Using match rule statements in Amazon WAF
This section explains what a match statement is and how it works.
Match statements compare the web request or its origin against criteria that you provide. For many statements of this type, Amazon WAF compares a specific component of the request for matching content.
Match statements are nestable. You can nest any of these statements inside logical rule statements and you can use them in scope-down statements. For information about logical rule statements, see Using logical rule statements in Amazon WAF. For information about scope-down statements, see Using scope-down statements in Amazon WAF.
This table describes the regular match statements that you can add to a rule and provides some guidelines for calculating web ACL capacity units (WCU) usage for each. For information about WCUs, see Web ACL capacity units (WCUs) in Amazon WAF.
Match Statement |
Description |
WCUs |
---|---|---|
Inspects the request's country of origin and applies labels for the country and region of origin. |
1 |
|
Inspects the request against a set of IP addresses and address ranges. |
1 for most cases. If you configure the statement to use a header with forwarded IP addresses and specify a position in the header of Any, then increase the WCUs by 4. |
|
Inspects the request for labels that have been added by other rules in the same web ACL. |
1 |
|
Compares a regex pattern against a specified request component. |
3, as a base cost. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |
|
Compares regex patterns against a specified request component. |
25 per pattern set, as a base cost. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |
|
Checks size constraints against a specified request component. |
1, as a base cost. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |
|
Inspects for malicious SQL code in a specified request component. |
20, as a base cost. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |
|
Compares a string to a specified request component. |
The base cost depends on the type of string match and is between 1 and 10. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |
|
Inspects for cross-site scripting attacks in a specified request component. |
40, as a base cost. If you use the request component All query parameters, add 10 WCUs. If you use the request component JSON body, double the base cost WCUs. For each Text transformation that you apply, add 10 WCUs. |