get-rate-based-statement-managed-keys¶

Description¶

Retrieves the keys that are currently blocked by a rate-based rule instance. The maximum number of managed keys that can be blocked for a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, those with the highest rates are blocked.

For a rate-based rule that you’ve defined inside a rule group, provide the name of the rule group reference statement in your request, in addition to the rate-based rule name and the web ACL name.

WAF monitors web requests and manages keys independently for each unique combination of web ACL, optional rule group, and rate-based rule. For example, if you define a rate-based rule inside a rule group, and then use the rule group in a web ACL, WAF monitors web requests and manages keys for that web ACL, rule group reference statement, and rate-based rule instance. If you use the same rule group in a second web ACL, WAF monitors web requests and manages keys for this second usage completely independent of your first.

Synopsis¶

  get-rate-based-statement-managed-keys
--scope <value>
--web-acl-name <value>
--web-acl-id <value>
[--rule-group-rule-name <value>]
--rule-name <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options¶

--scope (string)

Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, or an Amazon Cognito user pool.

To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows:

CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT --region=us-east-1 .

API and SDKs - For all calls, use the Region endpoint us-east-1.

Possible values:

CLOUDFRONT

REGIONAL

--web-acl-name (string)

The name of the web ACL. You cannot change the name of a web ACL after you create it.

--web-acl-id (string)

The unique identifier for the web ACL. This ID is returned in the responses to create and list commands. You provide it to operations like update and delete.

--rule-group-rule-name (string)

The name of the rule group reference statement in your web ACL. This is required only when you have the rate-based rule nested inside a rule group.

--rule-name (string)

The name of the rate-based rule to get the keys for. If you have the rule defined inside a rule group that you’re using in your web ACL, also provide the name of the rule group reference statement in the request parameter RuleGroupRuleName .

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

See ‘aws help’ for descriptions of global parameters.

Examples¶

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To retrieve a list of IP addresses that are blocked by a rate-based rule

The following get-rate-based-statement-managed-keys retrieves the IP addresses currently blocked by a rate-based rule that’s being used for a regional application.

aws wafv2 get-rate-based-statement-managed-keys \
    --scope REGIONAL \
    --web-acl-name testwebacl2 \
    --web-acl-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 \
    --rule-name ratebasedtest

Output:

{
    "ManagedKeysIPV4":{
        "IPAddressVersion":"IPV4",
        "Addresses":[
            "198.51.100.0/32"
        ]
    },
    "ManagedKeysIPV6":{
        "IPAddressVersion":"IPV6",
        "Addresses":[

        ]
    }
}

For more information, see Rate-Based Rule Statement in the AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide.

Output¶

ManagedKeysIPV4 -> (structure)

The keys that are of Internet Protocol version 4 (IPv4).

IPAddressVersion -> (string)

The version of the IP addresses, either IPV4 or IPV6 .

Addresses -> (list)

The IP addresses that are currently blocked.

(string)

ManagedKeysIPV6 -> (structure)

The keys that are of Internet Protocol version 6 (IPv6).

IPAddressVersion -> (string)

The version of the IP addresses, either IPV4 or IPV6 .

Addresses -> (list)

The IP addresses that are currently blocked.

(string)

Table of Contents

Feedback

User Guide