# AWS::WAFv2 Construct Library

This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.

```ts
import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
```

There are no official hand-written ([L2](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) constructs for this service yet. Here are some suggestions on how to proceed:

- Search [Construct Hub for WAFv2 construct libraries](https://constructs.dev/search?q=wafv2)
- Use the automatically generated [L1](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_l1_using) constructs, in the same way you would use [the CloudFormation AWS::WAFv2 resources](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_WAFv2.html) directly.

There are no hand-written ([L2](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_lib)) constructs for this service yet.
However, you can still use the automatically generated [L1](https://docs.aws.amazon.com/cdk/latest/guide/constructs.html#constructs_l1_using) constructs, and use this service exactly as you would using CloudFormation directly.

For more information on the resources and properties available for this service, see the [CloudFormation documentation for AWS::WAFv2](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_WAFv2.html).

(Read the [CDK Contributing Guide](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and submit an RFC if you are interested in contributing to this construct library.)

## Types

| Name | Kind | Summary |
| --- | --- | --- |
| [`CfnIPSet`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnIPSet) | Construct (L1) | > This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. |
| [`CfnLoggingConfiguration`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration) | Construct (L1) | Defines an association between logging destinations and a web ACL resource, for logging from AWS WAF . |
| [`CfnRegexPatternSet`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRegexPatternSet) | Construct (L1) | > This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. |
| [`CfnRuleGroup`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup) | Construct (L1) | > This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. |
| [`CfnWebACL`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL) | Construct (L1) | > This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. |
| [`CfnWebACLAssociation`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACLAssociation) | Construct (L1) | > This is the latest version of *AWS WAF* , named AWS WAF V2, released in November, 2019. |
| [`CfnIPSetProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnIPSetProps) | Struct | Properties for defining a `CfnIPSet`. |
| [`CfnLoggingConfiguration.ActionConditionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.ActionConditionProperty) | Struct | A single action condition for a condition in a logging filter. |
| [`CfnLoggingConfiguration.ConditionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.ConditionProperty) | Struct | A single match condition for a log filter. |
| [`CfnLoggingConfiguration.FieldToMatchProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.FieldToMatchProperty) | Struct | The parts of the request that you want to keep out of the logs. |
| [`CfnLoggingConfiguration.FilterProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.FilterProperty) | Struct | A single logging filter, used in `LoggingFilter` . |
| [`CfnLoggingConfiguration.JsonBodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.JsonBodyProperty) | Struct |  |
| [`CfnLoggingConfiguration.LabelNameConditionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.LabelNameConditionProperty) | Struct | A single label name condition for a condition in a logging filter. |
| [`CfnLoggingConfiguration.LoggingFilterProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.LoggingFilterProperty) | Struct | Filtering that specifies which web requests are kept in the logs and which are dropped, defined for a web ACL's `LoggingConfiguration` . |
| [`CfnLoggingConfiguration.MatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.MatchPatternProperty) | Struct |  |
| [`CfnLoggingConfiguration.SingleHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfiguration.SingleHeaderProperty) | Struct | Inspect one of the headers in the web request, identified by name, for example, `User-Agent` or `Referer` . |
| [`CfnLoggingConfigurationProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnLoggingConfigurationProps) | Struct | Properties for defining a `CfnLoggingConfiguration`. |
| [`CfnRegexPatternSetProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRegexPatternSetProps) | Struct | Properties for defining a `CfnRegexPatternSet`. |
| [`CfnRuleGroup.AllowProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.AllowProperty) | Struct | Allow traffic towards application. |
| [`CfnRuleGroup.AndStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.AndStatementProperty) | Struct | A logical rule statement used to combine other rule statements with AND logic. |
| [`CfnRuleGroup.AsnMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.AsnMatchStatementProperty) | Struct | A rule statement that inspects web traffic based on the Autonomous System Number (ASN) associated with the request's IP address. |
| [`CfnRuleGroup.BlockProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.BlockProperty) | Struct | Block traffic towards application. |
| [`CfnRuleGroup.BodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.BodyProperty) | Struct | Inspect the body of the web request. The body immediately follows the request headers. |
| [`CfnRuleGroup.ByteMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.ByteMatchStatementProperty) | Struct | A rule statement that defines a string match search for AWS WAF to apply to web requests. |
| [`CfnRuleGroup.CaptchaConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CaptchaConfigProperty) | Struct | Specifies how AWS WAF should handle `CAPTCHA` evaluations. |
| [`CfnRuleGroup.CaptchaProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CaptchaProperty) | Struct | Checks valid token exists with request. |
| [`CfnRuleGroup.ChallengeConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.ChallengeConfigProperty) | Struct | Specifies how AWS WAF should handle `Challenge` evaluations. |
| [`CfnRuleGroup.ChallengeProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.ChallengeProperty) | Struct | Checks that the request has a valid token with an unexpired challenge timestamp and, if not, returns a browser challenge to the client. |
| [`CfnRuleGroup.CookieMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CookieMatchPatternProperty) | Struct | The filter to use to identify the subset of cookies to inspect in a web request. |
| [`CfnRuleGroup.CookiesProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CookiesProperty) | Struct | Inspect the cookies in the web request. |
| [`CfnRuleGroup.CountProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CountProperty) | Struct | Count traffic towards application. |
| [`CfnRuleGroup.CryptoConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CryptoConfigProperty) | Struct | Configures cryptocurrency payment settings. |
| [`CfnRuleGroup.CustomHTTPHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CustomHTTPHeaderProperty) | Struct | A custom header for custom request and response handling. |
| [`CfnRuleGroup.CustomRequestHandlingProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CustomRequestHandlingProperty) | Struct | Custom request handling behavior that inserts custom headers into a web request. |
| [`CfnRuleGroup.CustomResponseBodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CustomResponseBodyProperty) | Struct | The response body to use in a custom response to a web request. |
| [`CfnRuleGroup.CustomResponseProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.CustomResponseProperty) | Struct | A custom response to send to the client. |
| [`CfnRuleGroup.FieldToMatchProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.FieldToMatchProperty) | Struct | Specifies a web request component to be used in a rule match statement or in a logging configuration. |
| [`CfnRuleGroup.ForwardedIPConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.ForwardedIPConfigurationProperty) | Struct | The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. |
| [`CfnRuleGroup.GeoMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.GeoMatchStatementProperty) | Struct | A rule statement that labels web requests by country and region and that matches against web requests based on country code. |
| [`CfnRuleGroup.HeaderMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.HeaderMatchPatternProperty) | Struct | The filter to use to identify the subset of headers to inspect in a web request. |
| [`CfnRuleGroup.HeaderOrderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.HeaderOrderProperty) | Struct | The string containing the list of a web request's header names, ordered as they appear in the web request, separated by colons. |
| [`CfnRuleGroup.HeadersProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.HeadersProperty) | Struct | Inspect all headers in the web request. |
| [`CfnRuleGroup.ImmunityTimePropertyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.ImmunityTimePropertyProperty) | Struct | Used for CAPTCHA and challenge token settings. |
| [`CfnRuleGroup.IPSetForwardedIPConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.IPSetForwardedIPConfigurationProperty) | Struct | The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. |
| [`CfnRuleGroup.IPSetReferenceStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.IPSetReferenceStatementProperty) | Struct | A rule statement used to detect web requests coming from particular IP addresses or address ranges. |
| [`CfnRuleGroup.JA3FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.JA3FingerprintProperty) | Struct | Available for use with Amazon CloudFront distributions and Application Load Balancers. |
| [`CfnRuleGroup.JA4FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.JA4FingerprintProperty) | Struct | Available for use with Amazon CloudFront distributions and Application Load Balancers. |
| [`CfnRuleGroup.JsonBodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.JsonBodyProperty) | Struct | Inspect the body of the web request as JSON. The body immediately follows the request headers. |
| [`CfnRuleGroup.JsonMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.JsonMatchPatternProperty) | Struct | The patterns to look for in the JSON body. |
| [`CfnRuleGroup.LabelMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.LabelMatchStatementProperty) | Struct | A rule statement to match against labels that have been added to the web request by rules that have already run in the web ACL. |
| [`CfnRuleGroup.LabelProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.LabelProperty) | Struct | A single label container. |
| [`CfnRuleGroup.LabelSummaryProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.LabelSummaryProperty) | Struct | List of labels used by one or more of the rules of a `RuleGroup` . |
| [`CfnRuleGroup.MonetizationConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.MonetizationConfigProperty) | Struct | Configures monetization for the web ACL or rule group. |
| [`CfnRuleGroup.MonetizeActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.MonetizeActionProperty) | Struct | Monetize action for rules. |
| [`CfnRuleGroup.NotStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.NotStatementProperty) | Struct | A logical rule statement used to negate the results of another rule statement. |
| [`CfnRuleGroup.OrStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.OrStatementProperty) | Struct | A logical rule statement used to combine other rule statements with OR logic. |
| [`CfnRuleGroup.PaymentNetworkProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.PaymentNetworkProperty) | Struct | Configuration for a single payment network. |
| [`CfnRuleGroup.PreParseTextTransformationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.PreParseTextTransformationProperty) | Struct | Text Transformation applied before parsing the query string. |
| [`CfnRuleGroup.PriceProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.PriceProperty) | Struct | A price configuration. |
| [`CfnRuleGroup.RateBasedStatementCustomKeyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateBasedStatementCustomKeyProperty) | Struct | Specifies a single custom aggregate key for a rate-base rule. |
| [`CfnRuleGroup.RateBasedStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateBasedStatementProperty) | Struct | A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. |
| [`CfnRuleGroup.RateLimitCookieProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitCookieProperty) | Struct | Specifies a cookie as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RateLimitHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitHeaderProperty) | Struct | Specifies a header as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RateLimitJA3FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty) | Struct | Use the request's JA3 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key. |
| [`CfnRuleGroup.RateLimitJA4FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty) | Struct | Use the request's JA4 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key. |
| [`CfnRuleGroup.RateLimitLabelNamespaceProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty) | Struct | Specifies a label namespace to use as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RateLimitQueryArgumentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitQueryArgumentProperty) | Struct | Specifies a query argument in the request as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RateLimitQueryStringProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitQueryStringProperty) | Struct | Specifies the request's query string as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RateLimitUriPathProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitUriPathProperty) | Struct | Specifies the request's URI path as an aggregate key for a rate-based rule. |
| [`CfnRuleGroup.RegexMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RegexMatchStatementProperty) | Struct | A rule statement used to search web request components for a match against a single regular expression. |
| [`CfnRuleGroup.RegexPatternSetReferenceStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RegexPatternSetReferenceStatementProperty) | Struct | A rule statement used to search web request components for matches with regular expressions. |
| [`CfnRuleGroup.RuleActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RuleActionProperty) | Struct | The action that AWS WAF should take on a web request when it matches a rule's statement. |
| [`CfnRuleGroup.RuleProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.RuleProperty) | Struct | A single rule, which you can use in a `WebACL` or `RuleGroup` to identify web requests that you want to manage in some way. |
| [`CfnRuleGroup.SingleHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.SingleHeaderProperty) | Struct | Inspect one of the headers in the web request, identified by name, for example, `User-Agent` or `Referer` . |
| [`CfnRuleGroup.SingleQueryArgumentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.SingleQueryArgumentProperty) | Struct | Inspect one query argument in the web request, identified by name, for example *UserName* or *SalesRegion* . |
| [`CfnRuleGroup.SizeConstraintStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.SizeConstraintStatementProperty) | Struct | A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). |
| [`CfnRuleGroup.SqliMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.SqliMatchStatementProperty) | Struct | A rule statement that inspects for malicious SQL code. |
| [`CfnRuleGroup.StatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.StatementProperty) | Struct | The processing guidance for a rule, used by AWS WAF to determine whether a web request matches the rule. |
| [`CfnRuleGroup.TextTransformationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.TextTransformationProperty) | Struct | Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. |
| [`CfnRuleGroup.UriFragmentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.UriFragmentProperty) | Struct | Inspect fragments of the request URI. |
| [`CfnRuleGroup.VisibilityConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.VisibilityConfigProperty) | Struct | Defines and enables Amazon CloudWatch metrics and web request sample collection. |
| [`CfnRuleGroup.XssMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroup.XssMatchStatementProperty) | Struct | A rule statement that inspects for cross-site scripting (XSS) attacks. |
| [`CfnRuleGroupProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnRuleGroupProps) | Struct | Properties for defining a `CfnRuleGroup`. |
| [`CfnWebACL.AllowActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AllowActionProperty) | Struct | Specifies that AWS WAF should allow the request and optionally defines additional custom handling for the request. |
| [`CfnWebACL.AndStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AndStatementProperty) | Struct | A logical rule statement used to combine other rule statements with AND logic. |
| [`CfnWebACL.ApplicationAttributeProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ApplicationAttributeProperty) | Struct | Application details defined during the web ACL creation process. |
| [`CfnWebACL.ApplicationConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ApplicationConfigProperty) | Struct | A list of `ApplicationAttribute` s that contains information about the application. |
| [`CfnWebACL.AsnMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AsnMatchStatementProperty) | Struct | A rule statement that inspects web traffic based on the Autonomous System Number (ASN) associated with the request's IP address. |
| [`CfnWebACL.AssociationConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AssociationConfigProperty) | Struct | Specifies custom configurations for the associations between the web ACL and protected resources. |
| [`CfnWebACL.AWSManagedRulesACFPRuleSetProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AWSManagedRulesACFPRuleSetProperty) | Struct | Details for your use of the account creation fraud prevention managed rule group, `AWSManagedRulesACFPRuleSet` . |
| [`CfnWebACL.AWSManagedRulesAntiDDoSRuleSetProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AWSManagedRulesAntiDDoSRuleSetProperty) | Struct | Configures the use of the anti-DDoS managed rule group, `AWSManagedRulesAntiDDoSRuleSet` . This configuration is used in `ManagedRuleGroupConfig` . |
| [`CfnWebACL.AWSManagedRulesATPRuleSetProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AWSManagedRulesATPRuleSetProperty) | Struct | Details for your use of the account takeover prevention managed rule group, `AWSManagedRulesATPRuleSet` . |
| [`CfnWebACL.AWSManagedRulesBotControlRuleSetProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.AWSManagedRulesBotControlRuleSetProperty) | Struct | Details for your use of the Bot Control managed rule group, `AWSManagedRulesBotControlRuleSet` . |
| [`CfnWebACL.BlockActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.BlockActionProperty) | Struct | Specifies that AWS WAF should block the request and optionally defines additional custom handling for the response to the web request. |
| [`CfnWebACL.BodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.BodyProperty) | Struct | Inspect the body of the web request. The body immediately follows the request headers. |
| [`CfnWebACL.ByteMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ByteMatchStatementProperty) | Struct | A rule statement that defines a string match search for AWS WAF to apply to web requests. |
| [`CfnWebACL.CaptchaActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CaptchaActionProperty) | Struct | Specifies that AWS WAF should run a `CAPTCHA` check against the request:. |
| [`CfnWebACL.CaptchaConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CaptchaConfigProperty) | Struct | Specifies how AWS WAF should handle `CAPTCHA` evaluations for rules that don't have their own `CaptchaConfig` settings. |
| [`CfnWebACL.ChallengeActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ChallengeActionProperty) | Struct | Specifies that AWS WAF should run a `Challenge` check against the request to verify that the request is coming from a legitimate client session: - If the request includes a valid, unexpired challenge token, AWS WAF applies any custom request handling and labels that you've configured and then allows the web request inspection to proceed to the next rule, similar to a `CountAction` . |
| [`CfnWebACL.ChallengeConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ChallengeConfigProperty) | Struct | Specifies how AWS WAF should handle `Challenge` evaluations. |
| [`CfnWebACL.ClientSideActionConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ClientSideActionConfigProperty) | Struct | This is part of the configuration for the managed rules `AWSManagedRulesAntiDDoSRuleSet` in `ManagedRuleGroupConfig` . |
| [`CfnWebACL.ClientSideActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ClientSideActionProperty) | Struct | This is part of the `AWSManagedRulesAntiDDoSRuleSet` `ClientSideActionConfig` configuration in `ManagedRuleGroupConfig` . |
| [`CfnWebACL.CookieMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CookieMatchPatternProperty) | Struct | The filter to use to identify the subset of cookies to inspect in a web request. |
| [`CfnWebACL.CookiesProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CookiesProperty) | Struct | Inspect the cookies in the web request. |
| [`CfnWebACL.CountActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CountActionProperty) | Struct | Specifies that AWS WAF should count the request. Optionally defines additional custom handling for the request. |
| [`CfnWebACL.CryptoConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CryptoConfigProperty) | Struct | Configures cryptocurrency payment settings. |
| [`CfnWebACL.CustomHTTPHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CustomHTTPHeaderProperty) | Struct | A custom header for custom request and response handling. |
| [`CfnWebACL.CustomRequestHandlingProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CustomRequestHandlingProperty) | Struct | Custom request handling behavior that inserts custom headers into a web request. |
| [`CfnWebACL.CustomResponseBodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CustomResponseBodyProperty) | Struct | The response body to use in a custom response to a web request. |
| [`CfnWebACL.CustomResponseProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.CustomResponseProperty) | Struct | A custom response to send to the client. |
| [`CfnWebACL.DataProtectionConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.DataProtectionConfigProperty) | Struct | Specifies data protection to apply to the web request data for the web ACL. |
| [`CfnWebACL.DataProtectProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.DataProtectProperty) | Struct |  |
| [`CfnWebACL.DefaultActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.DefaultActionProperty) | Struct | In a `WebACL` , this is the action that you want AWS WAF to perform when a web request doesn't match any of the rules in the `WebACL` . |
| [`CfnWebACL.ExcludedRuleProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ExcludedRuleProperty) | Struct | Specifies a single rule in a rule group whose action you want to override to `Count` . |
| [`CfnWebACL.FieldIdentifierProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.FieldIdentifierProperty) | Struct | The identifier of a field in the web request payload that contains customer data. |
| [`CfnWebACL.FieldToMatchProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.FieldToMatchProperty) | Struct | Specifies a web request component to be used in a rule match statement or in a logging configuration. |
| [`CfnWebACL.FieldToProtectProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.FieldToProtectProperty) | Struct | Specifies a field type and keys to protect in stored web request data. |
| [`CfnWebACL.ForwardedIPConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ForwardedIPConfigurationProperty) | Struct | The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. |
| [`CfnWebACL.GeoMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.GeoMatchStatementProperty) | Struct | A rule statement that labels web requests by country and region and that matches against web requests based on country code. |
| [`CfnWebACL.HeaderMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.HeaderMatchPatternProperty) | Struct | The filter to use to identify the subset of headers to inspect in a web request. |
| [`CfnWebACL.HeaderOrderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.HeaderOrderProperty) | Struct | The string containing the list of a web request's header names, ordered as they appear in the web request, separated by colons. |
| [`CfnWebACL.HeadersProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.HeadersProperty) | Struct | Inspect all headers in the web request. |
| [`CfnWebACL.ImmunityTimePropertyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ImmunityTimePropertyProperty) | Struct | Used for CAPTCHA and challenge token settings. |
| [`CfnWebACL.IPSetForwardedIPConfigurationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.IPSetForwardedIPConfigurationProperty) | Struct | The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. |
| [`CfnWebACL.IPSetReferenceStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.IPSetReferenceStatementProperty) | Struct | A rule statement used to detect web requests coming from particular IP addresses or address ranges. |
| [`CfnWebACL.JA3FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.JA3FingerprintProperty) | Struct | Available for use with Amazon CloudFront distributions and Application Load Balancers. |
| [`CfnWebACL.JA4FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.JA4FingerprintProperty) | Struct | Available for use with Amazon CloudFront distributions and Application Load Balancers. |
| [`CfnWebACL.JsonBodyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.JsonBodyProperty) | Struct | Inspect the body of the web request as JSON. The body immediately follows the request headers. |
| [`CfnWebACL.JsonMatchPatternProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.JsonMatchPatternProperty) | Struct | The patterns to look for in the JSON body. |
| [`CfnWebACL.LabelMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.LabelMatchStatementProperty) | Struct | A rule statement to match against labels that have been added to the web request by rules that have already run in the web ACL. |
| [`CfnWebACL.LabelProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.LabelProperty) | Struct | A single label container. |
| [`CfnWebACL.ManagedRuleGroupConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ManagedRuleGroupConfigProperty) | Struct | Additional information that's used by a managed rule group. Many managed rule groups don't require this. |
| [`CfnWebACL.ManagedRuleGroupStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ManagedRuleGroupStatementProperty) | Struct | A rule statement used to run the rules that are defined in a managed rule group. |
| [`CfnWebACL.MonetizationConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.MonetizationConfigProperty) | Struct | Configures monetization for the web ACL or rule group. |
| [`CfnWebACL.MonetizeActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.MonetizeActionProperty) | Struct | Monetize action for rules. |
| [`CfnWebACL.NotStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.NotStatementProperty) | Struct | A logical rule statement used to negate the results of another rule statement. |
| [`CfnWebACL.OnSourceDDoSProtectionConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.OnSourceDDoSProtectionConfigProperty) | Struct | Configures the level of DDoS protection that applies to web ACLs associated with Application Load Balancers. |
| [`CfnWebACL.OrStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.OrStatementProperty) | Struct | A logical rule statement used to combine other rule statements with OR logic. |
| [`CfnWebACL.OverrideActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.OverrideActionProperty) | Struct | The action to use in the place of the action that results from the rule group evaluation. |
| [`CfnWebACL.PaymentNetworkProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.PaymentNetworkProperty) | Struct | Configuration for a single payment network. |
| [`CfnWebACL.PreParseTextTransformationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.PreParseTextTransformationProperty) | Struct | Text Transformation applied before parsing the query string. |
| [`CfnWebACL.PriceProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.PriceProperty) | Struct | A price configuration. |
| [`CfnWebACL.RateBasedStatementCustomKeyProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateBasedStatementCustomKeyProperty) | Struct | Specifies a single custom aggregate key for a rate-base rule. |
| [`CfnWebACL.RateBasedStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateBasedStatementProperty) | Struct | A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. |
| [`CfnWebACL.RateLimitCookieProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitCookieProperty) | Struct | Specifies a cookie as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RateLimitHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitHeaderProperty) | Struct | Specifies a header as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RateLimitJA3FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitJA3FingerprintProperty) | Struct | Use the request's JA3 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key. |
| [`CfnWebACL.RateLimitJA4FingerprintProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitJA4FingerprintProperty) | Struct | Use the request's JA4 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key. |
| [`CfnWebACL.RateLimitLabelNamespaceProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitLabelNamespaceProperty) | Struct | Specifies a label namespace to use as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RateLimitQueryArgumentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitQueryArgumentProperty) | Struct | Specifies a query argument in the request as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RateLimitQueryStringProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitQueryStringProperty) | Struct | Specifies the request's query string as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RateLimitUriPathProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitUriPathProperty) | Struct | Specifies the request's URI path as an aggregate key for a rate-based rule. |
| [`CfnWebACL.RegexMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RegexMatchStatementProperty) | Struct | A rule statement used to search web request components for a match against a single regular expression. |
| [`CfnWebACL.RegexPatternSetReferenceStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RegexPatternSetReferenceStatementProperty) | Struct | A rule statement used to search web request components for matches with regular expressions. |
| [`CfnWebACL.RegexProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RegexProperty) | Struct | A single regular expression. |
| [`CfnWebACL.RequestBodyAssociatedResourceTypeConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RequestBodyAssociatedResourceTypeConfigProperty) | Struct | Customizes the maximum size of the request body that your protected CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access resources forward to AWS WAF for inspection. |
| [`CfnWebACL.RequestInspectionACFPProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RequestInspectionACFPProperty) | Struct | The criteria for inspecting account creation requests, used by the ACFP rule group to validate and track account creation attempts. |
| [`CfnWebACL.RequestInspectionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RequestInspectionProperty) | Struct | The criteria for inspecting login requests, used by the ATP rule group to validate credentials usage. |
| [`CfnWebACL.ResponseInspectionBodyContainsProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ResponseInspectionBodyContainsProperty) | Struct | Configures inspection of the response body. |
| [`CfnWebACL.ResponseInspectionHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ResponseInspectionHeaderProperty) | Struct | Configures inspection of the response header. This is part of the `ResponseInspection` configuration for `AWSManagedRulesATPRuleSet` and `AWSManagedRulesACFPRuleSet` . |
| [`CfnWebACL.ResponseInspectionJsonProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ResponseInspectionJsonProperty) | Struct | Configures inspection of the response JSON. |
| [`CfnWebACL.ResponseInspectionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ResponseInspectionProperty) | Struct | The criteria for inspecting responses to login requests and account creation requests, used by the ATP and ACFP rule groups to track login and account creation success and failure rates. |
| [`CfnWebACL.ResponseInspectionStatusCodeProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.ResponseInspectionStatusCodeProperty) | Struct | Configures inspection of the response status code. This is part of the `ResponseInspection` configuration for `AWSManagedRulesATPRuleSet` and `AWSManagedRulesACFPRuleSet` . |
| [`CfnWebACL.RuleActionOverrideProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RuleActionOverrideProperty) | Struct | Action setting to use in the place of a rule action that is configured inside the rule group. |
| [`CfnWebACL.RuleActionProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RuleActionProperty) | Struct | The action that AWS WAF should take on a web request when it matches a rule's statement. |
| [`CfnWebACL.RuleGroupReferenceStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RuleGroupReferenceStatementProperty) | Struct | A rule statement used to run the rules that are defined in a `RuleGroup` . |
| [`CfnWebACL.RuleProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.RuleProperty) | Struct | A single rule, which you can use in a `WebACL` or `RuleGroup` to identify web requests that you want to manage in some way. |
| [`CfnWebACL.SingleHeaderProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.SingleHeaderProperty) | Struct | Inspect one of the headers in the web request, identified by name, for example, `User-Agent` or `Referer` . |
| [`CfnWebACL.SingleQueryArgumentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.SingleQueryArgumentProperty) | Struct | Inspect one query argument in the web request, identified by name, for example *UserName* or *SalesRegion* . |
| [`CfnWebACL.SizeConstraintStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.SizeConstraintStatementProperty) | Struct | A rule statement that compares a number of bytes against the size of a request component, using a comparison operator, such as greater than (>) or less than (<). |
| [`CfnWebACL.SqliMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.SqliMatchStatementProperty) | Struct | A rule statement that inspects for malicious SQL code. |
| [`CfnWebACL.StatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.StatementProperty) | Struct | The processing guidance for a rule, used by AWS WAF to determine whether a web request matches the rule. |
| [`CfnWebACL.TextTransformationProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.TextTransformationProperty) | Struct | Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. |
| [`CfnWebACL.UriFragmentProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.UriFragmentProperty) | Struct | Inspect fragments of the request URI. |
| [`CfnWebACL.VisibilityConfigProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.VisibilityConfigProperty) | Struct | Defines and enables Amazon CloudWatch metrics and web request sample collection. |
| [`CfnWebACL.XssMatchStatementProperty`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACL.XssMatchStatementProperty) | Struct | A rule statement that inspects for cross-site scripting (XSS) attacks. |
| [`CfnWebACLAssociationProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACLAssociationProps) | Struct | Properties for defining a `CfnWebACLAssociation`. |
| [`CfnWebACLProps`](/v2/docs/aws-cdk-lib.aws_wafv2.CfnWebACLProps) | Struct | Properties for defining a `CfnWebACL`. |