@pulumi/aws-native
Version:
The Pulumi AWS Cloud Control Provider enables you to build, deploy, and manage [any AWS resource that's supported by the AWS Cloud Control API](https://github.com/pulumi/pulumi-aws-native/blob/master/provider/cmd/pulumi-gen-aws-native/supported-types.txt)
207 lines (206 loc) • 14.4 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "../types/input";
import * as outputs from "../types/output";
import * as enums from "../types/enums";
/**
* Contains the Rules that identify the requests that you want to allow, block, or count. In a WebACL, you also specify a default action (ALLOW or BLOCK), and the action for each Rule that you add to a WebACL, for example, block requests from specified IP addresses or block requests from specified referrers. You also associate the WebACL with a CloudFront distribution to identify the requests that you want AWS WAF to filter. If you add more than one Rule to a WebACL, a request needs to match only one of the specifications to be allowed, blocked, or counted.
*/
export declare class WebAcl extends pulumi.CustomResource {
/**
* Get an existing WebAcl resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, opts?: pulumi.CustomResourceOptions): WebAcl;
/**
* Returns true if the given object is an instance of WebAcl. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is WebAcl;
/**
* The Amazon Resource Name (ARN) of the web ACL.
*/
readonly arn: pulumi.Output<string>;
/**
* Specifies custom configurations for the associations between the web ACL and protected resources.
*
* Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).
*
* > You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see [AWS WAF Pricing](https://docs.aws.amazon.com/waf/pricing/) .
*
* For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
*/
readonly associationConfig: pulumi.Output<outputs.wafv2.WebAclAssociationConfig | undefined>;
/**
* The ID of the web ACL.
*/
readonly awsId: pulumi.Output<string>;
/**
* The web ACL capacity units (WCUs) currently being used by this web ACL.
*
* AWS WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.
*/
readonly capacity: pulumi.Output<number>;
/**
* Specifies how AWS WAF should handle `CAPTCHA` evaluations for rules that don't have their own `CaptchaConfig` settings. If you don't specify this, AWS WAF uses its default settings for `CaptchaConfig` .
*/
readonly captchaConfig: pulumi.Output<outputs.wafv2.WebAclCaptchaConfig | undefined>;
/**
* Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own `ChallengeConfig` settings. If you don't specify this, AWS WAF uses its default settings for `ChallengeConfig` .
*/
readonly challengeConfig: pulumi.Output<outputs.wafv2.WebAclChallengeConfig | undefined>;
/**
* A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the web ACL, and then use them in the rules and default actions that you define in the web ACL.
*
* For information about customizing web requests and responses, see [Customizing web requests and responses in AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the *AWS WAF Developer Guide* .
*
* For information about the limits on count and size for custom request and response settings, see [AWS WAF quotas](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the *AWS WAF Developer Guide* .
*/
readonly customResponseBodies: pulumi.Output<{
[key: string]: outputs.wafv2.WebAclCustomResponseBody;
} | undefined>;
/**
* Collection of dataProtects.
*/
readonly dataProtectionConfig: pulumi.Output<outputs.wafv2.WebAclDataProtectionConfig | undefined>;
/**
* The action to perform if none of the `Rules` contained in the `WebACL` match.
*/
readonly defaultAction: pulumi.Output<outputs.wafv2.WebAclDefaultAction>;
/**
* A description of the web ACL that helps with identification.
*/
readonly description: pulumi.Output<string | undefined>;
/**
* The label namespace prefix for this web ACL. All labels added by rules in this web ACL have this prefix.
*
* The syntax for the label namespace prefix for a web ACL is the following: `awswaf:<account ID>:webacl:<web ACL name>:`
*
* When a rule with a label matches a web request, AWS WAF adds the fully qualified label to the request. A fully qualified label is made up of the label namespace from the rule group or web ACL where the rule is defined and the label from the rule, separated by a colon.
*/
readonly labelNamespace: pulumi.Output<string>;
/**
* The name of the web ACL. You cannot change the name of a web ACL after you create it.
*/
readonly name: pulumi.Output<string | undefined>;
/**
* Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
*/
readonly onSourceDDoSProtectionConfig: pulumi.Output<outputs.wafv2.WebAclOnSourceDDoSProtectionConfig | undefined>;
/**
* Collection of Rules.
*/
readonly rules: pulumi.Output<outputs.wafv2.WebAclRule[] | undefined>;
/**
* Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use `CLOUDFRONT` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are `CLOUDFRONT` and `REGIONAL` .
*
* > For `CLOUDFRONT` , you must create your WAFv2 resources in the US East (N. Virginia) Region, `us-east-1` .
*
* For information about how to define the association of the web ACL with your resource, see `WebACLAssociation` .
*/
readonly scope: pulumi.Output<enums.wafv2.WebAclScope>;
/**
* Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource.
*
* > To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
*/
readonly tags: pulumi.Output<outputs.Tag[] | undefined>;
/**
* Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
*/
readonly tokenDomains: pulumi.Output<string[] | undefined>;
/**
* Defines and enables Amazon CloudWatch metrics and web request sample collection.
*/
readonly visibilityConfig: pulumi.Output<outputs.wafv2.WebAclVisibilityConfig>;
/**
* Create a WebAcl resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: WebAclArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* The set of arguments for constructing a WebAcl resource.
*/
export interface WebAclArgs {
/**
* Specifies custom configurations for the associations between the web ACL and protected resources.
*
* Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).
*
* > You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see [AWS WAF Pricing](https://docs.aws.amazon.com/waf/pricing/) .
*
* For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
*/
associationConfig?: pulumi.Input<inputs.wafv2.WebAclAssociationConfigArgs>;
/**
* Specifies how AWS WAF should handle `CAPTCHA` evaluations for rules that don't have their own `CaptchaConfig` settings. If you don't specify this, AWS WAF uses its default settings for `CaptchaConfig` .
*/
captchaConfig?: pulumi.Input<inputs.wafv2.WebAclCaptchaConfigArgs>;
/**
* Specifies how AWS WAF should handle challenge evaluations for rules that don't have their own `ChallengeConfig` settings. If you don't specify this, AWS WAF uses its default settings for `ChallengeConfig` .
*/
challengeConfig?: pulumi.Input<inputs.wafv2.WebAclChallengeConfigArgs>;
/**
* A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the web ACL, and then use them in the rules and default actions that you define in the web ACL.
*
* For information about customizing web requests and responses, see [Customizing web requests and responses in AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html) in the *AWS WAF Developer Guide* .
*
* For information about the limits on count and size for custom request and response settings, see [AWS WAF quotas](https://docs.aws.amazon.com/waf/latest/developerguide/limits.html) in the *AWS WAF Developer Guide* .
*/
customResponseBodies?: pulumi.Input<{
[key: string]: pulumi.Input<inputs.wafv2.WebAclCustomResponseBodyArgs>;
}>;
/**
* Collection of dataProtects.
*/
dataProtectionConfig?: pulumi.Input<inputs.wafv2.WebAclDataProtectionConfigArgs>;
/**
* The action to perform if none of the `Rules` contained in the `WebACL` match.
*/
defaultAction: pulumi.Input<inputs.wafv2.WebAclDefaultActionArgs>;
/**
* A description of the web ACL that helps with identification.
*/
description?: pulumi.Input<string>;
/**
* The name of the web ACL. You cannot change the name of a web ACL after you create it.
*/
name?: pulumi.Input<string>;
/**
* Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.
*/
onSourceDDoSProtectionConfig?: pulumi.Input<inputs.wafv2.WebAclOnSourceDDoSProtectionConfigArgs>;
/**
* Collection of Rules.
*/
rules?: pulumi.Input<pulumi.Input<inputs.wafv2.WebAclRuleArgs>[]>;
/**
* Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use `CLOUDFRONT` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are `CLOUDFRONT` and `REGIONAL` .
*
* > For `CLOUDFRONT` , you must create your WAFv2 resources in the US East (N. Virginia) Region, `us-east-1` .
*
* For information about how to define the association of the web ACL with your resource, see `WebACLAssociation` .
*/
scope: pulumi.Input<enums.wafv2.WebAclScope>;
/**
* Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource.
*
* > To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
*/
tags?: pulumi.Input<pulumi.Input<inputs.TagArgs>[]>;
/**
* Specifies the domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
*/
tokenDomains?: pulumi.Input<pulumi.Input<string>[]>;
/**
* Defines and enables Amazon CloudWatch metrics and web request sample collection.
*/
visibilityConfig: pulumi.Input<inputs.wafv2.WebAclVisibilityConfigArgs>;
}