Note
AWS WAF Classic support will end on September 30, 2025.
This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide.
For the latest version of AWS WAF , use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use.
Specifies where in a web request to look for TargetString.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
Properties
Data-
When the value of
TypeisHEADER, enter the name of the header that you want AWS WAF to search, for example,User-AgentorReferer. The name of the header is not case sensitive.When the value of
TypeisSINGLE_QUERY_ARG, enter the name of the parameter that you want AWS WAF to search, for example,UserNameorSalesRegion. The parameter name is not case sensitive.If the value of
Typeis any other value, omitData.Required: No
Type: String
Pattern:
.*\S.*Minimum:
1Maximum:
128Update requires: No interruption
Type-
The part of the web request that you want AWS WAF to search for a specified string. Parts of a request that you can search include the following:
-
HEADER: A specified request header, for example, the value of theUser-AgentorRefererheader. If you chooseHEADERfor the type, specify the name of the header inData. -
METHOD: The HTTP method, which indicated the type of operation that the request is asking the origin to perform. Amazon CloudFront supports the following methods:DELETE,GET,HEAD,OPTIONS,PATCH,POST, andPUT. -
QUERY_STRING: A query string, which is the part of a URL that appears after a?character, if any. -
URI: The part of a web request that identifies a resource, for example,/images/daily-ad.jpg. -
BODY: The part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. The request body immediately follows the request headers. Note that only the first8192bytes of the request body are forwarded to AWS WAF for inspection. To allow or block requests based on the length of the body, you can create a size constraint set. -
SINGLE_QUERY_ARG: The parameter in the query string that you will inspect, such as UserName or SalesRegion. The maximum length forSINGLE_QUERY_ARGis 30 characters. -
ALL_QUERY_ARGS: Similar toSINGLE_QUERY_ARG, but rather than inspecting a single parameter, AWS WAF will inspect all parameters within the query for the value or regex pattern that you specify inTargetString.
Required: Yes
Type: String
Allowed values:
URI | QUERY_STRING | HEADER | METHOD | BODY | SINGLE_QUERY_ARG | ALL_QUERY_ARGSUpdate requires: No interruption
-
