Skip to content

Commit 0292fb4

Browse files
author
awstools
committed
feat(client-wafv2): You can now use Security Lake to collect web ACL traffic data.
1 parent 6f0caf6 commit 0292fb4

File tree

6 files changed

+199
-9
lines changed

6 files changed

+199
-9
lines changed

‎clients/client-wafv2/src/commands/DeleteLoggingConfigurationCommand.ts

+2
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ export interface DeleteLoggingConfigurationCommandOutput extends DeleteLoggingCo
3636
* const client = new WAFV2Client(config);
3737
* const input = { // DeleteLoggingConfigurationRequest
3838
* ResourceArn: "STRING_VALUE", // required
39+
* LogType: "WAF_LOGS",
40+
* LogScope: "CUSTOMER" || "SECURITY_LAKE",
3941
* };
4042
* const command = new DeleteLoggingConfigurationCommand(input);
4143
* const response = await client.send(command);

‎clients/client-wafv2/src/commands/GetLoggingConfigurationCommand.ts

+4
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ export interface GetLoggingConfigurationCommandOutput extends GetLoggingConfigur
3636
* const client = new WAFV2Client(config);
3737
* const input = { // GetLoggingConfigurationRequest
3838
* ResourceArn: "STRING_VALUE", // required
39+
* LogType: "WAF_LOGS",
40+
* LogScope: "CUSTOMER" || "SECURITY_LAKE",
3941
* };
4042
* const command = new GetLoggingConfigurationCommand(input);
4143
* const response = await client.send(command);
@@ -125,6 +127,8 @@ export interface GetLoggingConfigurationCommandOutput extends GetLoggingConfigur
125127
* // ],
126128
* // DefaultBehavior: "KEEP" || "DROP", // required
127129
* // },
130+
* // LogType: "WAF_LOGS",
131+
* // LogScope: "CUSTOMER" || "SECURITY_LAKE",
128132
* // },
129133
* // };
130134
*

‎clients/client-wafv2/src/commands/ListLoggingConfigurationsCommand.ts

+3
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ export interface ListLoggingConfigurationsCommandOutput extends ListLoggingConfi
3838
* Scope: "CLOUDFRONT" || "REGIONAL", // required
3939
* NextMarker: "STRING_VALUE",
4040
* Limit: Number("int"),
41+
* LogScope: "CUSTOMER" || "SECURITY_LAKE",
4142
* };
4243
* const command = new ListLoggingConfigurationsCommand(input);
4344
* const response = await client.send(command);
@@ -128,6 +129,8 @@ export interface ListLoggingConfigurationsCommandOutput extends ListLoggingConfi
128129
* // ],
129130
* // DefaultBehavior: "KEEP" || "DROP", // required
130131
* // },
132+
* // LogType: "WAF_LOGS",
133+
* // LogScope: "CUSTOMER" || "SECURITY_LAKE",
131134
* // },
132135
* // ],
133136
* // NextMarker: "STRING_VALUE",

‎clients/client-wafv2/src/commands/PutLoggingConfigurationCommand.ts

+4
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ export interface PutLoggingConfigurationCommandOutput extends PutLoggingConfigur
162162
* ],
163163
* DefaultBehavior: "KEEP" || "DROP", // required
164164
* },
165+
* LogType: "WAF_LOGS",
166+
* LogScope: "CUSTOMER" || "SECURITY_LAKE",
165167
* },
166168
* };
167169
* const command = new PutLoggingConfigurationCommand(input);
@@ -252,6 +254,8 @@ export interface PutLoggingConfigurationCommandOutput extends PutLoggingConfigur
252254
* // ],
253255
* // DefaultBehavior: "KEEP" || "DROP", // required
254256
* // },
257+
* // LogType: "WAF_LOGS",
258+
* // LogScope: "CUSTOMER" || "SECURITY_LAKE",
255259
* // },
256260
* // };
257261
*

‎clients/client-wafv2/src/models/models_0.ts

+110-3
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ export const FallbackBehavior = {
449449
export type FallbackBehavior = (typeof FallbackBehavior)[keyof typeof FallbackBehavior];
450450

451451
/**
452-
* <p>Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each
452+
* <p>Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each
453453
* request that has enough TLS Client Hello information for the calculation. Almost
454454
* all web requests include this information.</p>
455455
* <note>
@@ -763,6 +763,10 @@ export interface UriPath {}
763763
* <p>In this documentation, the descriptions of the individual fields talk about specifying the web request component to inspect,
764764
* but for field redaction, you are specifying the component type to redact from the logs. </p>
765765
* </li>
766+
* <li>
767+
* <p>If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling.
768+
* The only way to exclude fields from request sampling is by disabling sampling in the web ACL visibility configuration. </p>
769+
* </li>
766770
* </ul>
767771
* </li>
768772
* </ul>
@@ -898,7 +902,7 @@ export interface FieldToMatch {
898902
HeaderOrder?: HeaderOrder;
899903

900904
/**
901-
* <p>Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each
905+
* <p>Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each
902906
* request that has enough TLS Client Hello information for the calculation. Almost
903907
* all web requests include this information.</p>
904908
* <note>
@@ -1013,7 +1017,7 @@ export interface ByteMatchStatement {
10131017
* </li>
10141018
* <li>
10151019
* <p>
1016-
* <code>JA3Fingerprint</code>: Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. You can use this choice only with a string match <code>ByteMatchStatement</code> with the <code>PositionalConstraint</code> set to
1020+
* <code>JA3Fingerprint</code>: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. You can use this choice only with a string match <code>ByteMatchStatement</code> with the <code>PositionalConstraint</code> set to
10171021
* <code>EXACTLY</code>. </p>
10181022
* <p>You can obtain the JA3 fingerprint for client requests from the web ACL logs.
10191023
* If WAF is able to calculate the fingerprint, it includes it in the logs.
@@ -3493,6 +3497,10 @@ export interface VisibilityConfig {
34933497
/**
34943498
* <p>Indicates whether WAF should store a sampling of the web requests that
34953499
* match the rules. You can view the sampled requests through the WAF console. </p>
3500+
* <note>
3501+
* <p>Request sampling doesn't provide a field redaction option, and any field redaction that you specify in your logging configuration doesn't affect sampling.
3502+
* The only way to exclude fields from request sampling is by disabling sampling in the web ACL visibility configuration. </p>
3503+
* </note>
34963504
* @public
34973505
*/
34983506
SampledRequestsEnabled: boolean | undefined;
@@ -4367,6 +4375,33 @@ export class WAFAssociatedItemException extends __BaseException {
43674375
}
43684376
}
43694377

4378+
/**
4379+
* @public
4380+
* @enum
4381+
*/
4382+
export const LogScope = {
4383+
CUSTOMER: "CUSTOMER",
4384+
SECURITY_LAKE: "SECURITY_LAKE",
4385+
} as const;
4386+
4387+
/**
4388+
* @public
4389+
*/
4390+
export type LogScope = (typeof LogScope)[keyof typeof LogScope];
4391+
4392+
/**
4393+
* @public
4394+
* @enum
4395+
*/
4396+
export const LogType = {
4397+
WAF_LOGS: "WAF_LOGS",
4398+
} as const;
4399+
4400+
/**
4401+
* @public
4402+
*/
4403+
export type LogType = (typeof LogType)[keyof typeof LogType];
4404+
43704405
/**
43714406
* @public
43724407
*/
@@ -4376,6 +4411,25 @@ export interface DeleteLoggingConfigurationRequest {
43764411
* @public
43774412
*/
43784413
ResourceArn: string | undefined;
4414+
4415+
/**
4416+
* <p>Used to distinguish between various logging options. Currently, there is one option.</p>
4417+
* <p>Default: <code>WAF_LOGS</code>
4418+
* </p>
4419+
* @public
4420+
*/
4421+
LogType?: LogType;
4422+
4423+
/**
4424+
* <p>The owner of the logging configuration, which must be set to <code>CUSTOMER</code> for the configurations that you manage. </p>
4425+
* <p>The log scope <code>SECURITY_LAKE</code> indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see
4426+
* <a href="https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html">Collecting data from Amazon Web Services services</a>
4427+
* in the <i>Amazon Security Lake user guide</i>. </p>
4428+
* <p>Default: <code>CUSTOMER</code>
4429+
* </p>
4430+
* @public
4431+
*/
4432+
LogScope?: LogScope;
43794433
}
43804434

43814435
/**
@@ -5091,6 +5145,25 @@ export interface GetLoggingConfigurationRequest {
50915145
* @public
50925146
*/
50935147
ResourceArn: string | undefined;
5148+
5149+
/**
5150+
* <p>Used to distinguish between various logging options. Currently, there is one option.</p>
5151+
* <p>Default: <code>WAF_LOGS</code>
5152+
* </p>
5153+
* @public
5154+
*/
5155+
LogType?: LogType;
5156+
5157+
/**
5158+
* <p>The owner of the logging configuration, which must be set to <code>CUSTOMER</code> for the configurations that you manage. </p>
5159+
* <p>The log scope <code>SECURITY_LAKE</code> indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see
5160+
* <a href="https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html">Collecting data from Amazon Web Services services</a>
5161+
* in the <i>Amazon Security Lake user guide</i>. </p>
5162+
* <p>Default: <code>CUSTOMER</code>
5163+
* </p>
5164+
* @public
5165+
*/
5166+
LogScope?: LogScope;
50945167
}
50955168

50965169
/**
@@ -5264,6 +5337,10 @@ export interface LoggingConfiguration {
52645337
* <p>You can specify only the following fields for redaction: <code>UriPath</code>,
52655338
* <code>QueryString</code>, <code>SingleHeader</code>, and <code>Method</code>.</p>
52665339
* </note>
5340+
* <note>
5341+
* <p>This setting has no impact on request sampling. With request sampling,
5342+
* the only way to exclude fields is by disabling sampling in the web ACL visibility configuration. </p>
5343+
* </note>
52675344
* @public
52685345
*/
52695346
RedactedFields?: FieldToMatch[];
@@ -5283,6 +5360,25 @@ export interface LoggingConfiguration {
52835360
* @public
52845361
*/
52855362
LoggingFilter?: LoggingFilter;
5363+
5364+
/**
5365+
* <p>Used to distinguish between various logging options. Currently, there is one option.</p>
5366+
* <p>Default: <code>WAF_LOGS</code>
5367+
* </p>
5368+
* @public
5369+
*/
5370+
LogType?: LogType;
5371+
5372+
/**
5373+
* <p>The owner of the logging configuration, which must be set to <code>CUSTOMER</code> for the configurations that you manage. </p>
5374+
* <p>The log scope <code>SECURITY_LAKE</code> indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see
5375+
* <a href="https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html">Collecting data from Amazon Web Services services</a>
5376+
* in the <i>Amazon Security Lake user guide</i>. </p>
5377+
* <p>Default: <code>CUSTOMER</code>
5378+
* </p>
5379+
* @public
5380+
*/
5381+
LogScope?: LogScope;
52865382
}
52875383

52885384
/**
@@ -6557,6 +6653,17 @@ export interface ListLoggingConfigurationsRequest {
65576653
* @public
65586654
*/
65596655
Limit?: number;
6656+
6657+
/**
6658+
* <p>The owner of the logging configuration, which must be set to <code>CUSTOMER</code> for the configurations that you manage. </p>
6659+
* <p>The log scope <code>SECURITY_LAKE</code> indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see
6660+
* <a href="https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html">Collecting data from Amazon Web Services services</a>
6661+
* in the <i>Amazon Security Lake user guide</i>. </p>
6662+
* <p>Default: <code>CUSTOMER</code>
6663+
* </p>
6664+
* @public
6665+
*/
6666+
LogScope?: LogScope;
65606667
}
65616668

65626669
/**

0 commit comments

Comments
 (0)