Skip to content

Commit 474281e

Browse files
author
awstools
committed
feat(client-wafv2): Add a property to WebACL to indicate whether it's been retrofitted by Firewall Manager.
1 parent 573b4e2 commit 474281e

File tree

11 files changed

+42
-109
lines changed

11 files changed

+42
-109
lines changed

‎clients/client-wafv2/README.md‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,8 @@ like endpoints and namespaces, all have the versioning information added, like "
1515
"v2", to distinguish from the prior version. We recommend migrating your resources to
1616
this version, because it has a number of significant improvements.</p>
1717
<p>If you used WAF prior to this release, you can't use this WAFV2 API to access any
18-
WAF resources that you created before. You can access your old rules, web ACLs, and
19-
other WAF resources only through the WAF Classic APIs. The WAF Classic APIs
20-
have retained the prior names, endpoints, and namespaces. </p>
21-
<p>For information, including how to migrate your WAF resources to this version,
18+
WAF resources that you created before. WAF Classic support will end on September 30, 2025. </p>
19+
<p>For information about WAF, including how to migrate your WAF Classic resources to this version,
2220
see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
2321
</note>
2422
<p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
@@ -45,26 +43,6 @@ US East (N. Virginia): us-east-1.</p>
4543
</ul>
4644
<p>Alternatively, you can use one of the Amazon Web Services SDKs to access an API that's tailored to the
4745
programming language or platform that you're using. For more information, see <a href="http://aws.amazon.com/tools/#SDKs">Amazon Web Services SDKs</a>.</p>
48-
<p>We currently provide two versions of the WAF API: this API and the prior versions,
49-
the classic WAF APIs. This new API provides the same functionality as the older versions,
50-
with the following major improvements:</p>
51-
<ul>
52-
<li>
53-
<p>You use one API for both global and regional applications. Where you need to
54-
distinguish the scope, you specify a <code>Scope</code> parameter and set it to
55-
<code>CLOUDFRONT</code> or <code>REGIONAL</code>. </p>
56-
</li>
57-
<li>
58-
<p>You can define a web ACL or rule group with a single call, and update it with a
59-
single call. You define all rule specifications in JSON format, and pass them to your
60-
rule group or web ACL calls.</p>
61-
</li>
62-
<li>
63-
<p>The limits WAF places on the use of rules more closely reflects the cost of
64-
running each type of rule. Rule groups include capacity settings, so you know the
65-
maximum cost of a rule group when you use it.</p>
66-
</li>
67-
</ul>
6846

6947
## Installing
7048

‎clients/client-wafv2/src/WAFV2.ts‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1108,10 +1108,8 @@ export interface WAFV2 {
11081108
* "v2", to distinguish from the prior version. We recommend migrating your resources to
11091109
* this version, because it has a number of significant improvements.</p>
11101110
* <p>If you used WAF prior to this release, you can't use this WAFV2 API to access any
1111-
* WAF resources that you created before. You can access your old rules, web ACLs, and
1112-
* other WAF resources only through the WAF Classic APIs. The WAF Classic APIs
1113-
* have retained the prior names, endpoints, and namespaces. </p>
1114-
* <p>For information, including how to migrate your WAF resources to this version,
1111+
* WAF resources that you created before. WAF Classic support will end on September 30, 2025. </p>
1112+
* <p>For information about WAF, including how to migrate your WAF Classic resources to this version,
11151113
* see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
11161114
* </note>
11171115
* <p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
@@ -1138,26 +1136,6 @@ export interface WAFV2 {
11381136
* </ul>
11391137
* <p>Alternatively, you can use one of the Amazon Web Services SDKs to access an API that's tailored to the
11401138
* programming language or platform that you're using. For more information, see <a href="http://aws.amazon.com/tools/#SDKs">Amazon Web Services SDKs</a>.</p>
1141-
* <p>We currently provide two versions of the WAF API: this API and the prior versions,
1142-
* the classic WAF APIs. This new API provides the same functionality as the older versions,
1143-
* with the following major improvements:</p>
1144-
* <ul>
1145-
* <li>
1146-
* <p>You use one API for both global and regional applications. Where you need to
1147-
* distinguish the scope, you specify a <code>Scope</code> parameter and set it to
1148-
* <code>CLOUDFRONT</code> or <code>REGIONAL</code>. </p>
1149-
* </li>
1150-
* <li>
1151-
* <p>You can define a web ACL or rule group with a single call, and update it with a
1152-
* single call. You define all rule specifications in JSON format, and pass them to your
1153-
* rule group or web ACL calls.</p>
1154-
* </li>
1155-
* <li>
1156-
* <p>The limits WAF places on the use of rules more closely reflects the cost of
1157-
* running each type of rule. Rule groups include capacity settings, so you know the
1158-
* maximum cost of a rule group when you use it.</p>
1159-
* </li>
1160-
* </ul>
11611139
* @public
11621140
*/
11631141
export class WAFV2 extends WAFV2Client implements WAFV2 {}

‎clients/client-wafv2/src/WAFV2Client.ts‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -497,10 +497,8 @@ export interface WAFV2ClientResolvedConfig extends WAFV2ClientResolvedConfigType
497497
* "v2", to distinguish from the prior version. We recommend migrating your resources to
498498
* this version, because it has a number of significant improvements.</p>
499499
* <p>If you used WAF prior to this release, you can't use this WAFV2 API to access any
500-
* WAF resources that you created before. You can access your old rules, web ACLs, and
501-
* other WAF resources only through the WAF Classic APIs. The WAF Classic APIs
502-
* have retained the prior names, endpoints, and namespaces. </p>
503-
* <p>For information, including how to migrate your WAF resources to this version,
500+
* WAF resources that you created before. WAF Classic support will end on September 30, 2025. </p>
501+
* <p>For information about WAF, including how to migrate your WAF Classic resources to this version,
504502
* see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
505503
* </note>
506504
* <p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
@@ -527,26 +525,6 @@ export interface WAFV2ClientResolvedConfig extends WAFV2ClientResolvedConfigType
527525
* </ul>
528526
* <p>Alternatively, you can use one of the Amazon Web Services SDKs to access an API that's tailored to the
529527
* programming language or platform that you're using. For more information, see <a href="http://aws.amazon.com/tools/#SDKs">Amazon Web Services SDKs</a>.</p>
530-
* <p>We currently provide two versions of the WAF API: this API and the prior versions,
531-
* the classic WAF APIs. This new API provides the same functionality as the older versions,
532-
* with the following major improvements:</p>
533-
* <ul>
534-
* <li>
535-
* <p>You use one API for both global and regional applications. Where you need to
536-
* distinguish the scope, you specify a <code>Scope</code> parameter and set it to
537-
* <code>CLOUDFRONT</code> or <code>REGIONAL</code>. </p>
538-
* </li>
539-
* <li>
540-
* <p>You can define a web ACL or rule group with a single call, and update it with a
541-
* single call. You define all rule specifications in JSON format, and pass them to your
542-
* rule group or web ACL calls.</p>
543-
* </li>
544-
* <li>
545-
* <p>The limits WAF places on the use of rules more closely reflects the cost of
546-
* running each type of rule. Rule groups include capacity settings, so you know the
547-
* maximum cost of a rule group when you use it.</p>
548-
* </li>
549-
* </ul>
550528
* @public
551529
*/
552530
export class WAFV2Client extends __Client<

‎clients/client-wafv2/src/commands/DeleteFirewallManagerRuleGroupsCommand.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,8 @@ export interface DeleteFirewallManagerRuleGroupsCommandOutput
3333
__MetadataBearer {}
3434

3535
/**
36-
* <p>Deletes all rule groups that are managed by Firewall Manager for the specified web ACL. </p>
37-
* <p>You can only use this if <code>ManagedByFirewallManager</code> is false in the specified
38-
* <a>WebACL</a>. </p>
36+
* <p>Deletes all rule groups that are managed by Firewall Manager from the specified <a>WebACL</a>. </p>
37+
* <p>You can only use this if <code>ManagedByFirewallManager</code> and <code>RetrofittedByFirewallManager</code> are both false in the web ACL. </p>
3938
* @example
4039
* Use a bare-bones client and the command you need to make an API call.
4140
* ```javascript

‎clients/client-wafv2/src/commands/DeleteWebACLCommand.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ export interface DeleteWebACLCommandOutput extends DeleteWebACLResponse, __Metad
2929

3030
/**
3131
* <p>Deletes the specified <a>WebACL</a>. </p>
32-
* <p>You can only use this if <code>ManagedByFirewallManager</code> is false in the specified
33-
* <a>WebACL</a>. </p>
32+
* <p>You can only use this if <code>ManagedByFirewallManager</code> is false in the web ACL. </p>
3433
* <note>
3534
* <p>Before deleting any web ACL, first disassociate it from all resources.</p>
3635
* <ul>

‎clients/client-wafv2/src/commands/GetWebACLCommand.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1217,6 +1217,7 @@ export interface GetWebACLCommandOutput extends GetWebACLResponse, __MetadataBea
12171217
* // },
12181218
* // },
12191219
* // },
1220+
* // RetrofittedByFirewallManager: true || false,
12201221
* // },
12211222
* // LockToken: "STRING_VALUE",
12221223
* // ApplicationIntegrationURL: "STRING_VALUE",

‎clients/client-wafv2/src/commands/GetWebACLForResourceCommand.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,6 +1225,7 @@ export interface GetWebACLForResourceCommandOutput extends GetWebACLForResourceR
12251225
* // },
12261226
* // },
12271227
* // },
1228+
* // RetrofittedByFirewallManager: true || false,
12281229
* // },
12291230
* // };
12301231
*

‎clients/client-wafv2/src/index.ts‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,8 @@
99
* "v2", to distinguish from the prior version. We recommend migrating your resources to
1010
* this version, because it has a number of significant improvements.</p>
1111
* <p>If you used WAF prior to this release, you can't use this WAFV2 API to access any
12-
* WAF resources that you created before. You can access your old rules, web ACLs, and
13-
* other WAF resources only through the WAF Classic APIs. The WAF Classic APIs
14-
* have retained the prior names, endpoints, and namespaces. </p>
15-
* <p>For information, including how to migrate your WAF resources to this version,
12+
* WAF resources that you created before. WAF Classic support will end on September 30, 2025. </p>
13+
* <p>For information about WAF, including how to migrate your WAF Classic resources to this version,
1614
* see the <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html">WAF Developer Guide</a>. </p>
1715
* </note>
1816
* <p>WAF is a web application firewall that lets you monitor the HTTP and HTTPS
@@ -39,26 +37,6 @@
3937
* </ul>
4038
* <p>Alternatively, you can use one of the Amazon Web Services SDKs to access an API that's tailored to the
4139
* programming language or platform that you're using. For more information, see <a href="http://aws.amazon.com/tools/#SDKs">Amazon Web Services SDKs</a>.</p>
42-
* <p>We currently provide two versions of the WAF API: this API and the prior versions,
43-
* the classic WAF APIs. This new API provides the same functionality as the older versions,
44-
* with the following major improvements:</p>
45-
* <ul>
46-
* <li>
47-
* <p>You use one API for both global and regional applications. Where you need to
48-
* distinguish the scope, you specify a <code>Scope</code> parameter and set it to
49-
* <code>CLOUDFRONT</code> or <code>REGIONAL</code>. </p>
50-
* </li>
51-
* <li>
52-
* <p>You can define a web ACL or rule group with a single call, and update it with a
53-
* single call. You define all rule specifications in JSON format, and pass them to your
54-
* rule group or web ACL calls.</p>
55-
* </li>
56-
* <li>
57-
* <p>The limits WAF places on the use of rules more closely reflects the cost of
58-
* running each type of rule. Rule groups include capacity settings, so you know the
59-
* maximum cost of a rule group when you use it.</p>
60-
* </li>
61-
* </ul>
6240
*
6341
* @packageDocumentation
6442
*/

‎clients/client-wafv2/src/models/models_0.ts‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5337,7 +5337,11 @@ export interface LoggingConfiguration {
53375337
/**
53385338
* <p>Indicates whether the logging configuration was created by Firewall Manager, as part of an
53395339
* WAF policy configuration. If true, only Firewall Manager can modify or delete the
5340-
* configuration. </p>
5340+
* configuration. </p>
5341+
* <p>The logging configuration can be created by Firewall Manager for use with any web ACL that Firewall Manager is using for an WAF policy.
5342+
* Web ACLs that Firewall Manager creates and uses have their <code>ManagedByFirewallManager</code> property set to true. Web ACLs that were created
5343+
* by a customer account and then retrofitted by Firewall Manager for use by a policy have their <code>RetrofittedByFirewallManager</code> property set to true.
5344+
* For either case, any corresponding logging configuration will indicate <code>ManagedByFirewallManager</code>.</p>
53415345
* @public
53425346
*/
53435347
ManagedByFirewallManager?: boolean;
@@ -8950,8 +8954,9 @@ export interface WebACL {
89508954
PostProcessFirewallManagerRuleGroups?: FirewallManagerRuleGroup[];
89518955

89528956
/**
8953-
* <p>Indicates whether this web ACL is managed by Firewall Manager. If true, then only Firewall Manager can
8954-
* delete the web ACL or any Firewall Manager rule groups in the web ACL. </p>
8957+
* <p>Indicates whether this web ACL was created by Firewall Manager and is being managed by Firewall Manager. If true, then only Firewall Manager can
8958+
* delete the web ACL or any Firewall Manager rule groups in the web ACL.
8959+
* See also the properties <code>RetrofittedByFirewallManager</code>, <code>PreProcessFirewallManagerRuleGroups</code>, and <code>PostProcessFirewallManagerRuleGroups</code>. </p>
89558960
* @public
89568961
*/
89578962
ManagedByFirewallManager?: boolean;
@@ -9017,6 +9022,14 @@ export interface WebACL {
90179022
* @public
90189023
*/
90199024
AssociationConfig?: AssociationConfig;
9025+
9026+
/**
9027+
* <p>Indicates whether this web ACL was created by a customer account and then retrofitted by Firewall Manager. If true, then the web ACL is currently being
9028+
* managed by a Firewall Manager WAF policy, and only Firewall Manager can manage any Firewall Manager rule groups in the web ACL.
9029+
* See also the properties <code>ManagedByFirewallManager</code>, <code>PreProcessFirewallManagerRuleGroups</code>, and <code>PostProcessFirewallManagerRuleGroups</code>. </p>
9030+
* @public
9031+
*/
9032+
RetrofittedByFirewallManager?: boolean;
90209033
}
90219034

90229035
/**

‎clients/client-wafv2/src/protocols/Aws_json1_1.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3998,6 +3998,7 @@ const de_WebACL = (output: any, context: __SerdeContext): WebACL => {
39983998
Name: __expectString,
39993999
PostProcessFirewallManagerRuleGroups: (_: any) => de_FirewallManagerRuleGroups(_, context),
40004000
PreProcessFirewallManagerRuleGroups: (_: any) => de_FirewallManagerRuleGroups(_, context),
4001+
RetrofittedByFirewallManager: __expectBoolean,
40014002
Rules: (_: any) => de_Rules(_, context),
40024003
TokenDomains: _json,
40034004
VisibilityConfig: _json,

0 commit comments

Comments
 (0)