Skip to content

Commit 60f4ec9

Browse files
committed
Add WAF updates
1 parent 19c144e commit 60f4ec9

File tree

2 files changed

+147
-12
lines changed

2 files changed

+147
-12
lines changed

services/waf/src/main/resources/codegen-resources/waf-regional/service-2.json

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -906,7 +906,8 @@
906906
"errors":[
907907
{"shape":"WAFInternalErrorException"},
908908
{"shape":"WAFInvalidAccountException"},
909-
{"shape":"WAFNonexistentItemException"}
909+
{"shape":"WAFNonexistentItemException"},
910+
{"shape":"WAFInvalidParameterException"}
910911
],
911912
"documentation":"<p>Returns an array of resources associated with the specified web ACL.</p>"
912913
},
@@ -1018,9 +1019,10 @@
10181019
"errors":[
10191020
{"shape":"WAFInternalErrorException"},
10201021
{"shape":"WAFNonexistentItemException"},
1021-
{"shape":"WAFStaleDataException"}
1022+
{"shape":"WAFStaleDataException"},
1023+
{"shape":"WAFServiceLinkedRoleErrorException"}
10221024
],
1023-
"documentation":"<p>Associates a <a>LoggingConfiguration</a> with a specified web ACL.</p> <p>You can access information about all traffic that AWS WAF inspects using the following steps:</p> <ol> <li> <p>Create an Amazon Kinesis Data Firehose delivery stream. For more information, see <a href=\"https://docs.aws.amazon.com/firehose/latest/dev/what-is-this-service.html\">Creating an Amazon Kinesis Data Firehose Delivery Stream</a>. </p> </li> <li> <p>Associate that delivery stream to your web ACL using a <code>PutLoggingConfiguration</code> request.</p> </li> </ol> <p>When you successfully enable logging using a <code>PutLoggingConfiguration</code> request, AWS WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose delivery stream. For more information, see <a href=\"http://docs.aws.amazon.com/waf/latest/developerguide/logging.html\">Logging Web ACL Traffic Information</a> in the <i>AWS WAF Developer Guide</i>.</p>"
1025+
"documentation":"<p>Associates a <a>LoggingConfiguration</a> with a specified web ACL.</p> <p>You can access information about all traffic that AWS WAF inspects using the following steps:</p> <ol> <li> <p>Create an Amazon Kinesis Data Firehose . </p> </li> <li> <p>Associate that firehose to your web ACL using a <code>PutLoggingConfiguration</code> request.</p> </li> </ol> <p>When you successfully enable logging using a <code>PutLoggingConfiguration</code> request, AWS WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose. For more information, see <a href=\"http://docs.aws.amazon.com/waf/latest/developerguide/logging.html\">Logging Web ACL Traffic Information</a> in the <i>AWS WAF Developer Guide</i>.</p>"
10241026
},
10251027
"PutPermissionPolicy":{
10261028
"name":"PutPermissionPolicy",
@@ -3363,6 +3365,10 @@
33633365
"WebACLId":{
33643366
"shape":"ResourceId",
33653367
"documentation":"<p>The unique identifier (ID) of the web ACL for which to list the associated resources.</p>"
3368+
},
3369+
"ResourceType":{
3370+
"shape":"ResourceType",
3371+
"documentation":"<p>The type of resource to list, either and application load balancer or Amazon API Gateway.</p>"
33663372
}
33673373
}
33683374
},
@@ -3580,14 +3586,14 @@
35803586
},
35813587
"LogDestinationConfigs":{
35823588
"shape":"LogDestinationConfigs",
3583-
"documentation":"<p>An array of Amazon Kinesis Data Firehose delivery stream ARNs.</p>"
3589+
"documentation":"<p>An array of Amazon Kinesis Data Firehose ARNs.</p>"
35843590
},
35853591
"RedactedFields":{
35863592
"shape":"RedactedFields",
3587-
"documentation":"<p>The parts of the request that you want redacted from the logs. For example, if you redact the cookie field, the cookie field in the delivery stream will be <code>xxx</code>. </p>"
3593+
"documentation":"<p>The parts of the request that you want redacted from the logs. For example, if you redact the cookie field, the cookie field in the firehose will be <code>xxx</code>. </p>"
35883594
}
35893595
},
3590-
"documentation":"<p>The Amazon Kinesis Data Firehose delivery streams, <code>RedactedFields</code> information, and the web ACL Amazon Resource Name (ARN).</p>"
3596+
"documentation":"<p>The Amazon Kinesis Data Firehose, <code>RedactedFields</code> information, and the web ACL Amazon Resource Name (ARN).</p>"
35913597
},
35923598
"LoggingConfigurations":{
35933599
"type":"list",
@@ -3713,7 +3719,7 @@
37133719
"members":{
37143720
"LoggingConfiguration":{
37153721
"shape":"LoggingConfiguration",
3716-
"documentation":"<p>The Amazon Kinesis Data Firehose delivery streams that contains the inspected traffic information, the redacted fields details, and the Amazon Resource Name (ARN) of the web ACL to monitor.</p>"
3722+
"documentation":"<p>The Amazon Kinesis Data Firehose that contains the inspected traffic information, the redacted fields details, and the Amazon Resource Name (ARN) of the web ACL to monitor.</p>"
37173723
}
37183724
}
37193725
},
@@ -3982,6 +3988,13 @@
39823988
"max":128,
39833989
"min":1
39843990
},
3991+
"ResourceType":{
3992+
"type":"string",
3993+
"enum":[
3994+
"APPLICATION_LOAD_BALANCER",
3995+
"API_GATEWAY"
3996+
]
3997+
},
39853998
"Rule":{
39863999
"type":"structure",
39874000
"required":[
@@ -4888,6 +4901,14 @@
48884901
"documentation":"<p>The operation failed because you tried to delete an object that is still in use. For example:</p> <ul> <li> <p>You tried to delete a <code>ByteMatchSet</code> that is still referenced by a <code>Rule</code>.</p> </li> <li> <p>You tried to delete a <code>Rule</code> that is still referenced by a <code>WebACL</code>.</p> </li> </ul>",
48894902
"exception":true
48904903
},
4904+
"WAFServiceLinkedRoleErrorException":{
4905+
"type":"structure",
4906+
"members":{
4907+
"message":{"shape":"errorMessage"}
4908+
},
4909+
"documentation":"<p>AWS WAF is not able to access the service linked role. This can be caused by a previous <code>PutLoggingConfiguration</code> request, which can lock the service linked role for about 20 seconds. Please try your request again. The service linked role can also be locked by a previous <code>DeleteServiceLinkedRole</code> request, which can lock the role for 15 minutes or more. If you recently made a <code>DeleteServiceLinkedRole</code>, wait at least 15 minutes and try the request again. If you receive this same exception again, you will have to wait additional time until the role is unlocked.</p>",
4910+
"exception":true
4911+
},
48914912
"WAFStaleDataException":{
48924913
"type":"structure",
48934914
"members":{
@@ -4984,6 +5005,10 @@
49845005
"Rules":{
49855006
"shape":"ActivatedRules",
49865007
"documentation":"<p>An array that contains the action for each <code>Rule</code> in a <code>WebACL</code>, the priority of the <code>Rule</code>, and the ID of the <code>Rule</code>.</p>"
5008+
},
5009+
"WebACLArn":{
5010+
"shape":"ResourceArn",
5011+
"documentation":"<p>Tha Amazon Resource Name (ARN) of the web ACL.</p>"
49875012
}
49885013
},
49895014
"documentation":"<p>Contains the <code>Rules</code> that identify the requests that you want to allow, block, or count. In a <code>WebACL</code>, you also specify a default action (<code>ALLOW</code> or <code>BLOCK</code>), and the action for each <code>Rule</code> that you add to a <code>WebACL</code>, for example, block requests from specified IP addresses or block requests from specified referrers. You also associate the <code>WebACL</code> with a CloudFront distribution to identify the requests that you want AWS WAF to filter. If you add more than one <code>Rule</code> to a <code>WebACL</code>, a request needs to match only one of the specifications to be allowed, blocked, or counted. For more information, see <a>UpdateWebACL</a>.</p>"

services/waf/src/main/resources/codegen-resources/waf/service-2.json

Lines changed: 115 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1256,6 +1256,28 @@
12561256
"type":"list",
12571257
"member":{"shape":"ActivatedRule"}
12581258
},
1259+
"AssociateWebACLRequest":{
1260+
"type":"structure",
1261+
"required":[
1262+
"WebACLId",
1263+
"ResourceArn"
1264+
],
1265+
"members":{
1266+
"WebACLId":{
1267+
"shape":"ResourceId",
1268+
"documentation":"<p>A unique identifier (ID) for the web ACL.</p>"
1269+
},
1270+
"ResourceArn":{
1271+
"shape":"ResourceArn",
1272+
"documentation":"<p>The ARN (Amazon Resource Name) of the resource to be protected.</p>"
1273+
}
1274+
}
1275+
},
1276+
"AssociateWebACLResponse":{
1277+
"type":"structure",
1278+
"members":{
1279+
}
1280+
},
12591281
"ByteMatchSet":{
12601282
"type":"structure",
12611283
"required":[
@@ -2132,6 +2154,21 @@
21322154
},
21332155
"documentation":"<p>The response to a request to delete an <a>XssMatchSet</a> from AWS WAF.</p>"
21342156
},
2157+
"DisassociateWebACLRequest":{
2158+
"type":"structure",
2159+
"required":["ResourceArn"],
2160+
"members":{
2161+
"ResourceArn":{
2162+
"shape":"ResourceArn",
2163+
"documentation":"<p>The ARN (Amazon Resource Name) of the resource from which the web ACL is being removed.</p>"
2164+
}
2165+
}
2166+
},
2167+
"DisassociateWebACLResponse":{
2168+
"type":"structure",
2169+
"members":{
2170+
}
2171+
},
21352172
"FieldToMatch":{
21362173
"type":"structure",
21372174
"required":["Type"],
@@ -2833,6 +2870,25 @@
28332870
},
28342871
"documentation":"<p>The response to a <a>GetSqlInjectionMatchSet</a> request.</p>"
28352872
},
2873+
"GetWebACLForResourceRequest":{
2874+
"type":"structure",
2875+
"required":["ResourceArn"],
2876+
"members":{
2877+
"ResourceArn":{
2878+
"shape":"ResourceArn",
2879+
"documentation":"<p>The ARN (Amazon Resource Name) of the resource for which to get the web ACL.</p>"
2880+
}
2881+
}
2882+
},
2883+
"GetWebACLForResourceResponse":{
2884+
"type":"structure",
2885+
"members":{
2886+
"WebACLSummary":{
2887+
"shape":"WebACLSummary",
2888+
"documentation":"<p>Information about the web ACL that you specified in the <code>GetWebACLForResource</code> request. If there is no associated resource, a null WebACLSummary is returned.</p>"
2889+
}
2890+
}
2891+
},
28362892
"GetWebACLRequest":{
28372893
"type":"structure",
28382894
"required":["WebACLId"],
@@ -3235,6 +3291,29 @@
32353291
}
32363292
}
32373293
},
3294+
"ListResourcesForWebACLRequest":{
3295+
"type":"structure",
3296+
"required":["WebACLId"],
3297+
"members":{
3298+
"WebACLId":{
3299+
"shape":"ResourceId",
3300+
"documentation":"<p>The unique identifier (ID) of the web ACL for which to list the associated resources.</p>"
3301+
},
3302+
"ResourceType":{
3303+
"shape":"ResourceType",
3304+
"documentation":"<p>The type of resource to list, either and application load balancer or Amazon API Gateway.</p>"
3305+
}
3306+
}
3307+
},
3308+
"ListResourcesForWebACLResponse":{
3309+
"type":"structure",
3310+
"members":{
3311+
"ResourceArns":{
3312+
"shape":"ResourceArns",
3313+
"documentation":"<p>An array of ARNs (Amazon Resource Names) of the resources associated with the specified web ACL. An array with zero elements is returned if there are no resources associated with the web ACL.</p>"
3314+
}
3315+
}
3316+
},
32383317
"ListRuleGroupsRequest":{
32393318
"type":"structure",
32403319
"members":{
@@ -3440,14 +3519,14 @@
34403519
},
34413520
"LogDestinationConfigs":{
34423521
"shape":"LogDestinationConfigs",
3443-
"documentation":"<p>An array of Amazon Kinesis Data Firehose delivery stream ARNs.</p>"
3522+
"documentation":"<p>An array of Amazon Kinesis Data Firehose ARNs.</p>"
34443523
},
34453524
"RedactedFields":{
34463525
"shape":"RedactedFields",
3447-
"documentation":"<p>The parts of the request that you want redacted from the logs. For example, if you redact the cookie field, the cookie field in the delivery stream will be <code>xxx</code>. </p>"
3526+
"documentation":"<p>The parts of the request that you want redacted from the logs. For example, if you redact the cookie field, the cookie field in the firehose will be <code>xxx</code>. </p>"
34483527
}
34493528
},
3450-
"documentation":"<p>The Amazon Kinesis Data Firehose delivery streams, <code>RedactedFields</code> information, and the web ACL Amazon Resource Name (ARN).</p>"
3529+
"documentation":"<p>The Amazon Kinesis Data Firehose, <code>RedactedFields</code> information, and the web ACL Amazon Resource Name (ARN).</p>"
34513530
},
34523531
"LoggingConfigurations":{
34533532
"type":"list",
@@ -3573,7 +3652,7 @@
35733652
"members":{
35743653
"LoggingConfiguration":{
35753654
"shape":"LoggingConfiguration",
3576-
"documentation":"<p>The Amazon Kinesis Data Firehose delivery streams that contains the inspected traffic information, the redacted fields details, and the Amazon Resource Name (ARN) of the web ACL to monitor.</p>"
3655+
"documentation":"<p>The Amazon Kinesis Data Firehose that contains the inspected traffic information, the redacted fields details, and the Amazon Resource Name (ARN) of the web ACL to monitor.</p>"
35773656
}
35783657
}
35793658
},
@@ -3828,6 +3907,10 @@
38283907
"max":1224,
38293908
"min":1
38303909
},
3910+
"ResourceArns":{
3911+
"type":"list",
3912+
"member":{"shape":"ResourceArn"}
3913+
},
38313914
"ResourceId":{
38323915
"type":"string",
38333916
"max":128,
@@ -3838,6 +3921,13 @@
38383921
"max":128,
38393922
"min":1
38403923
},
3924+
"ResourceType":{
3925+
"type":"string",
3926+
"enum":[
3927+
"APPLICATION_LOAD_BALANCER",
3928+
"API_GATEWAY"
3929+
]
3930+
},
38413931
"Rule":{
38423932
"type":"structure",
38433933
"required":[
@@ -4744,6 +4834,14 @@
47444834
"documentation":"<p>The operation failed because you tried to delete an object that is still in use. For example:</p> <ul> <li> <p>You tried to delete a <code>ByteMatchSet</code> that is still referenced by a <code>Rule</code>.</p> </li> <li> <p>You tried to delete a <code>Rule</code> that is still referenced by a <code>WebACL</code>.</p> </li> </ul>",
47454835
"exception":true
47464836
},
4837+
"WAFServiceLinkedRoleErrorException":{
4838+
"type":"structure",
4839+
"members":{
4840+
"message":{"shape":"errorMessage"}
4841+
},
4842+
"documentation":"<p>AWS WAF is not able to access the service linked role. This can be caused by a previous <code>PutLoggingConfiguration</code> request, which can lock the service linked role for about 20 seconds. Please try your request again. The service linked role can also be locked by a previous <code>DeleteServiceLinkedRole</code> request, which can lock the role for 15 minutes or more. If you recently made a <code>DeleteServiceLinkedRole</code>, wait at least 15 minutes and try the request again. If you receive this same exception again, you will have to wait additional time until the role is unlocked.</p>",
4843+
"exception":true
4844+
},
47474845
"WAFStaleDataException":{
47484846
"type":"structure",
47494847
"members":{
@@ -4760,6 +4858,14 @@
47604858
"documentation":"<p>The specified subscription does not exist.</p>",
47614859
"exception":true
47624860
},
4861+
"WAFUnavailableEntityException":{
4862+
"type":"structure",
4863+
"members":{
4864+
"message":{"shape":"errorMessage"}
4865+
},
4866+
"documentation":"<p>The operation failed because the entity referenced is temporarily unavailable. Retry your request.</p>",
4867+
"exception":true
4868+
},
47634869
"WafAction":{
47644870
"type":"structure",
47654871
"required":["Type"],
@@ -4832,6 +4938,10 @@
48324938
"Rules":{
48334939
"shape":"ActivatedRules",
48344940
"documentation":"<p>An array that contains the action for each <code>Rule</code> in a <code>WebACL</code>, the priority of the <code>Rule</code>, and the ID of the <code>Rule</code>.</p>"
4941+
},
4942+
"WebACLArn":{
4943+
"shape":"ResourceArn",
4944+
"documentation":"<p>Tha Amazon Resource Name (ARN) of the web ACL.</p>"
48354945
}
48364946
},
48374947
"documentation":"<p>Contains the <code>Rules</code> that identify the requests that you want to allow, block, or count. In a <code>WebACL</code>, you also specify a default action (<code>ALLOW</code> or <code>BLOCK</code>), and the action for each <code>Rule</code> that you add to a <code>WebACL</code>, for example, block requests from specified IP addresses or block requests from specified referrers. You also associate the <code>WebACL</code> with a CloudFront distribution to identify the requests that you want AWS WAF to filter. If you add more than one <code>Rule</code> to a <code>WebACL</code>, a request needs to match only one of the specifications to be allowed, blocked, or counted. For more information, see <a>UpdateWebACL</a>.</p>"
@@ -4971,5 +5081,5 @@
49715081
},
49725082
"errorMessage":{"type":"string"}
49735083
},
4974-
"documentation":"<p>This is the <i>AWS WAF API Reference</i> for using AWS WAF with Amazon CloudFront. The AWS WAF actions and data types listed in the reference are available for protecting Amazon CloudFront distributions. You can use these actions and data types via the endpoint <i>waf.amazonaws.com</i>. This guide is for developers who need detailed information about the AWS WAF API actions, data types, and errors. For detailed information about AWS WAF features and an overview of how to use the AWS WAF API, see the <a href=\"http://docs.aws.amazon.com/waf/latest/developerguide/\">AWS WAF Developer Guide</a>.</p>"
5084+
"documentation":"<p>This is the <i>AWS WAF Regional API Reference</i> for using AWS WAF with Elastic Load Balancing (ELB) Application Load Balancers. The AWS WAF actions and data types listed in the reference are available for protecting Application Load Balancers. You can use these actions and data types by means of the endpoints listed in <a href=\"http://docs.aws.amazon.com/general/latest/gr/rande.html#waf_region\">AWS Regions and Endpoints</a>. This guide is for developers who need detailed information about the AWS WAF API actions, data types, and errors. For detailed information about AWS WAF features and an overview of how to use the AWS WAF API, see the <a href=\"http://docs.aws.amazon.com/waf/latest/developerguide/\">AWS WAF Developer Guide</a>.</p>"
49755085
}

0 commit comments

Comments
 (0)