--- title: Getting Started with Datadog description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog --- # aws_wafv2_acl{% #aws_wafv2_acl %} ## `account_id`{% #account_id %} **Type**: `STRING` ## `application_integration_url`{% #application_integration_url %} **Type**: `STRING`**Provider name**: `ApplicationIntegrationURL`**Description**: The URL to use in SDK integrations with Amazon Web Services managed rule groups. For example, you can use the integration SDKs with the account takeover prevention managed rule group `AWSManagedRulesATPRuleSet` and the account creation fraud prevention managed rule group `AWSManagedRulesACFPRuleSet`. This is only populated if you are using a rule group in your web ACL that integrates with your applications in this way. For more information, see [WAF client application integration](https://docs.aws.amazon.com/waf/latest/developerguide/waf-application-integration.html) in the WAF Developer Guide. ## `arn`{% #arn %} **Type**: `STRING`**Provider name**: `ARN`**Description**: The Amazon Resource Name (ARN) of the entity. ## `description`{% #description %} **Type**: `STRING`**Provider name**: `Description`**Description**: A description of the web ACL that helps with identification. ## `id`{% #id %} **Type**: `STRING`**Provider name**: `Id`**Description**: The unique identifier for the web ACL. This ID is returned in the responses to create and list commands. You provide it to operations like update and delete. ## `lock_token`{% #lock_token %} **Type**: `STRING`**Provider name**: `LockToken`**Description**: A token used for optimistic locking. WAF returns a token to your `get` and `list` requests, to mark the state of the entity at the time of the request. To make changes to the entity associated with the token, you provide the token to operations like `update` and `delete`. WAF uses the token to ensure that no changes have been made to the entity since you last retrieved it. If a change has been made, the update fails with a `WAFOptimisticLockException`. If this happens, perform another `get`, and use the new token returned by that operation. ## `logging_configuration`{% #logging_configuration %} **Type**: `STRUCT`**Provider name**: `LoggingConfiguration`**Description**: The LoggingConfiguration for the specified web ACL. - `log_destination_configs`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `LogDestinationConfigs`**Description**: The logging destination configuration that you want to associate with the web ACL.You can associate one logging destination to a web ACL. - `log_scope`**Type**: `STRING`**Provider name**: `LogScope`**Description**: The owner of the logging configuration, which must be set to `CUSTOMER` for the configurations that you manage. The log scope `SECURITY_LAKE` indicates a configuration that is managed through Amazon Security Lake. You can use Security Lake to collect log and event data from various sources for normalization, analysis, and management. For information, see [Collecting data from Amazon Web Services services](https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html) in the Amazon Security Lake user guide.**Default**: `CUSTOMER` - `log_type`**Type**: `STRING`**Provider name**: `LogType`**Description**: Used to distinguish between various logging options. Currently, there is one option.**Default**: `WAF_LOGS` - `logging_filter`**Type**: `STRUCT`**Provider name**: `LoggingFilter`**Description**: Filtering that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. - `default_behavior`**Type**: `STRING`**Provider name**: `DefaultBehavior`**Description**: Default handling for logs that don't match any of the specified filtering conditions. - `filters`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Filters`**Description**: The filters that you want to apply to the logs. - `behavior`**Type**: `STRING`**Provider name**: `Behavior`**Description**: How to handle logs that satisfy the filter's conditions and requirement. - `conditions`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Conditions`**Description**: Match conditions for the filter. - `action_condition`**Type**: `STRUCT`**Provider name**: `ActionCondition`**Description**: A single action condition. This is the action setting that a log record must contain in order to meet the condition. - `action`**Type**: `STRING`**Provider name**: `Action`**Description**: The action setting that a log record must contain in order to meet the condition. This is the action that WAF applied to the web request. For rule groups, this is either the configured rule action setting, or if you've applied a rule action override to the rule, it's the override action. The value `EXCLUDED_AS_COUNT` matches on excluded rules and also on rules that have a rule action override of Count. - `label_name_condition`**Type**: `STRUCT`**Provider name**: `LabelNameCondition`**Description**: A single label name condition. This is the fully qualified label name that a log record must contain in order to meet the condition. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label. - `label_name`**Type**: `STRING`**Provider name**: `LabelName`**Description**: The label name that a log record must contain in order to meet the condition. This must be a fully qualified label name. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label. - `requirement`**Type**: `STRING`**Provider name**: `Requirement`**Description**: Logic to apply to the filtering conditions. You can specify that, in order to satisfy the filter, a log must match all conditions or must match at least one condition. - `managed_by_firewall_manager`**Type**: `BOOLEAN`**Provider name**: `ManagedByFirewallManager`**Description**: Indicates whether the logging configuration was created by Firewall Manager, as part of an WAF policy configuration. If true, only Firewall Manager can modify or delete the configuration. The logging configuration can be created by Firewall Manager for use with any web ACL that Firewall Manager is using for an WAF policy. Web ACLs that Firewall Manager creates and uses have their `ManagedByFirewallManager` property set to true. Web ACLs that were created by a customer account and then retrofitted by Firewall Manager for use by a policy have their `RetrofittedByFirewallManager` property set to true. For either case, any corresponding logging configuration will indicate `ManagedByFirewallManager`. - `redacted_fields`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `RedactedFields`**Description**: The parts of the request that you want to keep out of the logs. For example, if you redact the `SingleHeader` field, the `HEADER` field in the logs will be `REDACTED` for all rules that use the `SingleHeader` `FieldToMatch` setting. Redaction applies only to the component that's specified in the rule's `FieldToMatch` setting, so the `SingleHeader` redaction doesn't apply to rules that use the `Headers` `FieldToMatch`.You can specify only the following fields for redaction: `UriPath`, `QueryString`, `SingleHeader`, and `Method`.This setting has no impact on request sampling. With request sampling, the only way to exclude fields is by disabling sampling in the web ACL visibility configuration. - `all_query_arguments`**Type**: `STRUCT`**Provider name**: `AllQueryArguments`**Description**: Inspect all query arguments. - `body`**Type**: `STRUCT`**Provider name**: `Body`**Description**: Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. - For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL `AssociationConfig`, for additional processing fees. For information about how to handle oversized request bodies, see the `Body` object configuration. - `oversize_handling`**Type**: `STRING`**Provider name**: `OversizeHandling`**Description**: What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. - For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL `AssociationConfig`, for additional processing fees. The options for oversize handling are the following: - `CONTINUE` - Inspect the available body contents normally, according to the rule inspection criteria. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. You can combine the `MATCH` or `NO_MATCH` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.**Default**: `CONTINUE` - `cookies`**Type**: `STRUCT`**Provider name**: `Cookies`**Description**: Inspect the request cookies. You must configure scope and pattern matching filters in the `Cookies` object, to define the set of cookies and the parts of the cookies that WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the `Cookies` object. WAF applies the pattern matching filters to the cookies that it receives from the underlying host service. - `match_pattern`**Type**: `STRUCT`**Provider name**: `MatchPattern`**Description**: The filter to use to identify the subset of cookies to inspect in a web request. You must specify exactly one setting: either `All`, `IncludedCookies`, or `ExcludedCookies`. Example JSON: `"MatchPattern": { "IncludedCookies": [ "session-id-time", "session-id" ] }` - `all`**Type**: `STRUCT`**Provider name**: `All`**Description**: Inspect all cookies. - `excluded_cookies`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `ExcludedCookies`**Description**: Inspect only the cookies whose keys don't match any of the strings specified here. - `included_cookies`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `IncludedCookies`**Description**: Inspect only the cookies that have a key that matches one of the strings specified here. - `match_scope`**Type**: `STRING`**Provider name**: `MatchScope`**Description**: The parts of the cookies to inspect with the rule inspection criteria. If you specify `ALL`, WAF inspects both keys and values. `All` does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical `AND` statement to combine two match rules, one that inspects the keys and another that inspects the values. - `oversize_handling`**Type**: `STRING`**Provider name**: `OversizeHandling`**Description**: What WAF should do if the cookies of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request cookies when they exceed 8 KB (8192 bytes) or 200 total cookies. The underlying host service forwards a maximum of 200 cookies and at most 8 KB of cookie contents to WAF. The options for oversize handling are the following: - `CONTINUE` - Inspect the available cookies normally, according to the rule inspection criteria. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. - `header_order`**Type**: `STRUCT`**Provider name**: `HeaderOrder`**Description**: Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example `host:user-agent:accept:authorization:referer`. - `oversize_handling`**Type**: `STRING`**Provider name**: `OversizeHandling`**Description**: What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF. The options for oversize handling are the following: - `CONTINUE` - Inspect the available headers normally, according to the rule inspection criteria. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. - `headers`**Type**: `STRUCT`**Provider name**: `Headers`**Description**: Inspect the request headers. You must configure scope and pattern matching filters in the `Headers` object, to define the set of headers to and the parts of the headers that WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the `Headers` object. WAF applies the pattern matching filters to the headers that it receives from the underlying host service. - `match_pattern`**Type**: `STRUCT`**Provider name**: `MatchPattern`**Description**: The filter to use to identify the subset of headers to inspect in a web request. You must specify exactly one setting: either `All`, `IncludedHeaders`, or `ExcludedHeaders`. Example JSON: `"MatchPattern": { "ExcludedHeaders": [ "KeyToExclude1", "KeyToExclude2" ] }` - `all`**Type**: `STRUCT`**Provider name**: `All`**Description**: Inspect all headers. - `excluded_headers`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `ExcludedHeaders`**Description**: Inspect only the headers whose keys don't match any of the strings specified here. - `included_headers`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `IncludedHeaders`**Description**: Inspect only the headers that have a key that matches one of the strings specified here. - `match_scope`**Type**: `STRING`**Provider name**: `MatchScope`**Description**: The parts of the headers to match with the rule inspection criteria. If you specify `ALL`, WAF inspects both keys and values. `All` does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical `AND` statement to combine two match rules, one that inspects the keys and another that inspects the values. - `oversize_handling`**Type**: `STRING`**Provider name**: `OversizeHandling`**Description**: What WAF should do if the headers of the request are more numerous or larger than WAF can inspect. WAF does not support inspecting the entire contents of request headers when they exceed 8 KB (8192 bytes) or 200 total headers. The underlying host service forwards a maximum of 200 headers and at most 8 KB of header contents to WAF. The options for oversize handling are the following: - `CONTINUE` - Inspect the available headers normally, according to the rule inspection criteria. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. - `ja3_fingerprint`**Type**: `STRUCT`**Provider name**: `JA3Fingerprint`**Description**: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.You can use this choice only with a string match `ByteMatchStatement` with the `PositionalConstraint` set to `EXACTLY`.You can obtain the JA3 fingerprint for client requests from the web ACL logs. If WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see [Log fields](https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html) in the WAF Developer Guide. Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration. - `fallback_behavior`**Type**: `STRING`**Provider name**: `FallbackBehavior`**Description**: The match status to assign to the web request if the request doesn't have a JA3 fingerprint. You can specify the following fallback behaviors: - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. - `json_body`**Type**: `STRUCT`**Provider name**: `JsonBody`**Description**: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. - For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL `AssociationConfig`, for additional processing fees. For information about how to handle oversized request bodies, see the `JsonBody` object configuration. - `invalid_fallback_behavior`**Type**: `STRING`**Provider name**: `InvalidFallbackBehavior`**Description**: What WAF should do if it fails to completely parse the JSON body. The options are the following: - `EVALUATE_AS_STRING` - Inspect the body as plain text. WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. If you don't provide this setting, WAF parses and evaluates the content only up to the first parsing failure that it encounters.WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, WAF doesn't apply the fallback behavior. For more information, see [JSON body](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body) in the WAF Developer Guide. - `match_pattern`**Type**: `STRUCT`**Provider name**: `MatchPattern`**Description**: The patterns to look for in the JSON body. WAF inspects the results of these pattern matches against the rule inspection criteria. - `all`**Type**: `STRUCT`**Provider name**: `All`**Description**: Match all of the elements. See also `MatchScope` in JsonBody. You must specify either this setting or the `IncludedPaths` setting, but not both. - `included_paths`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `IncludedPaths`**Description**: Match only the specified include paths. See also `MatchScope` in JsonBody. Provide the include paths using JSON Pointer syntax. For example, `"IncludedPaths": ["/dogs/0/name", "/dogs/1/name"]`. For information about this syntax, see the Internet Engineering Task Force (IETF) documentation [JavaScript Object Notation (JSON) Pointer](https://tools.ietf.org/html/rfc6901). You must specify either this setting or the `All` setting, but not both.Don't use this option to include all paths. Instead, use the `All` setting. - `match_scope`**Type**: `STRING`**Provider name**: `MatchScope`**Description**: The parts of the JSON to match against using the `MatchPattern`. If you specify `ALL`, WAF matches against keys and values. `All` does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical `AND` statement to combine two match rules, one that inspects the keys and another that inspects the values. - `oversize_handling`**Type**: `STRING`**Provider name**: `OversizeHandling`**Description**: What WAF should do if the body is larger than WAF can inspect. WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to WAF for inspection. - For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL `AssociationConfig`, for additional processing fees. The options for oversize handling are the following: - `CONTINUE` - Inspect the available body contents normally, according to the rule inspection criteria. - `MATCH` - Treat the web request as matching the rule statement. WAF applies the rule action to the request. - `NO_MATCH` - Treat the web request as not matching the rule statement. You can combine the `MATCH` or `NO_MATCH` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit.**Default**: `CONTINUE` - `method`**Type**: `STRUCT`**Provider name**: `Method`**Description**: Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform. - `query_string`**Type**: `STRUCT`**Provider name**: `QueryString`**Description**: Inspect the query string. This is the part of a URL that appears after a `?` character, if any. - `single_header`**Type**: `STRUCT`**Provider name**: `SingleHeader`**Description**: Inspect a single header. Provide the name of the header to inspect, for example, `User-Agent` or `Referer`. This setting isn't case sensitive. Example JSON: `"SingleHeader": { "Name": "haystack" }` Alternately, you can filter and inspect all headers with the `Headers` `FieldToMatch` setting. - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the query header to inspect. - `single_query_argument`**Type**: `STRUCT`**Provider name**: `SingleQueryArgument`**Description**: Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn't case sensitive. Example JSON: `"SingleQueryArgument": { "Name": "myArgument" }` - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the query argument to inspect. - `uri_path`**Type**: `STRUCT`**Provider name**: `UriPath`**Description**: Inspect the request URI path. This is the part of the web request that identifies a resource, for example, `/images/daily-ad.jpg`. - `resource_arn`**Type**: `STRING`**Provider name**: `ResourceArn`**Description**: The Amazon Resource Name (ARN) of the web ACL that you want to associate with `LogDestinationConfigs`. ## `name`{% #name %} **Type**: `STRING`**Provider name**: `Name`**Description**: The name of the web ACL. You cannot change the name of a web ACL after you create it. ## `resource_arns`{% #resource_arns %} **Type**: `UNORDERED_LIST_STRING`**Provider name**: `ResourceArns`**Description**: The array of Amazon Resource Names (ARNs) of the associated resources. ## `tags`{% #tags %} **Type**: `UNORDERED_LIST_STRING` ## `web_acl`{% #web_acl %} **Type**: `STRUCT`**Provider name**: `WebACL`**Description**: The web ACL specification. You can modify the settings in this web ACL and use it to update this web ACL or create a new one. - `arn`**Type**: `STRING`**Provider name**: `ARN`**Description**: The Amazon Resource Name (ARN) of the web ACL that you want to associate with the resource. - `association_config`**Type**: `STRUCT`**Provider name**: `AssociationConfig`**Description**: Specifies custom configurations for the associations between the web ACL and protected resources. Use this to customize the maximum size of the request body that your protected resources forward to WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see [WAF Pricing](http://aws.amazon.com/waf/pricing/).For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - `request_body`**Type**: `STRING`**Provider name**: `RequestBody`**Description**: Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to WAF for inspection. The default size is 16 KB (16,384 bytes). You can change the setting for any of the available resource types.You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see [WAF Pricing](http://aws.amazon.com/waf/pricing/).Example JSON: `{ "API_GATEWAY": "KB_48", "APP_RUNNER_SERVICE": "KB_32" }` For Application Load Balancer and AppSync, the limit is fixed at 8 KB (8,192 bytes). - `capacity`**Type**: `INT64`**Provider name**: `Capacity`**Description**: The web ACL capacity units (WCUs) currently being used by this web ACL. WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. For more information, see [WAF web ACL capacity units (WCU)](https://docs.aws.amazon.com/waf/latest/developerguide/aws-waf-capacity-units.html) in the WAF Developer Guide. - `captcha_config`**Type**: `STRUCT`**Provider name**: `CaptchaConfig`**Description**: Specifies how WAF should handle `CAPTCHA` evaluations for rules that don't have their own `CaptchaConfig` settings. If you don't specify this, WAF uses its default settings for `CaptchaConfig`. - `immunity_time_property`**Type**: `STRUCT`**Provider name**: `ImmunityTimeProperty`**Description**: Determines how long a `CAPTCHA` timestamp in the token remains valid after the client successfully solves a `CAPTCHA` puzzle. - `immunity_time`**Type**: `INT64`**Provider name**: `ImmunityTime`**Description**: The amount of time, in seconds, that a `CAPTCHA` or challenge timestamp is considered valid by WAF. The default setting is 300. For the Challenge action, the minimum setting is 300. - `challenge_config`**Type**: `STRUCT`**Provider name**: `ChallengeConfig`**Description**: Specifies how WAF should handle challenge evaluations for rules that don't have their own `ChallengeConfig` settings. If you don't specify this, WAF uses its default settings for `ChallengeConfig`. - `immunity_time_property`**Type**: `STRUCT`**Provider name**: `ImmunityTimeProperty`**Description**: Determines how long a challenge timestamp in the token remains valid after the client successfully responds to a challenge. - `immunity_time`**Type**: `INT64`**Provider name**: `ImmunityTime`**Description**: The amount of time, in seconds, that a `CAPTCHA` or challenge timestamp is considered valid by WAF. The default setting is 300. For the Challenge action, the minimum setting is 300. - `custom_response_bodies`**Type**: `STRING`**Provider name**: `CustomResponseBodies`**Description**: A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the web ACL, and then use them in the rules and default actions that you define in the web ACL. For information about customizing web requests and responses, see [Customizing web requests and responses in WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. For information about the limits on count and size for custom request and response settings, see [WAF quotas](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the WAF Developer Guide. - `default_action`**Type**: `STRUCT`**Provider name**: `DefaultAction`**Description**: The action to perform if none of the `Rules` contained in the `WebACL` match. - `allow`**Type**: `STRUCT`**Provider name**: `Allow`**Description**: Specifies that WAF should allow requests by default. - `custom_request_handling`**Type**: `STRUCT`**Provider name**: `CustomRequestHandling`**Description**: Defines custom handling for the web request. For information about customizing web requests and responses, see [Customizing web requests and responses in WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. - `insert_headers`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `InsertHeaders`**Description**: The HTTP headers to insert into the request. Duplicate header names are not allowed. For information about the limits on count and size for custom request and response settings, see [WAF quotas](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the WAF Developer Guide. - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the custom header. For custom request header insertion, when WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, WAF inserts the header `x-amzn-waf-sample`. - `value`**Type**: `STRING`**Provider name**: `Value`**Description**: The value of the custom header. - `block`**Type**: `STRUCT`**Provider name**: `Block`**Description**: Specifies that WAF should block requests by default. - `custom_response`**Type**: `STRUCT`**Provider name**: `CustomResponse`**Description**: Defines a custom response for the web request. For information about customizing web requests and responses, see [Customizing web requests and responses in WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the WAF Developer Guide. - `custom_response_body_key`**Type**: `STRING`**Provider name**: `CustomResponseBodyKey`**Description**: References the response body that you want WAF to return to the web request client. You can define a custom response for a rule action or a default web ACL action that is set to block. To do this, you first define the response body key and value in the `CustomResponseBodies` setting for the WebACL or RuleGroup where you want to use it. Then, in the rule action or web ACL default action `BlockAction` setting, you reference the response body using this key. - `response_code`**Type**: `INT32`**Provider name**: `ResponseCode`**Description**: The HTTP status code to return to the client. For a list of status codes that you can use in your custom responses, see [Supported status codes for custom response](https://docs.aws.amazon.com/waf/latest/developerguide/customizing-the-response-status-codes.html) in the WAF Developer Guide. - `response_headers`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `ResponseHeaders`**Description**: The HTTP headers to use in the response. You can specify any header name except for `content-type`. Duplicate header names are not allowed. For information about the limits on count and size for custom request and response settings, see [WAF quotas](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the WAF Developer Guide. - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the custom header. For custom request header insertion, when WAF inserts the header into the request, it prefixes this name `x-amzn-waf-`, to avoid confusion with the headers that are already in the request. For example, for the header name `sample`, WAF inserts the header `x-amzn-waf-sample`. - `value`**Type**: `STRING`**Provider name**: `Value`**Description**: The value of the custom header. - `description`**Type**: `STRING`**Provider name**: `Description`**Description**: A description of the web ACL that helps with identification. - `id`**Type**: `STRING`**Provider name**: `Id`**Description**: A unique identifier for the `WebACL`. This ID is returned in the responses to create and list commands. You use this ID to do things like get, update, and delete a `WebACL`. - `label_namespace`**Type**: `STRING`**Provider name**: `LabelNamespace`**Description**: The label namespace prefix for this web ACL. All labels added by rules in this web ACL have this prefix. - The syntax for the label namespace prefix for a web ACL is the following: `awswaf::webacl::` - When a rule with a label matches a web request, WAF adds the fully qualified label to the request. A fully qualified label is made up of the label namespace from the rule group or web ACL where the rule is defined and the label from the rule, separated by a colon: `