Label match rule statement
The label match statement inspects the labels that are on the web request against a string specification. The labels that are available to a rule for inspection are those that have already been added to the web request by other rules in the same web ACL evaluation.
Labels don't persist outside of the web ACL evaluation, but you can access label metrics in CloudWatch and you can see summaries of label information for any web ACL in the Amazon WAF console. For more information, see Label metrics and dimensions and Monitoring and tuning. You can also see labels in the logs. For information, see Log fields.
Note
A label match statement can only see labels from rules that are evaluated earlier in the web ACL. For information about how Amazon WAF evaluates the rules and rule groups in a web ACL, see Processing order of rules and rule groups in a web ACL.
For more information about adding and matching labels, see Amazon WAF labels on web requests.
Nestable – You can nest this statement type.
WCUs – 1 WCU
This statement uses the following settings:
-
Match scope – Set this to Label to match against the label name and, optionally, the preceding namespaces and prefix. Set this to Namespace to match against some or all of the namespace specifications and, optionally, the preceding prefix.
-
Key – The string that you want to match against. If you specify a namespace match scope, this should only specify namespaces and optionally the prefix, with an ending colon. If you specify a label match scope, this must include the label name and can optionally include preceding namespaces and prefix.
For more information about these settings, see Amazon WAF rules that match labels and Amazon WAF label match examples.
Where to find this rule statement
-
Rule builder on the console – For Request option, choose Has label.
-
API – LabelMatchStatement