Label match rule statement - Amazon WAF, Amazon Firewall Manager, Amazon Shield Advanced, and Amazon Shield network security director
Rule statement characteristicsWhere to find this rule statement
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Introducing a new console experience for Amazon WAF

You can now use the updated experience to access Amazon WAF functionality anywhere in the console. For more details, see Working with the updated console experience.

Label match rule statement

This section explains what a label match statement is and how it works.

The label match statement inspects the labels that are on the web request against a string specification. The labels that are available to a rule for inspection are those that have already been added to the web request by other rules in the same protection pack or web ACL evaluation.

Labels don't persist outside of the protection pack or web ACL evaluation, but you can access label metrics in CloudWatch and you can see summaries of label information for any protection pack or web ACL in the Amazon WAF console. For more information, see Label metrics and dimensions and Monitoring and tuning your Amazon WAF protections. You can also see labels in the logs. For information, see Log fields for protection pack or web ACL traffic.

Note

A label match statement can only see labels from rules that are evaluated earlier in the protection pack or web ACL. For information about how Amazon WAF evaluates the rules and rule groups in a protection pack or web ACL, see Setting rule priority.

For more information about adding and matching labels, see Web request labeling in Amazon WAF.

Rule statement characteristics

Nestable – You can nest this statement type.

WCUs – 1 WCU

This statement uses the following settings:

  • Match scope – Set this to Label to match against the label name and, optionally, the preceding namespaces and prefix. Set this to Namespace to match against some or all of the namespace specifications and, optionally, the preceding prefix.

  • Key – The string that you want to match against. If you specify a namespace match scope, this should only specify namespaces and optionally the prefix, with an ending colon. If you specify a label match scope, this must include the label name and can optionally include preceding namespaces and prefix.

For more information about these settings, see Amazon WAF rules that match labels and Amazon WAF label match examples.

Where to find this rule statement

  • Rule builder on the console – For Request option, choose Has label.

  • API – LabelMatchStatement