WafConfig

Defined in: packages/core/src/config/types.ts:632

Config shape for declaring a WAFv2 WebACL — Phase 3C (design §5.1).

Extends the L1 wafv2.CfnWebACLProps so every CDK option (customResponseBodies, tags, description, …) passes through. Axis controls name, scope, defaultAction, visibilityConfig and rules (the framework supplies secure managed-rule defaults), so those are omitted and re-exposed below as Axis fields.

Defaults (applied when rules is absent): the three AWS managed rule groups (Common + KnownBadInputs + AmazonIpReputationList) plus a default-on rate-based rule. rules fully replaces this default set; additionalRules appends to it; rateLimit: false disables the rate rule; defaultAction: "BLOCK" flips the default action.

Extends

Omit<wafv2.CfnWebACLProps, "name" | "scope" | "defaultAction" | "visibilityConfig" | "rules">

Properties

additionalRules?

optional additionalRules?: RuleProperty[]

Defined in: packages/core/src/config/types.ts:647

Appended to the default managed-rule set (ignored when rules is set).

applicationConfig?

readonly optional applicationConfig?: ApplicationConfigProperty | IResolvable

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7234

Returns a list of ApplicationAttribute s.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-applicationconfig

Inherited from

Omit.applicationConfig

associationConfig?

readonly optional associationConfig?: IResolvable | AssociationConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7246

Specifies custom configurations for the associations between the web ACL and protected resources.

Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see AWS WAF Pricing .

For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-associationconfig

Inherited from

Omit.associationConfig

baseName

baseName: string

Defined in: packages/core/src/config/types.ts:639

Logical name used for SSM keys + WebACL/metric naming.

captchaConfig?

readonly optional captchaConfig?: IResolvable | CaptchaConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7254

Specifies how AWS WAF should handle CAPTCHA evaluations for rules that don’t have their own CaptchaConfig settings.

If you don’t specify this, AWS WAF uses its default settings for CaptchaConfig .

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-captchaconfig

Inherited from

Omit.captchaConfig

challengeConfig?

readonly optional challengeConfig?: IResolvable | ChallengeConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7262

Specifies how AWS WAF should handle challenge evaluations for rules that don’t have their own ChallengeConfig settings.

If you don’t specify this, AWS WAF uses its default settings for ChallengeConfig .

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-challengeconfig

Inherited from

Omit.challengeConfig

constructId

constructId: string

Defined in: packages/core/src/config/types.ts:637

CFN logical ID — NEVER change once deployed.

customResponseBodies?

readonly optional customResponseBodies?: IResolvable | Record<string, IResolvable | CustomResponseBodyProperty>

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7274

A map of custom response keys and content bodies.

When you create a rule with a block action, you can send a custom response to the web request. You define these for the web ACL, and then use them in the rules and default actions that you define in the web ACL.

For information about customizing web requests and responses, see Customizing web requests and responses in AWS WAF in the AWS WAF Developer Guide .

For information about the limits on count and size for custom request and response settings, see AWS WAF quotas in the AWS WAF Developer Guide .

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-customresponsebodies

Inherited from

Omit.customResponseBodies

dataProtectionConfig?

readonly optional dataProtectionConfig?: IResolvable | DataProtectionConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7284

Specifies data protection to apply to the web request data for the web ACL.

This is a web ACL level data protection option.

The data protection that you configure for the web ACL alters the data that’s available for any other data collection activity, including your AWS WAF logging destinations, web ACL request sampling, and Amazon Security Lake data collection and management. Your other option for data protection is in the logging configuration, which only affects logging.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-dataprotectionconfig

Inherited from

Omit.dataProtectionConfig

defaultAction?

optional defaultAction?: "ALLOW" | "BLOCK"

Defined in: packages/core/src/config/types.ts:643

Default action when no rule matches. Default “ALLOW”.

description?

readonly optional description?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7296

A description of the web ACL that helps with identification.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-description

Inherited from

Omit.description

monetizationConfig?

readonly optional monetizationConfig?: IResolvable | MonetizationConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7302

Configures monetization for the web ACL or rule group.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-monetizationconfig

Inherited from

Omit.monetizationConfig

onSourceDDoSProtectionConfig?

readonly optional onSourceDDoSProtectionConfig?: IResolvable | OnSourceDDoSProtectionConfigProperty

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7316

Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-onsourceddosprotectionconfig

Inherited from

Omit.onSourceDDoSProtectionConfig

rateLimit?

optional rateLimit?: false | WafRateRuleConfig

Defined in: packages/core/src/config/types.ts:649

Rate-based rule. Default on (2000/5min/IP). false disables.

rules?

optional rules?: RuleProperty[]

Defined in: packages/core/src/config/types.ts:645

FULL replacement for the framework default managed-rule set.

scope

scope: WafScope

Defined in: packages/core/src/config/types.ts:641

REGIONAL (API GW / ALB) or CLOUDFRONT (must be a us-east-1 stack).

tags?

readonly optional tags?: CfnTag[]

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7346

Key:value pairs associated with an AWS resource.

The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each AWS resource.

To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-tags

Inherited from

Omit.tags

tokenDomains?

readonly optional tokenDomains?: string[]

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-wafv2/lib/wafv2.generated.d.ts:7354

Specifies the domains that AWS WAF should accept in a web request token.

This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don’t specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource’s host domain plus all domains in the token domain list, including their prefixed subdomains.

See

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webacl.html#cfn-wafv2-webacl-tokendomains

Inherited from

Omit.tokenDomains