AWS::WAF::ByteMatchSet
Note
This is Amazon WAF Classic documentation. For more information, see Amazon WAF Classic in the developer guide.
For the latest version of Amazon WAF, use the Amazon WAFV2 API and see the Amazon WAF Developer Guide. With the latest version, Amazon WAF has a single set of endpoints for regional and global use.
The AWS::WAF::ByteMatchSet
resource creates an Amazon WAFByteMatchSet
that identifies a part of a web request that you want to inspect.
Syntax
To declare this entity in your Amazon CloudFormation template, use the following syntax:
JSON
{ "Type" : "AWS::WAF::ByteMatchSet", "Properties" : { "ByteMatchTuples" :
[ ByteMatchTuple, ... ]
, "Name" :String
} }
YAML
Type: AWS::WAF::ByteMatchSet Properties: ByteMatchTuples:
- ByteMatchTuple
Name:String
Properties
ByteMatchTuples
-
Specifies the bytes (typically a string that corresponds with ASCII characters) that you want Amazon WAF to search for in web requests, the location in requests that you want Amazon WAF to search, and other settings.
Required: No
Type: Array of ByteMatchTuple
Update requires: No interruption
Name
-
The name of the
ByteMatchSet
. You can't changeName
after you create aByteMatchSet
.Required: Yes
Type: String
Pattern:
.*\S.*
Minimum:
1
Maximum:
128
Update requires: Replacement
Return values
Ref
When you pass the logical ID of this resource to the intrinsic Ref
function, Ref
returns the resource physical ID, such as 1234a1a-a1b1-12a1-abcd-a123b123456.
For more information about using the Ref
function, see Ref
.
Fn::GetAtt
Examples
HTTP Referers
The following example defines a set of HTTP referers to match.
JSON
"BadReferers": { "Type": "AWS::WAF::ByteMatchSet", "Properties": { "Name": "ByteMatch for matching bad HTTP referers", "ByteMatchTuples": [ { "FieldToMatch" : { "Type": "HEADER", "Data": "referer" }, "TargetString" : "badrefer1", "TextTransformation" : "NONE", "PositionalConstraint" : "CONTAINS" }, { "FieldToMatch" : { "Type": "HEADER", "Data": "referer" }, "TargetString" : "badrefer2", "TextTransformation" : "NONE", "PositionalConstraint" : "CONTAINS" } ] } }
YAML
BadReferers: Type: "AWS::WAF::ByteMatchSet" Properties: Name: "ByteMatch for matching bad HTTP referers" ByteMatchTuples: - FieldToMatch: Type: "HEADER" Data: "referer" TargetString: "badrefer1" TextTransformation: "NONE" PositionalConstraint: "CONTAINS" - FieldToMatch: Type: "HEADER" Data: "referer" TargetString: "badrefer2" TextTransformation: "NONE" PositionalConstraint: "CONTAINS"
Associate a ByteMatchSet with a Web ACL Rule
The following example associates the BadReferers
byte match set with a
web access control list (ACL) rule.
JSON
"BadReferersRule" : { "Type": "AWS::WAF::Rule", "Properties": { "Name": "BadReferersRule", "MetricName" : "BadReferersRule", "Predicates": [ { "DataId" : { "Ref" : "BadReferers" }, "Negated" : false, "Type" : "ByteMatch" } ] } }
YAML
BadReferersRule: Type: "AWS::WAF::Rule" Properties: Name: "BadReferersRule" MetricName: "BadReferersRule" Predicates: - DataId: Ref: "BadReferers" Negated: false Type: "ByteMatch"
Create a Web ACL
The following example associates the BadReferersRule
rule with a web
ACL. The web ACL allows all requests except for ones with referers that match the
BadReferersRule
rule.
JSON
"MyWebACL": { "Type": "AWS::WAF::WebACL", "Properties": { "Name": "WebACL to block IP addresses", "DefaultAction": { "Type": "ALLOW" }, "MetricName" : "MyWebACL", "Rules": [ { "Action" : { "Type" : "BLOCK" }, "Priority" : 1, "RuleId" : { "Ref" : "BadReferersRule" } } ] } }
YAML
MyWebACL: Type: "AWS::WAF::WebACL" Properties: Name: "WebACL to block IP addresses" DefaultAction: Type: "ALLOW" MetricName: "MyWebACL" Rules: - Action: Type: "BLOCK" Priority: 1 RuleId: Ref: "BadReferersRule"