Enabling logging for a web ACL
This section provides instructions for enabling logging for a web ACL.
Note
You are charged for logging in addition to the charges for using AWS WAF. For information, see Pricing for logging web ACL traffic information.
To enable logging for a web ACL, you must have already configured a logging destination. For information about your destination choices and the requirements for each, see AWS WAF logging destinations.
To enable logging for a web ACL
Sign in to the AWS Management Console and open the AWS WAF console at https://console.aws.amazon.com/wafv2/
. In the navigation pane, choose Web ACLs.
Choose the name of the web ACL that you want to enable logging for. The console takes you to the web ACL's description, where you can edit it.
On the Logging tab, choose Enable logging.
Choose the logging destination type, and then choose the logging destination that you configured. You must choose a logging destination whose name begins with
aws-waf-logs-.(Optional) If you don't want some fields included in the logs, redact them. Choose the field to redact, and then choose Add. Repeat as necessary to redact additional fields.
Note
This setting has no impact on request sampling. With request sampling, the only way to exclude fields is by disabling sampling for the web ACL.
-
(Optional) If you don't want to send all requests to the logs, add your filtering criteria and behavior. Under Filter logs, for each filter that you want to apply, choose Add filter, then choose your filtering criteria and specify whether you want to keep or drop requests that match the criteria. When you finish adding filters, if needed, modify the Default logging behavior.
Choose Enable logging.
Note
When you successfully enable logging, AWS WAF will create a service-linked role with the necessary permissions to write logs to the logging destination. For more information, see Using service-linked roles for AWS WAF.
