View a markdown version of this page

AWS::WAFv2::WebACL AssociationConfig - Amazon CloudFormation
SyntaxProperties
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This is the new Amazon CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the Amazon CloudFormation User Guide.

AWS::WAFv2::WebACL AssociationConfig

Specifies custom configurations for the associations between the web ACL and protected resources.

Use this to customize the maximum size of the request body that your protected resources forward to Amazon WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).

Note

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see Amazon WAF Pricing.

For Application Load Balancer and Amazon AppSync, the limit is fixed at 8 KB (8,192 bytes).

You can also use this to have your CloudFront distributions insert the Amazon WAF challenge JavaScript SDK into the HTML responses that they return. For more information, see the ChallengeJavascriptSdkInjection setting.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "ChallengeJavascriptSdkInjection" : Json,
  "RequestBody" : {Key: Value, ...}
}

Properties

ChallengeJavascriptSdkInjection

Specifies the CloudFront distributions that insert the Amazon WAF challenge JavaScript SDK into the HTML responses that they return. When you enable this setting for a distribution, you do not add the SDK to your web pages yourself.

You can configure this setting only for CloudFront distributions, using the CLOUDFRONT map key. Amazon WAF rejects any other resource type, and the setting is not available for regional resources. To configure it, use the CloudFront scope.

Your web ACL must also contain at least one of the following qualifying managed rule groups. Amazon WAF Bot Control qualifies only at the TARGETED inspection level, not at COMMON:

  • The Amazon WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet, with the inspection level set to TARGETED.

  • The Amazon WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet.

  • The Amazon WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet.

If you remove the last qualifying managed rule group from the web ACL, or lower the Amazon WAF Bot Control inspection level from TARGETED to COMMON, you must remove this setting in the same update. Otherwise, Amazon WAF rejects the update.

Example JSON: { "CLOUDFRONT": {} }

If you omit this setting, CloudFront does not insert the SDK. When you omit it from a web ACL that previously used it, cached HTML that already contains the SDK is still served until it expires, or until you invalidate the cache for that distribution. For more information, see Automatic SDK integration for CloudFront distributions in the Amazon WAF Developer Guide.

Required: No

Type: Json

Pattern: ^(CLOUDFRONT)$

Update requires: No interruption

RequestBody

Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to Amazon WAF for inspection. The default size is 16 KB (16,384 bytes). You can change the setting for any of the available resource types.

Note

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see Amazon WAF Pricing.

Example JSON: { "API_GATEWAY": "KB_48", "APP_RUNNER_SERVICE": "KB_32" }

For Application Load Balancer and Amazon AppSync, the limit is fixed at 8 KB (8,192 bytes).

Required: No

Type: Object of RequestBodyAssociatedResourceTypeConfig

Update requires: No interruption