You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| <aname="input_association_resources"></a> [association\_resources](#input\_association\_resources)| ARN of the ALB, CloudFront, Etc to be associated with the WAFv2 ACL. |`list(string)`|`[]`| no |
63
-
| <aname="input_default_action"></a> [default\_action](#input\_default\_action)| The action to perform if none of the rules contained in the WebACL match. |`string`|`"allow"`| no |
104
+
| <aname="input_default_action"></a> [default\_action](#input\_default\_action)| The action to perform if none of the rules contained in the WebACL match. |`string`|`"block"`| no |
64
105
| <aname="input_environment"></a> [environment](#input\_environment)| Environment Variable used as a prefix |`string`| n/a | yes |
106
+
| <aname="input_ip_rate_based_rule"></a> [ip\_rate\_based\_rule](#input\_ip\_rate\_based\_rule)| A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span | <pre>object({<br> name = string<br> priority = number<br> action = string<br> limit = number<br> })</pre> |`null`| no |
65
107
| <aname="input_ip_sets_rule"></a> [ip\_sets\_rule](#input\_ip\_sets\_rule)| A rule to detect web requests coming from particular IP addresses or address ranges. | <pre>list(object({<br> name = string<br> priority = number<br> ip_set = list(string)<br> action = string<br> ip_address_version = string<br> }))</pre> |`[]`| no |
| <aname="input_is_create_logging_configuration"></a> [is\_create\_logging\_configuration](#input\_is\_create\_logging\_configuration)| Whether to create logging configuration in order start logging from a WAFv2 Web ACL to CloudWatch |`bool`|`true`| no |
109
+
| <aname="input_is_enable_cloudwatch_metrics"></a> [is\_enable\_cloudwatch\_metrics](#input\_is\_enable\_cloudwatch\_metrics)| The action to perform if none of the rules contained in the WebACL match. |`bool`|`true`| no |
110
+
| <aname="input_is_enable_default_rule"></a> [is\_enable\_default\_rule](#input\_is\_enable\_default\_rule)| If true with enable default rule (detail in locals.tf) |`bool`|`true`| no |
111
+
| <aname="input_is_enable_sampled_requests"></a> [is\_enable\_sampled\_requests](#input\_is\_enable\_sampled\_requests)| Whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console. |`bool`|`true`| no |
112
+
| <aname="input_logging_filter"></a> [logging\_filter](#input\_logging\_filter)| A configuration block that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation. |`any`|`{}`| no |
113
+
| <aname="input_managed_rules"></a> [managed\_rules](#input\_managed\_rules)| List of Managed WAF rules. | <pre>list(object({<br> name = string<br> priority = number<br> override_action = string<br> excluded_rules = list(string)<br> }))</pre> |`[]`| no |
67
114
| <aname="input_name"></a> [name](#input\_name)| A friendly name of the WebACL. |`string`| n/a | yes |
68
115
| <aname="input_prefix"></a> [prefix](#input\_prefix)| The prefix name of customer to be displayed in AWS console and resource |`string`| n/a | yes |
116
+
| <aname="input_redacted_fields"></a> [redacted\_fields](#input\_redacted\_fields)| The parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported. |`any`|`[]`| no |
69
117
| <aname="input_scope"></a> [scope](#input\_scope)| The scope of this Web ACL. Valid options: CLOUDFRONT, REGIONAL. |`string`| n/a | yes |
70
118
| <aname="input_tags"></a> [tags](#input\_tags)| A mapping of tags to assign to the WAFv2 ACL. |`map(string)`|`{}`| no |
71
119
@@ -74,3 +122,4 @@ No modules.
74
122
| Name | Description |
75
123
|------|-------------|
76
124
| <aname="output_web_acl_id"></a> [web\_acl\_id](#output\_web\_acl\_id)| The ARN of the WAF WebACL. |
description="The action to perform if none of the rules contained in the WebACL match."
104
-
default="allow"
74
+
default="block"
75
+
}
76
+
77
+
variable"is_enable_cloudwatch_metrics" {
78
+
type=bool
79
+
description="The action to perform if none of the rules contained in the WebACL match."
80
+
default=true
81
+
}
82
+
83
+
variable"is_enable_sampled_requests" {
84
+
type=bool
85
+
description="Whether AWS WAF should store a sampling of the web requests that match the rules. You can view the sampled requests through the AWS WAF console."
86
+
default=true
87
+
}
88
+
89
+
variable"ip_rate_based_rule" {
90
+
type=object({
91
+
name =string
92
+
priority =number
93
+
action =string
94
+
limit =number
95
+
})
96
+
description="A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span"
97
+
default=null
98
+
}
99
+
100
+
variable"is_create_logging_configuration" {
101
+
description="Whether to create logging configuration in order start logging from a WAFv2 Web ACL to CloudWatch"
102
+
default=true
103
+
}
104
+
105
+
variable"redacted_fields" {
106
+
description="The parts of the request that you want to keep out of the logs. Up to 100 `redacted_fields` blocks are supported."
107
+
type=any
108
+
default=[]
109
+
}
110
+
111
+
variable"logging_filter" {
112
+
type=any
113
+
description="A configuration block that specifies which web requests are kept in the logs and which are dropped. You can filter on the rule action and on the web request labels that were applied by matching rules during web ACL evaluation."
0 commit comments