Skip to content

Commit 5bea879

Browse files
author
awstools
committed
feat(client-wafv2): You can now inspect all request headers and all cookies. You can now specify how to handle oversize body contents in your rules that inspect the body.
1 parent 1a4fe40 commit 5bea879

11 files changed

+920
-97
lines changed

‎clients/client-wafv2/src/WAFV2.ts

+43-3
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,8 @@ export class WAFV2 extends WAFV2Client {
278278
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
279279
* associate a web ACL, in the CloudFront call <code>UpdateDistribution</code>, set the web ACL ID
280280
* to the Amazon Resource Name (ARN) of the web ACL. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>
281+
*
282+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
281283
*/
282284
public associateWebACL(
283285
args: AssociateWebACLCommandInput,
@@ -666,9 +668,38 @@ export class WAFV2 extends WAFV2Client {
666668
}
667669

668670
/**
669-
* <p>Deletes the specified <a>WebACL</a>.</p>
671+
* <p>Deletes the specified <a>WebACL</a>. </p>
670672
* <p>You can only use this if <code>ManagedByFirewallManager</code> is false in the specified
671673
* <a>WebACL</a>. </p>
674+
* <note>
675+
* <p>Before deleting any web ACL, first disassociate it from all resources.</p>
676+
* <ul>
677+
* <li>
678+
* <p>To retrieve a list of the resources that are associated with a web ACL, use the following calls:</p>
679+
* <ul>
680+
* <li>
681+
* <p>For regional resources, call <a>ListResourcesForWebACL</a>.</p>
682+
* </li>
683+
* <li>
684+
* <p>For Amazon CloudFront distributions, use the CloudFront call <code>ListDistributionsByWebACLId</code>.
685+
* For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html">ListDistributionsByWebACLId</a>.</p>
686+
* </li>
687+
* </ul>
688+
* </li>
689+
* <li>
690+
* <p>To disassociate a resource from a web ACL, use the following calls:</p>
691+
* <ul>
692+
* <li>
693+
* <p>For regional resources, call <a>DisassociateWebACL</a>.</p>
694+
* </li>
695+
* <li>
696+
* <p>For Amazon CloudFront distributions, provide an empty web ACL ID in the CloudFront call
697+
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>
698+
* </li>
699+
* </ul>
700+
* </li>
701+
* </ul>
702+
* </note>
672703
*/
673704
public deleteWebACL(
674705
args: DeleteWebACLCommandInput,
@@ -730,7 +761,8 @@ export class WAFV2 extends WAFV2Client {
730761
}
731762

732763
/**
733-
* <p>Disassociates a web ACL from a regional application resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. </p>
764+
* <p>Disassociates the specified regional application resource from any existing web ACL association. A resource can have at most one
765+
* web ACL association. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. </p>
734766
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
735767
* disassociate a web ACL, provide an empty web ACL ID in the CloudFront call
736768
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>
@@ -1740,6 +1772,8 @@ export class WAFV2 extends WAFV2Client {
17401772
* <note>
17411773
* <p>This operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call. To modify the IP set, retrieve it by calling <a>GetIPSet</a>, update the settings as needed, and then provide the complete IP set specification to this call.</p>
17421774
* </note>
1775+
*
1776+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
17431777
*/
17441778
public updateIPSet(args: UpdateIPSetCommandInput, options?: __HttpHandlerOptions): Promise<UpdateIPSetCommandOutput>;
17451779
public updateIPSet(args: UpdateIPSetCommandInput, cb: (err: any, data?: UpdateIPSetCommandOutput) => void): void;
@@ -1809,6 +1843,8 @@ export class WAFV2 extends WAFV2Client {
18091843
* <note>
18101844
* <p>This operation completely replaces the mutable specifications that you already have for the regex pattern set with the ones that you provide to this call. To modify the regex pattern set, retrieve it by calling <a>GetRegexPatternSet</a>, update the settings as needed, and then provide the complete regex pattern set specification to this call.</p>
18111845
* </note>
1846+
*
1847+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
18121848
*/
18131849
public updateRegexPatternSet(
18141850
args: UpdateRegexPatternSetCommandInput,
@@ -1844,6 +1880,8 @@ export class WAFV2 extends WAFV2Client {
18441880
* <note>
18451881
* <p>This operation completely replaces the mutable specifications that you already have for the rule group with the ones that you provide to this call. To modify the rule group, retrieve it by calling <a>GetRuleGroup</a>, update the settings as needed, and then provide the complete rule group specification to this call.</p>
18461882
* </note>
1883+
*
1884+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
18471885
* <p> A rule group defines a collection of rules to inspect and control web requests that you can use in a <a>WebACL</a>. When you create a rule group, you define an immutable capacity limit. If you update a rule group, you must stay within the capacity. This allows others to reuse the rule group with confidence in its capacity requirements. </p>
18481886
*/
18491887
public updateRuleGroup(
@@ -1876,7 +1914,9 @@ export class WAFV2 extends WAFV2Client {
18761914
}
18771915

18781916
/**
1879-
* <p>Updates the specified <a>WebACL</a>.</p>
1917+
* <p>Updates the specified <a>WebACL</a>. While updating a web ACL, WAF provides continous coverage to the resources that you have associated with the web ACL. </p>
1918+
*
1919+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
18801920
* <note>
18811921
* <p>This operation completely replaces the mutable specifications that you already have for the web ACL with the ones that you provide to this call. To modify the web ACL, retrieve it by calling <a>GetWebACL</a>, update the settings as needed, and then provide the complete web ACL specification to this call.</p>
18821922
* </note>

‎clients/client-wafv2/src/commands/AssociateWebACLCommand.ts

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ export interface AssociateWebACLCommandOutput extends AssociateWebACLResponse, _
2727
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
2828
* associate a web ACL, in the CloudFront call <code>UpdateDistribution</code>, set the web ACL ID
2929
* to the Amazon Resource Name (ARN) of the web ACL. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>
30+
*
31+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
3032
* @example
3133
* Use a bare-bones client and the command you need to make an API call.
3234
* ```javascript

‎clients/client-wafv2/src/commands/DeleteWebACLCommand.ts

+30-1
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,38 @@ export interface DeleteWebACLCommandInput extends DeleteWebACLRequest {}
2222
export interface DeleteWebACLCommandOutput extends DeleteWebACLResponse, __MetadataBearer {}
2323

2424
/**
25-
* <p>Deletes the specified <a>WebACL</a>.</p>
25+
* <p>Deletes the specified <a>WebACL</a>. </p>
2626
* <p>You can only use this if <code>ManagedByFirewallManager</code> is false in the specified
2727
* <a>WebACL</a>. </p>
28+
* <note>
29+
* <p>Before deleting any web ACL, first disassociate it from all resources.</p>
30+
* <ul>
31+
* <li>
32+
* <p>To retrieve a list of the resources that are associated with a web ACL, use the following calls:</p>
33+
* <ul>
34+
* <li>
35+
* <p>For regional resources, call <a>ListResourcesForWebACL</a>.</p>
36+
* </li>
37+
* <li>
38+
* <p>For Amazon CloudFront distributions, use the CloudFront call <code>ListDistributionsByWebACLId</code>.
39+
* For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html">ListDistributionsByWebACLId</a>.</p>
40+
* </li>
41+
* </ul>
42+
* </li>
43+
* <li>
44+
* <p>To disassociate a resource from a web ACL, use the following calls:</p>
45+
* <ul>
46+
* <li>
47+
* <p>For regional resources, call <a>DisassociateWebACL</a>.</p>
48+
* </li>
49+
* <li>
50+
* <p>For Amazon CloudFront distributions, provide an empty web ACL ID in the CloudFront call
51+
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>
52+
* </li>
53+
* </ul>
54+
* </li>
55+
* </ul>
56+
* </note>
2857
* @example
2958
* Use a bare-bones client and the command you need to make an API call.
3059
* ```javascript

‎clients/client-wafv2/src/commands/DisassociateWebACLCommand.ts

+2-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ export interface DisassociateWebACLCommandInput extends DisassociateWebACLReques
2222
export interface DisassociateWebACLCommandOutput extends DisassociateWebACLResponse, __MetadataBearer {}
2323

2424
/**
25-
* <p>Disassociates a web ACL from a regional application resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. </p>
25+
* <p>Disassociates the specified regional application resource from any existing web ACL association. A resource can have at most one
26+
* web ACL association. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. </p>
2627
* <p>For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To
2728
* disassociate a web ACL, provide an empty web ACL ID in the CloudFront call
2829
* <code>UpdateDistribution</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html">UpdateDistribution</a>.</p>

‎clients/client-wafv2/src/commands/UpdateIPSetCommand.ts

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ export interface UpdateIPSetCommandOutput extends UpdateIPSetResponse, __Metadat
2626
* <note>
2727
* <p>This operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call. To modify the IP set, retrieve it by calling <a>GetIPSet</a>, update the settings as needed, and then provide the complete IP set specification to this call.</p>
2828
* </note>
29+
*
30+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
2931
* @example
3032
* Use a bare-bones client and the command you need to make an API call.
3133
* ```javascript

‎clients/client-wafv2/src/commands/UpdateRegexPatternSetCommand.ts

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ export interface UpdateRegexPatternSetCommandOutput extends UpdateRegexPatternSe
2626
* <note>
2727
* <p>This operation completely replaces the mutable specifications that you already have for the regex pattern set with the ones that you provide to this call. To modify the regex pattern set, retrieve it by calling <a>GetRegexPatternSet</a>, update the settings as needed, and then provide the complete regex pattern set specification to this call.</p>
2828
* </note>
29+
*
30+
* <p>When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.</p>
2931
* @example
3032
* Use a bare-bones client and the command you need to make an API call.
3133
* ```javascript

0 commit comments

Comments
 (0)