AssociationConfig

Specifies custom configurations for the associations between the web ACL and protected resources.

Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes).

Note

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see AWS WAF Pricing.

For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB (8,192 bytes).

You can also use this to have your CloudFront distributions insert the AWS WAF challenge JavaScript SDK into the HTML responses that they return. For more information, see the ChallengeJavascriptSdkInjection setting.

ChallengeJavascriptSdkInjection

Specifies the CloudFront distributions that insert the AWS WAF challenge JavaScript SDK into the HTML responses that they return. When you enable this setting for a distribution, you do not add the SDK to your web pages yourself.

You can configure this setting only for CloudFront distributions, using the CLOUDFRONT map key. AWS WAF rejects any other resource type, and the setting is not available for regional resources. To configure it, use the CloudFront scope.

Your web ACL must also contain at least one of the following qualifying managed rule groups. AWS WAF Bot Control qualifies only at the TARGETED inspection level, not at COMMON:

The AWS WAF Bot Control managed rule group AWSManagedRulesBotControlRuleSet, with the inspection level set to TARGETED.
The AWS WAF Fraud Control account takeover prevention (ATP) managed rule group AWSManagedRulesATPRuleSet.
The AWS WAF Fraud Control account creation fraud prevention (ACFP) managed rule group AWSManagedRulesACFPRuleSet.

If you remove the last qualifying managed rule group from the web ACL, or lower the AWS WAF Bot Control inspection level from TARGETED to COMMON, you must remove this setting in the same update. Otherwise, AWS WAF rejects the update.

Example JSON: { "CLOUDFRONT": {} }

If you omit this setting, CloudFront does not insert the SDK. When you omit it from a web ACL that previously used it, cached HTML that already contains the SDK is still served until it expires, or until you invalidate the cache for that distribution. For more information, see Automatic SDK integration for CloudFront distributions in the AWS WAF Developer Guide.

Type: String to ChallengeJavascriptSdkInjectionConfig object map

Map Entries: Maximum number of items.

Required: No

RequestBody

Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to AWS WAF for inspection. The default size is 16 KB (16,384 bytes). You can change the setting for any of the available resource types.

Note

You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see AWS WAF Pricing.

Example JSON: { "API_GATEWAY": "KB_48", "APP_RUNNER_SERVICE": "KB_32" }

For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB (8,192 bytes).

Type: String to RequestBodyAssociatedResourceTypeConfig object map

Required: No

AssociationConfig

Note

Contents

Note

See Also