Package software.amazon.awscdk.services.wafv2

Class CfnLoggingConfiguration

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.core.Construct
software.amazon.awscdk.core.CfnElement
software.amazon.awscdk.core.CfnRefElement
software.amazon.awscdk.core.CfnResource
software.amazon.awscdk.services.wafv2.CfnLoggingConfiguration
All Implemented Interfaces:
IConstruct, IDependable, IInspectable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct
@Generated(value="jsii-pacmak/1.84.0 (build 5404dcf)", date="2023-06-19T16:30:36.145Z") @Stability(Stable) public class CfnLoggingConfiguration extends CfnResource implements IInspectable
A CloudFormation AWS::WAFv2::LoggingConfiguration.

Defines an association between logging destinations and a web ACL resource, for logging from AWS WAF . As part of the association, you can specify parts of the standard logging fields to keep out of the logs and you can specify filters so that you log only a subset of the logging records.

You can define one logging destination per web ACL.

You can access information about the traffic that AWS WAF inspects using the following steps:

  • Create your logging destination. You can use an Amazon CloudWatch Logs log group, an Amazon Simple Storage Service (Amazon S3) bucket, or an Amazon Kinesis Data Firehose.

The name that you give the destination must start with aws-waf-logs- . Depending on the type of destination, you might need to configure additional settings or permissions.

For configuration requirements and pricing information for each destination type, see Logging web ACL traffic in the AWS WAF Developer Guide .

  • Associate your logging destination to your web ACL using a PutLoggingConfiguration request.

When you successfully enable logging using a PutLoggingConfiguration request, AWS WAF creates an additional role or policy that is required to write logs to the logging destination. For an Amazon CloudWatch Logs log group, AWS WAF creates a resource policy on the log group. For an Amazon S3 bucket, AWS WAF creates a bucket policy. For an Amazon Kinesis Data Firehose, AWS WAF creates a service-linked role.

For additional information about web ACL logging, see Logging web ACL traffic information in the AWS WAF Developer Guide .

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.wafv2.*;
 Object jsonBody;
 Object loggingFilter;
 Object method;
 Object queryString;
 Object singleHeader;
 Object uriPath;
 CfnLoggingConfiguration cfnLoggingConfiguration = CfnLoggingConfiguration.Builder.create(this, "MyCfnLoggingConfiguration")
         .logDestinationConfigs(List.of("logDestinationConfigs"))
         .resourceArn("resourceArn")
         // the properties below are optional
         .loggingFilter(loggingFilter)
         .redactedFields(List.of(FieldToMatchProperty.builder()
                 .jsonBody(jsonBody)
                 .method(method)
                 .queryString(queryString)
                 .singleHeader(singleHeader)
                 .uriPath(uriPath)
                 .build()))
         .build();

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnLoggingConfiguration

      protected CfnLoggingConfiguration(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnLoggingConfiguration

      protected CfnLoggingConfiguration(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnLoggingConfiguration

      @Stability(Stable) public CfnLoggingConfiguration(@NotNull Construct scope, @NotNull String id, @NotNull CfnLoggingConfigurationProps props)
      Create a new AWS::WAFv2::LoggingConfiguration.

      Parameters:
      scope -
      • scope in which this resource is defined.
      This parameter is required.
      id -
      • scoped id of the resource.
      This parameter is required.
      props -
      • resource properties.
      This parameter is required.

  • Method Details

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector -
      • tree inspector to collect and process attributes.
      This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getAttrManagedByFirewallManager

      @Stability(Stable) @NotNull public IResolvable getAttrManagedByFirewallManager()
      Indicates whether the logging configuration was created by AWS Firewall Manager , as part of an AWS WAF policy configuration.

      If true, only Firewall Manager can modify or delete the configuration.

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getLogDestinationConfigs

      @Stability(Stable) @NotNull public List<String> getLogDestinationConfigs()
      The logging destination configuration that you want to associate with the web ACL.

      You can associate one logging destination to a web ACL.

    • setLogDestinationConfigs

      @Stability(Stable) public void setLogDestinationConfigs(@NotNull List<String> value)
      The logging destination configuration that you want to associate with the web ACL.

      You can associate one logging destination to a web ACL.

    • getLoggingFilter

      @Stability(Stable) @NotNull public Object getLoggingFilter()
      Filtering that specifies which web requests are kept in the logs and which are dropped.

      You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation.

    • setLoggingFilter

      @Stability(Stable) public void setLoggingFilter(@NotNull Object value)
      Filtering that specifies which web requests are kept in the logs and which are dropped.

      You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation.

    • getResourceArn

      @Stability(Stable) @NotNull public String getResourceArn()
      The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

    • setResourceArn

      @Stability(Stable) public void setResourceArn(@NotNull String value)
      The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs .

    • getRedactedFields

      @Stability(Stable) @Nullable public Object getRedactedFields()
      The parts of the request that you want to keep out of the logs.

      For example, if you redact the SingleHeader field, the HEADER field in the logs will be REDACTED for all rules that use the SingleHeader FieldToMatch setting.

      Redaction applies only to the component that's specified in the rule's FieldToMatch setting, so the SingleHeader redaction doesn't apply to rules that use the Headers FieldToMatch .

      You can specify only the following fields for redaction: UriPath , QueryString , SingleHeader , and Method .

    • setRedactedFields

      @Stability(Stable) public void setRedactedFields(@Nullable IResolvable value)
      The parts of the request that you want to keep out of the logs.

      For example, if you redact the SingleHeader field, the HEADER field in the logs will be REDACTED for all rules that use the SingleHeader FieldToMatch setting.

      Redaction applies only to the component that's specified in the rule's FieldToMatch setting, so the SingleHeader redaction doesn't apply to rules that use the Headers FieldToMatch .

      You can specify only the following fields for redaction: UriPath , QueryString , SingleHeader , and Method .

    • setRedactedFields

      @Stability(Stable) public void setRedactedFields(@Nullable List<Object> value)
      The parts of the request that you want to keep out of the logs.

      For example, if you redact the SingleHeader field, the HEADER field in the logs will be REDACTED for all rules that use the SingleHeader FieldToMatch setting.

      Redaction applies only to the component that's specified in the rule's FieldToMatch setting, so the SingleHeader redaction doesn't apply to rules that use the Headers FieldToMatch .

      You can specify only the following fields for redaction: UriPath , QueryString , SingleHeader , and Method .