Set by controls 1

Active controls fix these values.

• visibility_configobject({...}), set to {}Visibility configuration for the Web ACL. Defines CloudWatch metrics configuration

Optional 22

• association_configmap({...}), default {}Configuration for body inspection size limits per resource type. Keys are resource types (e.g., CLOUDFRONT, API_GATEWAY, COGNITO_USER_POOL, APP_RUNNER_SERVICE, VERIFIED_ACCESS_INSTANCE)
• association_resource_arnsmap(string), default {}Map of resource ARNs to associate with the Web ACL. Key is a friendly name, value is the resource ARN
• captcha_configobject({...}), default nullCAPTCHA configuration for the Web ACL. Specifies how long a CAPTCHA timestamp is considered valid
• challenge_configobject({...}), default nullChallenge configuration for the Web ACL. Specifies how long a challenge timestamp is considered valid
• createbool, default trueControls if resources should be created (affects all resources)
• create_logging_configurationbool, default falseControls if a logging configuration should be created for the Web ACL
• custom_response_bodiesmap({...}), default {}Map of custom response body configurations. Key is the reference key, used in custom responses
• data_protection_configany, default nullData protection configuration. data_protections is a list of objects with field (object with field_keys list and field_type one of SINGLE_HEADER/SINGLE_COOKIE/SINGLE_QUERY_ARGUMENT/QUERY_STRING/BODY), action (HASH or SUBSTITUTION), exclude_rate_based_details (bool, optional), and exclude_rule_match_details (bool, optional)
• default_actionany, default "allow"Action to perform if none of the rules contained in the Web ACL match. Use allow or block for simple actions, or provide an object for custom request handling/response. See examples for object structure
• descriptionstring, default nullA friendly description of the Web ACL
• logging_filterobject({...}), default nullA configuration block that specifies which web requests are kept in the logs and which are dropped
• logging_log_destination_configslist(string), default []The Amazon Kinesis Data Firehose, CloudWatch Log Group, or S3 Bucket ARNs for the logging destination. Names must be prefixed with aws-waf-logs-
• logging_redacted_fieldslist({...}), default []The parts of the request that you want to keep out of the logs. Each entry must specify exactly one of method, query_string, uri_path, or single_header
• logging_regionstring, default nullRegion where the WAF logging configuration will be managed. Defaults to the provider region
• namestring, default nullA friendly name of the Web ACL. Mutually exclusive with name_prefix
• name_prefixstring, default nullCreates a unique name beginning with the specified prefix. Mutually exclusive with name (provider rejects both being set at apply time)
• putin_khuylobool, default trueDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Russian_invasion_of_Ukraine
• rule_jsonstring, default nullEscape hatch: JSON string of WAF rules for cases where dynamic blocks cannot represent all provider features. Mutually exclusive with rules
• rulesany, default {}Map of WAF rule configurations. The key is used as the rule name. Each rule supports: - priority - (Required) Rule priority (lower = evaluated first) - action - Action for standalone rules. Use string (allow, block, count, captcha, challenge) or object for custom response - override_action - Override action for managed/rule group rules. Use string (none, count) or object - statement - (Required) Rule statement configuration. See AWS provider docs for statement structure - visibility_config - CloudWatch metrics config. Auto-generated from rule key if omitted - captcha_config - Optional CAPTCHA configuration - challenge_config - Optional challenge configuration - rule_labels - Optional list of labels to add to matching requests See examples/complete for usage patterns.
• scopestring, default "REGIONAL"Specifies whether this is for an AWS CloudFront distribution or for a regional application. Valid values are CLOUDFRONT or REGIONAL
• tagsmap(string), default {}A map of tags to add to all resources
• token_domainslist(string), default []Specifies the domains that AWS WAF should accept in a web request token. Enables token use across multiple protected resources