[ aws . wafv2 ]

put-logging-configuration

Description

Enables the specified LoggingConfiguration , to start logging from a web ACL, according to the configuration provided.

You can access information about all traffic that AWS WAF inspects using the following steps:

• Create an Amazon Kinesis Data Firehose. Create the data firehose with a PUT source and in the Region that you are operating. If you are capturing logs for Amazon CloudFront, always create the firehose in US East (N. Virginia). Give the data firehose a name that starts with the prefix aws-waf-logs- . For example, aws-waf-logs-us-east-2-analytics .

Note

Do not create the data firehose using a Kinesis stream as your source.

• Associate that firehose to your web ACL using a PutLoggingConfiguration request.

When you successfully enable logging using a PutLoggingConfiguration request, AWS WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose. For more information, see Logging Web ACL Traffic Information in the AWS WAF Developer Guide .

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  put-logging-configuration
--logging-configuration <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--logging-configuration (structure)

ResourceArn -> (string)

The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

LogDestinationConfigs -> (list)

The Amazon Kinesis Data Firehose Amazon Resource Name (ARNs) that you want to associate with the web ACL.

(string)

RedactedFields -> (list)

The parts of the request that you want to keep out of the logs. For example, if you redact the HEADER field, the HEADER field in the firehose will be xxx .

Note

You must use one of the following values: URI , QUERY_STRING , HEADER , or METHOD .

(structure)

The part of a web request that you want AWS WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component.

SingleHeader -> (structure)

Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer . This setting isn’t case sensitive.

Name -> (string)

The name of the query header to inspect.

SingleQueryArgument -> (structure)

Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion . The name can be up to 30 characters long and isn’t case sensitive.

This is used only to indicate the web request component for AWS WAF to inspect, in the FieldToMatch specification.

Name -> (string)

The name of the query argument to inspect.

AllQueryArguments -> (structure)

Inspect all query arguments.

UriPath -> (structure)

Inspect the request URI path. This is the part of a web request that identifies a resource, for example, /images/daily-ad.jpg .

QueryString -> (structure)

Inspect the query string. This is the part of a URL that appears after a ? character, if any.

Body -> (structure)

Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

Note that only the first 8 KB (8192 bytes) of the request body are forwarded to AWS WAF for inspection by the underlying host service. If you don’t need to inspect more than 8 KB, you can guarantee that you don’t allow additional bytes in by combining a statement that inspects the body of the web request, such as ByteMatchStatement or RegexPatternSetReferenceStatement , with a SizeConstraintStatement that enforces an 8 KB size limit on the body of the request. AWS WAF doesn’t support inspecting the entire contents of web requests whose bodies exceed the 8 KB limit.

Method -> (structure)

Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.

JsonBody -> (structure)

Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

Note that only the first 8 KB (8192 bytes) of the request body are forwarded to AWS WAF for inspection by the underlying host service. If you don’t need to inspect more than 8 KB, you can guarantee that you don’t allow additional bytes in by combining a statement that inspects the body of the web request, such as ByteMatchStatement or RegexPatternSetReferenceStatement , with a SizeConstraintStatement that enforces an 8 KB size limit on the body of the request. AWS WAF doesn’t support inspecting the entire contents of web requests whose bodies exceed the 8 KB limit.

MatchPattern -> (structure)

The patterns to look for in the JSON body. AWS WAF inspects the results of these pattern matches against the rule inspection criteria.

All -> (structure)

Match all of the elements. See also MatchScope in JsonBody .

You must specify either this setting or the IncludedPaths setting, but not both.

IncludedPaths -> (list)

Match only the specified include paths. See also MatchScope in JsonBody .

Provide the include paths using JSON Pointer syntax. For example, "IncludedPaths": ["/dogs/0/name", "/dogs/1/name"] . For information about this syntax, see the Internet Engineering Task Force (IETF) documentation JavaScript Object Notation (JSON) Pointer .

You must specify either this setting or the All setting, but not both.

Note

Don’t use this option to include all paths. Instead, use the All setting.

(string)

MatchScope -> (string)

The parts of the JSON to match against using the MatchPattern . If you specify All , AWS WAF matches against keys and values.

InvalidFallbackBehavior -> (string)

The inspection behavior to fall back to if the JSON in the request body is invalid. For AWS WAF, invalid JSON is any content that isn’t complete syntactical JSON, content whose root node isn’t an object or an array, and duplicate keys in the content.

You can specify the following fallback behaviors:

• MATCH - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.

• NO_MATCH - Treat the web request as not matching the rule statement.

• EVALUATE_AS_STRING - Inspect the body as plain text. This option applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.

If you don’t provide this setting, when AWS WAF encounters invalid JSON, it parses and inspects what it can, up to the first invalid JSON that it encounters.

ManagedByFirewallManager -> (boolean)

Indicates whether the logging configuration was created by AWS Firewall Manager, as part of an AWS WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration.

JSON Syntax:

{
  "ResourceArn": "string",
  "LogDestinationConfigs": ["string", ...],
  "RedactedFields": [
    {
      "SingleHeader": {
        "Name": "string"
      },
      "SingleQueryArgument": {
        "Name": "string"
      },
      "AllQueryArguments": {

      },
      "UriPath": {

      },
      "QueryString": {

      },
      "Body": {

      },
      "Method": {

      },
      "JsonBody": {
        "MatchPattern": {
          "All": {

          },
          "IncludedPaths": ["string", ...]
        },
        "MatchScope": "ALL"|"KEY"|"VALUE",
        "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING"
      }
    }
    ...
  ],
  "ManagedByFirewallManager": true|false
}

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Examples

To add a logging configuration to a web ACL

The following put-logging-configuration adds the Amazon Kinesis Data Firehose logging configuration aws-waf-logs-custom-transformation to the specified web ACL, with no fields redacted from the logs.

aws wafv2 put-logging-configuration \
    --logging-configuration ResourceArn=arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-cli/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111,LogDestinationConfigs=arn:aws:firehose:us-west-2:123456789012:deliverystream/aws-waf-logs-custom-transformation \
            --region us-west-2

Output:

{
    "LoggingConfiguration":{
        "ResourceArn":"arn:aws:wafv2:us-west-2:123456789012:regional/webacl/test-cli/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
        "LogDestinationConfigs":[
            "arn:aws:firehose:us-west-2:123456789012:deliverystream/aws-waf-logs-custom-transformation"
        ]
    }
}

For more information, see Logging Web ACL Traffic Information in the AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide.

Output

LoggingConfiguration -> (structure)

ResourceArn -> (string)

The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

LogDestinationConfigs -> (list)

The Amazon Kinesis Data Firehose Amazon Resource Name (ARNs) that you want to associate with the web ACL.

(string)

RedactedFields -> (list)

The parts of the request that you want to keep out of the logs. For example, if you redact the HEADER field, the HEADER field in the firehose will be xxx .

Note

You must use one of the following values: URI , QUERY_STRING , HEADER , or METHOD .

(structure)

The part of a web request that you want AWS WAF to inspect. Include the single FieldToMatch type that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component in FieldToMatch for each rule statement that requires it. To inspect more than one component of a web request, create a separate rule statement for each component.

SingleHeader -> (structure)

Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer . This setting isn’t case sensitive.

Name -> (string)

The name of the query header to inspect.

SingleQueryArgument -> (structure)

Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion . The name can be up to 30 characters long and isn’t case sensitive.

This is used only to indicate the web request component for AWS WAF to inspect, in the FieldToMatch specification.

Name -> (string)

The name of the query argument to inspect.

AllQueryArguments -> (structure)

Inspect all query arguments.

UriPath -> (structure)

Inspect the request URI path. This is the part of a web request that identifies a resource, for example, /images/daily-ad.jpg .

QueryString -> (structure)

Inspect the query string. This is the part of a URL that appears after a ? character, if any.

Body -> (structure)

Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

Note that only the first 8 KB (8192 bytes) of the request body are forwarded to AWS WAF for inspection by the underlying host service. If you don’t need to inspect more than 8 KB, you can guarantee that you don’t allow additional bytes in by combining a statement that inspects the body of the web request, such as ByteMatchStatement or RegexPatternSetReferenceStatement , with a SizeConstraintStatement that enforces an 8 KB size limit on the body of the request. AWS WAF doesn’t support inspecting the entire contents of web requests whose bodies exceed the 8 KB limit.

Method -> (structure)

Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.

JsonBody -> (structure)

Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

Note that only the first 8 KB (8192 bytes) of the request body are forwarded to AWS WAF for inspection by the underlying host service. If you don’t need to inspect more than 8 KB, you can guarantee that you don’t allow additional bytes in by combining a statement that inspects the body of the web request, such as ByteMatchStatement or RegexPatternSetReferenceStatement , with a SizeConstraintStatement that enforces an 8 KB size limit on the body of the request. AWS WAF doesn’t support inspecting the entire contents of web requests whose bodies exceed the 8 KB limit.

MatchPattern -> (structure)

The patterns to look for in the JSON body. AWS WAF inspects the results of these pattern matches against the rule inspection criteria.

All -> (structure)

Match all of the elements. See also MatchScope in JsonBody .

You must specify either this setting or the IncludedPaths setting, but not both.

IncludedPaths -> (list)

Match only the specified include paths. See also MatchScope in JsonBody .

Provide the include paths using JSON Pointer syntax. For example, "IncludedPaths": ["/dogs/0/name", "/dogs/1/name"] . For information about this syntax, see the Internet Engineering Task Force (IETF) documentation JavaScript Object Notation (JSON) Pointer .

You must specify either this setting or the All setting, but not both.

Note

Don’t use this option to include all paths. Instead, use the All setting.

(string)

MatchScope -> (string)

The parts of the JSON to match against using the MatchPattern . If you specify All , AWS WAF matches against keys and values.

InvalidFallbackBehavior -> (string)

The inspection behavior to fall back to if the JSON in the request body is invalid. For AWS WAF, invalid JSON is any content that isn’t complete syntactical JSON, content whose root node isn’t an object or an array, and duplicate keys in the content.

You can specify the following fallback behaviors:

• MATCH - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.

• NO_MATCH - Treat the web request as not matching the rule statement.

• EVALUATE_AS_STRING - Inspect the body as plain text. This option applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.

If you don’t provide this setting, when AWS WAF encounters invalid JSON, it parses and inspects what it can, up to the first invalid JSON that it encounters.

ManagedByFirewallManager -> (boolean)

Indicates whether the logging configuration was created by AWS Firewall Manager, as part of an AWS WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration.