Package com.pulumi.aws.wafv2

Class WebAcl

  • public class WebAcl
extends com.pulumi.resources.CustomResource
    Creates a WAFv2 Web ACL resource. > **Note:** Inline `rule` blocks in this resource have several known limitations. Consider using `aws.wafv2.WebAclRule` to manage rules as separate resources instead. Limitations include: **Deletion ordering errors:** When removing a rule that references an IP set or rule group, AWS requires the rule to be detached before the referenced resource is deleted. Terraform's dependency graph cannot model this correctly for inline rules, resulting in `WAFAssociatedItemException` errors. **Spurious diffs:** AWS returns rules in an unpredictable order, which can cause Terraform to detect changes even when the configuration has not changed. **Coupled updates:** Modifying one inline rule may cause all rules to be recreated, which can be disruptive. > **Warning:** If you use the `aws.wafv2.WebAclRule` or `aws.wafv2.WebAclRuleGroupAssociation` resources with this Web ACL, you must add `lifecycle { ignoreChanges = [rule] }` to this resource to prevent configuration drift. Those resources manage the Web ACL's rules outside of this resource's direct management. ## Import Using `pulumi import`, import WAFv2 Web ACLs using `ID/Name/Scope`. For example: ```sh $ pulumi import aws:wafv2/webAcl:WebAcl example a1b2c3d4-d5f6-7777-8888-9999aaaabbbbcccc/example/REGIONAL ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Constructor Summary

      Constructors 
      Constructor Description
      WebAcl​(java.lang.String name)  
      WebAcl​(java.lang.String name, WebAclArgs args)  
      WebAcl​(java.lang.String name, WebAclArgs args, com.pulumi.resources.CustomResourceOptions options)  

    • Constructor Detail

      • WebAcl

        public WebAcl​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • WebAcl

        public WebAcl​(java.lang.String name,
              WebAclArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • WebAcl

        public WebAcl​(java.lang.String name,
              WebAclArgs args,
              @Nullable
              com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • applicationIntegrationUrl

        public com.pulumi.core.Output<java.lang.String> applicationIntegrationUrl()
        Returns:
        URL to use in SDK integrations with managed rule groups.

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        ARN of the WAF WebACL.

      • associationConfig

        public com.pulumi.core.Output<java.util.Optional<WebAclAssociationConfig>> associationConfig()
        Returns:
        Custom configurations for the associations between the web ACL and protected resources. See `associationConfig` below for details.

      • capacity

        public com.pulumi.core.Output<java.lang.Integer> capacity()
        Returns:
        Web ACL capacity units (WCUs) currently being used by this web ACL.

      • captchaConfig

        public com.pulumi.core.Output<java.util.Optional<WebAclCaptchaConfig>> captchaConfig()
        Returns:
        Configuration for how AWS WAF handles CAPTCHA evaluations at the web ACL level (used by [AWS Bot Control](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)). See `captchaConfig` below for details.

      • challengeConfig

        public com.pulumi.core.Output<java.util.Optional<WebAclChallengeConfig>> challengeConfig()
        Returns:
        Configuration for how AWS WAF handles Challenge evaluations at the web ACL level (used by [AWS Bot Control](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html)). See `challengeConfig` below for details.

      • customResponseBodies

        public com.pulumi.core.Output<java.util.Optional<java.util.List<WebAclCustomResponseBody>>> customResponseBodies()
        Returns:
        Custom response bodies that can be referenced by `customResponse` actions. See `customResponseBody` below for details.

      • dataProtectionConfig

        public com.pulumi.core.Output<java.util.Optional<WebAclDataProtectionConfig>> dataProtectionConfig()
        Returns:
        Data protection to apply to the web request data for the web ACL. This is a web ACL level data protection option. See `dataProtectionConfig` below for details.

      • defaultAction

        public com.pulumi.core.Output<WebAclDefaultAction> defaultAction()
        Returns:
        Action to perform if none of the `rules` contained in the WebACL match. See `defaultAction` below for details.

      • description

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> description()
        Returns:
        Friendly description of the WebACL.

      • lockToken

        public com.pulumi.core.Output<java.lang.String> lockToken()

      • monetizationConfig

        public com.pulumi.core.Output<java.util.Optional<WebAclMonetizationConfig>> monetizationConfig()
        Returns:
        Monetization configuration for the web ACL. Provide this when any rule in the web ACL uses the `monetize` action. See `monetizationConfig` below for details.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Friendly name of the WebACL. If omitted, the provider will assign a random, unique name. Conflicts with `namePrefix`.

      • namePrefix

        public com.pulumi.core.Output<java.lang.String> namePrefix()
        Returns:
        Creates a unique name beginning with the specified prefix. Conflicts with `name`.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • ruleJson

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> ruleJson()
        Returns:
        Raw JSON string to allow more than three nested statements. Conflicts with `rule` attribute. This is for advanced use cases where more than 3 levels of nested statements are required. **There is no drift detection at this time**. If you use this attribute instead of `rule`, you will be foregoing drift detection. Additionally, importing an existing web ACL into a configuration with `ruleJson` set will result in a one time in-place update as the remote rule configuration is initially written to the `rule` attribute. See the AWS [documentation](https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateWebACL.html) for the JSON structure.

      • rules

        public com.pulumi.core.Output<java.util.Optional<java.util.List<WebAclRule>>> rules()
        Returns:
        **`rule` blocks in this resource have several known limitations.** Consider using `aws.wafv2.WebAclRule` to manage rules as separate resources instead. Rule blocks used to identify the web requests that you want to `allow`, `block`, or `count`. See `rule` below for details.

      • scope

        public com.pulumi.core.Output<java.lang.String> scope()
        Returns:
        Scope of the web ACL, either an AWS CloudFront distribution or a regional application. Valid values are `CLOUDFRONT` or `REGIONAL`. To work with CloudFront, you must also specify the region `us-east-1` (N. Virginia) on the AWS provider.

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Map of key-value pairs to associate with the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • tokenDomains

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tokenDomains()
        Returns:
        Domains that AWS WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When AWS WAF provides a token, it uses the domain of the AWS resource that the web ACL is protecting. If you don't specify a list of token domains, AWS WAF accepts tokens only for the domain of the protected resource. With a token domain list, AWS WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.

      • visibilityConfig

        public com.pulumi.core.Output<WebAclVisibilityConfig> visibilityConfig()
        Returns:
        Amazon CloudWatch metrics and web request sample collection configuration. See `visibilityConfig` below for details.

      • get

        public static WebAcl get​(java.lang.String name,
                         com.pulumi.core.Output<java.lang.String> id,
                         @Nullable
                         WebAclState state,
                         @Nullable
                         com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.