdateDistribution</code> for the distribution and provide the Amazon Resource Name (ARN) of the web ACL in the web ACL ID. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a> in the <i>Amazon CloudFront Developer Guide</i>. </p>
3633
* <p>
3734
* <b>Required permissions for customer-managed IAM policies</b>
3835
* </p>
@@ -117,7 +114,7 @@ export interface AssociateWebACLCommandOutput extends AssociateWebACLResponse, _
117114
* <p>WAF couldn’t retrieve a resource that you specified for this operation.
118115
* If you've just created a resource that you're using in this operation, you might
119116
* just need to wait a few minutes. It can take from a few seconds to a number of minutes
120-
* for changes to propagate. Verify the resources that you are specifying in your request
117+
* for changes to propagate. Verify the resource specifications in your request
121118
* parameters and then retry the operation.</p>
122119
*
123120
* @throws {@link WAFV2ServiceException}

‎clients/client-wafv2/src/commands/CheckCapacityCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1071,7 +1071,7 @@ export interface CheckCapacityCommandOutput extends CheckCapacityResponse, __Met
10711071
* <p>WAF couldn’t retrieve a resource that you specified for this operation.
10721072
* If you've just created a resource that you're using in this operation, you might
10731073
* just need to wait a few minutes. It can take from a few seconds to a number of minutes
1074-
* for changes to propagate. Verify the resources that you are specifying in your request
1074+
* for changes to propagate. Verify the resource specifications in your request
10751075
* parameters and then retry the operation.</p>
10761076
*
10771077
* @throws {@link WAFV2ServiceException}

‎clients/client-wafv2/src/commands/CreateRuleGroupCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1094,7 +1094,7 @@ export interface CreateRuleGroupCommandOutput extends CreateRuleGroupResponse, _
10941094
* <p>WAF couldn’t retrieve a resource that you specified for this operation.
10951095
* If you've just created a resource that you're using in this operation, you might
10961096
* just need to wait a few minutes. It can take from a few seconds to a number of minutes
1097-
* for changes to propagate. Verify the resources that you are specifying in your request
1097+
* for changes to propagate. Verify the resource specifications in your request
10981098
* parameters and then retry the operation.</p>
10991099
*
11001100
* @throws {@link WAFV2ServiceException}

‎clients/client-wafv2/src/commands/CreateWebACLCommand.ts

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ export interface CreateWebACLCommandOutput extends CreateWebACLResponse, __Metad
2929

3030
/**
3131
* <p>Creates a <a>WebACL</a> per the specifications provided.</p>
32-
* <p> A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types <a>Rule</a>, <a>RuleGroup</a>, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
32+
* <p> A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types <a>Rule</a>, <a>RuleGroup</a>, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resource types include Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync GraphQL API, Amazon Cognito user pool, App Runner service, and Amazon Web Services Verified Access instance. </p>
3333
* @example
3434
* Use a bare-bones client and the command you need to make an API call.
3535
* ```javascript
@@ -984,6 +984,21 @@ export interface CreateWebACLCommandOutput extends CreateWebACLResponse, __Metad
984984
* CloudWatchMetricsEnabled: true || false, // required
985985
* MetricName: "STRING_VALUE", // required
986986
* },
987+
* DataProtectionConfig: { // DataProtectionConfig
988+
* DataProtections: [ // DataProtections // required
989+
* { // DataProtection
990+
* Field: { // FieldToProtect
991+
* FieldType: "SINGLE_HEADER" || "SINGLE_COOKIE" || "SINGLE_QUERY_ARGUMENT" || "QUERY_STRING" || "BODY", // required
992+
* FieldKeys: [ // FieldToProtectKeys
993+
* "STRING_VALUE",
994+
* ],
995+
* },
996+
* Action: "SUBSTITUTION" || "HASH", // required
997+
* ExcludeRuleMatchDetails: true || false,
998+
* ExcludeRateBasedDetails: true || false,
999+
* },
1000+
* ],
1001+
* },
9871002
* Tags: [ // TagList
9881003
* { // Tag
9891004
* Key: "STRING_VALUE", // required
@@ -1123,7 +1138,7 @@ export interface CreateWebACLCommandOutput extends CreateWebACLResponse, __Metad
11231138
* <p>WAF couldn’t retrieve a resource that you specified for this operation.
11241139
* If you've just created a resource that you're using in this operation, you might
11251140
* just need to wait a few minutes. It can take from a few seconds to a number of minutes
1126-
* for changes to propagate. Verify the resources that you are specifying in your request
1141+
* for changes to propagate. Verify the resource specifications in your request
11271142
* parameters and then retry the operation.</p>
11281143
*
11291144
* @throws {@link WAFV2ServiceException}

‎clients/client-wafv2/src/commands/DeleteWebACLCommand.ts

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,26 +38,26 @@ export interface DeleteWebACLCommandOutput extends DeleteWebACLResponse, __Metad
3838
* following calls:</p>
3939
* <ul>
4040
* <li>
41-
* <p>For regional resources, call <a>ListResourcesForWebACL</a>.</p>
42-
* </li>
43-
* <li>
4441
* <p>For Amazon CloudFront distributions, use the CloudFront call
4542
* <code>ListDistributionsByWebACLId</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html">ListDistributionsByWebACLId</a>
4643
* in the <i>Amazon CloudFront API Reference</i>. </p>
4744
* </li>
45+
* <li>
46+
* <p>For all other resources, call <a>ListResourcesForWebACL</a>.</p>
47+
* </li>
4848
* </ul>
4949
* </li>
5050
* <li>
5151
* <p>To disassociate a resource from a web ACL, use the following calls:</p>
5252
* <ul>
5353
* <li>
54-
* <p>For regional resources, call <a>DisassociateWebACL</a>.</p>
55-
* </li>
56-
* <li>
5754
* <p>For Amazon CloudFront distributions, provide an empty web ACL ID in the CloudFront call
5855
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>
5956
* in the <i>Amazon CloudFront API Reference</i>. </p>
6057
* </li>
58+
* <li>
59+
* <p>For all other resources, call <a>DisassociateWebACL</a>.</p>
60+
* </li>
6161
* </ul>
6262
* </li>
6363
* </ul>

‎clients/client-wafv2/src/commands/DisassociateWebACLCommand.ts

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,9 @@ export interface DisassociateWebACLCommandInput extends DisassociateWebACLReques
2828
export interface DisassociateWebACLCommandOutput extends DisassociateWebACLResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Disassociates the specified regional application resource from any existing web ACL
32-
* association. A resource can have at most one web ACL association. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
33-
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
34-
* disassociate a web ACL, provide an empty web ACL ID in the CloudFront call
35-
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a> in the <i>Amazon CloudFront API Reference</i>. </p>
31+
* <p>Disassociates the specified resource from its web ACL
32+
* association, if it has one. </p>
33+
* <p>Use this for all resource types except for Amazon CloudFront distributions. For Amazon CloudFront, call <code>UpdateDistribution</code> for the distribution and provide an empty web ACL ID. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a> in the <i>Amazon CloudFront API Reference</i>. </p>
3634
* <p>
3735
* <b>Required permissions for customer-managed IAM policies</b>
3836
* </p>

‎clients/client-wafv2/src/commands/GetWebACLCommand.ts

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -992,6 +992,21 @@ export interface GetWebACLCommandOutput extends GetWebACLResponse, __MetadataBea
992992
* // CloudWatchMetricsEnabled: true || false, // required
993993
* // MetricName: "STRING_VALUE", // required
994994
* // },
995+
* // DataProtectionConfig: { // DataProtectionConfig
996+
* // DataProtections: [ // DataProtections // required
997+
* // { // DataProtection
998+
* // Field: { // FieldToProtect
999+
* // FieldType: "SINGLE_HEADER" || "SINGLE_COOKIE" || "SINGLE_QUERY_ARGUMENT" || "QUERY_STRING" || "BODY", // required
1000+
* // FieldKeys: [ // FieldToProtectKeys
1001+
* // "STRING_VALUE",
1002+
* // ],
1003+
* // },
1004+
* // Action: "SUBSTITUTION" || "HASH", // required
1005+
* // ExcludeRuleMatchDetails: true || false,
1006+
* // ExcludeRateBasedDetails: true || false,
1007+
* // },
1008+
* // ],
1009+
* // },
9951010
* // Capacity: Number("long"),
9961011
* // PreProcessFirewallManagerRuleGroups: [ // FirewallManagerRuleGroups
9971012
* // { // FirewallManagerRuleGroup

0 commit comments

Comments
 (0)