From df8a5856b1df974207218d84ce47e4bbdcb28563 Mon Sep 17 00:00:00 2001 From: aws-sdk-go-automation <43143561+aws-sdk-go-automation@users.noreply.github.com> Date: Tue, 16 May 2023 11:22:41 -0700 Subject: [PATCH] Release v1.44.264 (2023-05-16) (#4841) Release v1.44.264 (2023-05-16) === ### Service Client Updates * `service/detective`: Updates service API * `service/directconnect`: Updates service documentation * This release includes an update to the mtu value for CreateTransitVirtualInterface from 9001 mtu to 8500 mtu. * `service/glue`: Updates service API and documentation * Add Support for Tags for Custom Entity Types * `service/secretsmanager`: Updates service documentation * Documentation updates for Secrets Manager * `service/wafv2`: Updates service API and documentation --- CHANGELOG.md | 13 + aws/endpoints/defaults.go | 89 ++ aws/version.go | 2 +- models/apis/detective/2018-10-26/api-2.json | 3 +- .../2018-10-26/endpoint-rule-set-1.json | 392 ++--- .../2018-10-26/endpoint-tests-1.json | 923 +++--------- .../apis/directconnect/2012-10-25/docs-2.json | 4 +- models/apis/glue/2017-03-31/api-2.json | 6 +- models/apis/glue/2017-03-31/docs-2.json | 2 + .../secretsmanager/2017-10-17/docs-2.json | 6 +- models/apis/wafv2/2019-07-29/api-2.json | 108 +- models/apis/wafv2/2019-07-29/docs-2.json | 111 +- models/endpoints/endpoints.json | 76 +- service/detective/api.go | 4 + service/directconnect/api.go | 6 +- service/glue/api.go | 18 + service/secretsmanager/api.go | 13 +- service/wafv2/api.go | 1339 ++++++++++++++--- service/wafv2/errors.go | 9 + 19 files changed, 1954 insertions(+), 1170 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 18a7c9e0e4f..bc44a823fd9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,16 @@ +Release v1.44.264 (2023-05-16) +=== + +### Service Client Updates +* `service/detective`: Updates service API +* `service/directconnect`: Updates service documentation + * This release includes an update to the mtu value for CreateTransitVirtualInterface from 9001 mtu to 8500 mtu. +* `service/glue`: Updates service API and documentation + * Add Support for Tags for Custom Entity Types +* `service/secretsmanager`: Updates service documentation + * Documentation updates for Secrets Manager +* `service/wafv2`: Updates service API and documentation + Release v1.44.263 (2023-05-15) === diff --git a/aws/endpoints/defaults.go b/aws/endpoints/defaults.go index 2d665d61ba8..22d4d9f3f80 100644 --- a/aws/endpoints/defaults.go +++ b/aws/endpoints/defaults.go @@ -20401,18 +20401,63 @@ var awsPartition = partition{ endpointKey{ Region: "ca-central-1", }: endpoint{}, + endpointKey{ + Region: "ca-central-1", + Variant: fipsVariant, + }: endpoint{ + Hostname: "profile-fips.ca-central-1.amazonaws.com", + }, endpointKey{ Region: "eu-central-1", }: endpoint{}, endpointKey{ Region: "eu-west-2", }: endpoint{}, + endpointKey{ + Region: "fips-ca-central-1", + }: endpoint{ + Hostname: "profile-fips.ca-central-1.amazonaws.com", + CredentialScope: credentialScope{ + Region: "ca-central-1", + }, + Deprecated: boxedTrue, + }, + endpointKey{ + Region: "fips-us-east-1", + }: endpoint{ + Hostname: "profile-fips.us-east-1.amazonaws.com", + CredentialScope: credentialScope{ + Region: "us-east-1", + }, + Deprecated: boxedTrue, + }, + endpointKey{ + Region: "fips-us-west-2", + }: endpoint{ + Hostname: "profile-fips.us-west-2.amazonaws.com", + CredentialScope: credentialScope{ + Region: "us-west-2", + }, + Deprecated: boxedTrue, + }, endpointKey{ Region: "us-east-1", }: endpoint{}, + endpointKey{ + Region: "us-east-1", + Variant: fipsVariant, + }: endpoint{ + Hostname: "profile-fips.us-east-1.amazonaws.com", + }, endpointKey{ Region: "us-west-2", }: endpoint{}, + endpointKey{ + Region: "us-west-2", + Variant: fipsVariant, + }: endpoint{ + Hostname: "profile-fips.us-west-2.amazonaws.com", + }, }, }, "projects.iot1click": service{ @@ -38807,6 +38852,28 @@ var awsisoPartition = partition{ }: endpoint{}, }, }, + "rbin": service{ + Endpoints: serviceEndpoints{ + endpointKey{ + Region: "fips-us-iso-east-1", + }: endpoint{ + Hostname: "rbin-fips.us-iso-east-1.c2s.ic.gov", + CredentialScope: credentialScope{ + Region: "us-iso-east-1", + }, + Deprecated: boxedTrue, + }, + endpointKey{ + Region: "us-iso-east-1", + }: endpoint{}, + endpointKey{ + Region: "us-iso-east-1", + Variant: fipsVariant, + }: endpoint{ + Hostname: "rbin-fips.us-iso-east-1.c2s.ic.gov", + }, + }, + }, "rds": service{ Endpoints: serviceEndpoints{ endpointKey{ @@ -39468,6 +39535,28 @@ var awsisobPartition = partition{ }: endpoint{}, }, }, + "rbin": service{ + Endpoints: serviceEndpoints{ + endpointKey{ + Region: "fips-us-isob-east-1", + }: endpoint{ + Hostname: "rbin-fips.us-isob-east-1.sc2s.sgov.gov", + CredentialScope: credentialScope{ + Region: "us-isob-east-1", + }, + Deprecated: boxedTrue, + }, + endpointKey{ + Region: "us-isob-east-1", + }: endpoint{}, + endpointKey{ + Region: "us-isob-east-1", + Variant: fipsVariant, + }: endpoint{ + Hostname: "rbin-fips.us-isob-east-1.sc2s.sgov.gov", + }, + }, + }, "rds": service{ Endpoints: serviceEndpoints{ endpointKey{ diff --git a/aws/version.go b/aws/version.go index 9e1a41ed169..d3f98bd1747 100644 --- a/aws/version.go +++ b/aws/version.go @@ -5,4 +5,4 @@ package aws const SDKName = "aws-sdk-go" // SDKVersion is the version of this SDK -const SDKVersion = "1.44.263" +const SDKVersion = "1.44.264" diff --git a/models/apis/detective/2018-10-26/api-2.json b/models/apis/detective/2018-10-26/api-2.json index ff239e33292..892b41d32f9 100644 --- a/models/apis/detective/2018-10-26/api-2.json +++ b/models/apis/detective/2018-10-26/api-2.json @@ -517,7 +517,8 @@ "type":"string", "enum":[ "DETECTIVE_CORE", - "EKS_AUDIT" + "EKS_AUDIT", + "ASFF_SECURITYHUB_FINDING" ] }, "DatasourcePackageIngestDetail":{ diff --git a/models/apis/detective/2018-10-26/endpoint-rule-set-1.json b/models/apis/detective/2018-10-26/endpoint-rule-set-1.json index c6e55e4bfe2..7227bac202c 100644 --- a/models/apis/detective/2018-10-26/endpoint-rule-set-1.json +++ b/models/apis/detective/2018-10-26/endpoint-rule-set-1.json @@ -3,7 +3,7 @@ "parameters": { "Region": { "builtIn": "AWS::Region", - "required": true, + "required": false, "documentation": "The AWS region used to dispatch the request.", "type": "String" }, @@ -32,13 +32,12 @@ { "conditions": [ { - "fn": "aws.partition", + "fn": "isSet", "argv": [ { - "ref": "Region" + "ref": "Endpoint" } - ], - "assign": "PartitionResult" + ] } ], "type": "tree", @@ -46,14 +45,20 @@ { "conditions": [ { - "fn": "isSet", + "fn": "booleanEquals", "argv": [ { - "ref": "Endpoint" - } + "ref": "UseFIPS" + }, + true ] } ], + "error": "Invalid Configuration: FIPS and custom endpoint are not supported", + "type": "error" + }, + { + "conditions": [], "type": "tree", "rules": [ { @@ -62,67 +67,42 @@ "fn": "booleanEquals", "argv": [ { - "ref": "UseFIPS" + "ref": "UseDualStack" }, true ] } ], - "error": "Invalid Configuration: FIPS and custom endpoint are not supported", + "error": "Invalid Configuration: Dualstack and custom endpoint are not supported", "type": "error" }, { "conditions": [], - "type": "tree", - "rules": [ - { - "conditions": [ - { - "fn": "booleanEquals", - "argv": [ - { - "ref": "UseDualStack" - }, - true - ] - } - ], - "error": "Invalid Configuration: Dualstack and custom endpoint are not supported", - "type": "error" + "endpoint": { + "url": { + "ref": "Endpoint" }, - { - "conditions": [], - "endpoint": { - "url": { - "ref": "Endpoint" - }, - "properties": {}, - "headers": {} - }, - "type": "endpoint" - } - ] + "properties": {}, + "headers": {} + }, + "type": "endpoint" } ] - }, + } + ] + }, + { + "conditions": [], + "type": "tree", + "rules": [ { "conditions": [ { - "fn": "booleanEquals", - "argv": [ - { - "ref": "UseFIPS" - }, - true - ] - }, - { - "fn": "booleanEquals", + "fn": "isSet", "argv": [ { - "ref": "UseDualStack" - }, - true + "ref": "Region" + } ] } ], @@ -131,90 +111,215 @@ { "conditions": [ { - "fn": "booleanEquals", + "fn": "aws.partition", "argv": [ - true, { - "fn": "getAttr", + "ref": "Region" + } + ], + "assign": "PartitionResult" + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseFIPS" + }, + true + ] + }, + { + "fn": "booleanEquals", "argv": [ { - "ref": "PartitionResult" + "ref": "UseDualStack" + }, + true + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsFIPS" + ] + } + ] }, - "supportsFIPS" + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsDualStack" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://api.detective-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } ] + }, + { + "conditions": [], + "error": "FIPS and DualStack are enabled, but this partition does not support one or both", + "type": "error" } ] }, { - "fn": "booleanEquals", - "argv": [ - true, + "conditions": [ { - "fn": "getAttr", + "fn": "booleanEquals", "argv": [ { - "ref": "PartitionResult" + "ref": "UseFIPS" }, - "supportsDualStack" + true ] } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsFIPS" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://api.detective-fips.{Region}.{PartitionResult#dnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } + ] + }, + { + "conditions": [], + "error": "FIPS is enabled but this partition does not support FIPS", + "type": "error" + } ] - } - ], - "type": "tree", - "rules": [ - { - "conditions": [], - "endpoint": { - "url": "https://api.detective-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", - "properties": {}, - "headers": {} - }, - "type": "endpoint" - } - ] - }, - { - "conditions": [], - "error": "FIPS and DualStack are enabled, but this partition does not support one or both", - "type": "error" - } - ] - }, - { - "conditions": [ - { - "fn": "booleanEquals", - "argv": [ - { - "ref": "UseFIPS" }, - true - ] - } - ], - "type": "tree", - "rules": [ - { - "conditions": [ { - "fn": "booleanEquals", - "argv": [ - true, + "conditions": [ { - "fn": "getAttr", + "fn": "booleanEquals", "argv": [ { - "ref": "PartitionResult" + "ref": "UseDualStack" }, - "supportsFIPS" + true + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsDualStack" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://api.detective.{Region}.{PartitionResult#dualStackDnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } ] + }, + { + "conditions": [], + "error": "DualStack is enabled but this partition does not support DualStack", + "type": "error" } ] - } - ], - "type": "tree", - "rules": [ + }, { "conditions": [], "type": "tree", @@ -222,7 +327,7 @@ { "conditions": [], "endpoint": { - "url": "https://api.detective-fips.{Region}.{PartitionResult#dnsSuffix}", + "url": "https://api.detective.{Region}.{PartitionResult#dnsSuffix}", "properties": {}, "headers": {} }, @@ -231,74 +336,13 @@ ] } ] - }, - { - "conditions": [], - "error": "FIPS is enabled but this partition does not support FIPS", - "type": "error" - } - ] - }, - { - "conditions": [ - { - "fn": "booleanEquals", - "argv": [ - { - "ref": "UseDualStack" - }, - true - ] - } - ], - "type": "tree", - "rules": [ - { - "conditions": [ - { - "fn": "booleanEquals", - "argv": [ - true, - { - "fn": "getAttr", - "argv": [ - { - "ref": "PartitionResult" - }, - "supportsDualStack" - ] - } - ] - } - ], - "type": "tree", - "rules": [ - { - "conditions": [], - "endpoint": { - "url": "https://api.detective.{Region}.{PartitionResult#dualStackDnsSuffix}", - "properties": {}, - "headers": {} - }, - "type": "endpoint" - } - ] - }, - { - "conditions": [], - "error": "DualStack is enabled but this partition does not support DualStack", - "type": "error" } ] }, { "conditions": [], - "endpoint": { - "url": "https://api.detective.{Region}.{PartitionResult#dnsSuffix}", - "properties": {}, - "headers": {} - }, - "type": "endpoint" + "error": "Invalid Configuration: Missing Region", + "type": "error" } ] } diff --git a/models/apis/detective/2018-10-26/endpoint-tests-1.json b/models/apis/detective/2018-10-26/endpoint-tests-1.json index 7d8cee9a3f5..2c6f75a9e02 100644 --- a/models/apis/detective/2018-10-26/endpoint-tests-1.json +++ b/models/apis/detective/2018-10-26/endpoint-tests-1.json @@ -1,276 +1,276 @@ { "testCases": [ { - "documentation": "For region ap-south-1 with FIPS enabled and DualStack enabled", + "documentation": "For region af-south-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.ap-south-1.api.aws" + "url": "https://api.detective.af-south-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "ap-south-1", - "UseDualStack": true + "Region": "af-south-1", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region ap-south-1 with FIPS enabled and DualStack disabled", + "documentation": "For region ap-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.ap-south-1.amazonaws.com" + "url": "https://api.detective.ap-east-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "ap-south-1", + "Region": "ap-east-1", + "UseFIPS": false, "UseDualStack": false } }, { - "documentation": "For region ap-south-1 with FIPS disabled and DualStack enabled", + "documentation": "For region ap-northeast-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.ap-south-1.api.aws" + "url": "https://api.detective.ap-northeast-1.amazonaws.com" } }, "params": { + "Region": "ap-northeast-1", "UseFIPS": false, - "Region": "ap-south-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region ap-south-1 with FIPS disabled and DualStack disabled", + "documentation": "For region ap-northeast-2 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.ap-south-1.amazonaws.com" + "url": "https://api.detective.ap-northeast-2.amazonaws.com" } }, "params": { + "Region": "ap-northeast-2", "UseFIPS": false, - "Region": "ap-south-1", "UseDualStack": false } }, { - "documentation": "For region eu-south-1 with FIPS enabled and DualStack enabled", + "documentation": "For region ap-south-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-south-1.api.aws" + "url": "https://api.detective.ap-south-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "eu-south-1", - "UseDualStack": true + "Region": "ap-south-1", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region eu-south-1 with FIPS enabled and DualStack disabled", + "documentation": "For region ap-southeast-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-south-1.amazonaws.com" + "url": "https://api.detective.ap-southeast-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "eu-south-1", + "Region": "ap-southeast-1", + "UseFIPS": false, "UseDualStack": false } }, { - "documentation": "For region eu-south-1 with FIPS disabled and DualStack enabled", + "documentation": "For region ap-southeast-2 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-south-1.api.aws" + "url": "https://api.detective.ap-southeast-2.amazonaws.com" } }, "params": { + "Region": "ap-southeast-2", "UseFIPS": false, - "Region": "eu-south-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region eu-south-1 with FIPS disabled and DualStack disabled", + "documentation": "For region ca-central-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-south-1.amazonaws.com" + "url": "https://api.detective.ca-central-1.amazonaws.com" } }, "params": { + "Region": "ca-central-1", "UseFIPS": false, - "Region": "eu-south-1", "UseDualStack": false } }, { - "documentation": "For region us-gov-east-1 with FIPS enabled and DualStack enabled", + "documentation": "For region eu-central-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.us-gov-east-1.api.aws" + "url": "https://api.detective.eu-central-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "us-gov-east-1", - "UseDualStack": true + "Region": "eu-central-1", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region us-gov-east-1 with FIPS enabled and DualStack disabled", + "documentation": "For region eu-north-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.us-gov-east-1.amazonaws.com" + "url": "https://api.detective.eu-north-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "us-gov-east-1", + "Region": "eu-north-1", + "UseFIPS": false, "UseDualStack": false } }, { - "documentation": "For region us-gov-east-1 with FIPS disabled and DualStack enabled", + "documentation": "For region eu-south-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.us-gov-east-1.api.aws" + "url": "https://api.detective.eu-south-1.amazonaws.com" } }, "params": { + "Region": "eu-south-1", "UseFIPS": false, - "Region": "us-gov-east-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region us-gov-east-1 with FIPS disabled and DualStack disabled", + "documentation": "For region eu-west-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.us-gov-east-1.amazonaws.com" + "url": "https://api.detective.eu-west-1.amazonaws.com" } }, "params": { + "Region": "eu-west-1", "UseFIPS": false, - "Region": "us-gov-east-1", "UseDualStack": false } }, { - "documentation": "For region ca-central-1 with FIPS enabled and DualStack enabled", + "documentation": "For region eu-west-2 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.ca-central-1.api.aws" + "url": "https://api.detective.eu-west-2.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "ca-central-1", - "UseDualStack": true + "Region": "eu-west-2", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region ca-central-1 with FIPS enabled and DualStack disabled", + "documentation": "For region eu-west-3 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.ca-central-1.amazonaws.com" + "url": "https://api.detective.eu-west-3.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "ca-central-1", + "Region": "eu-west-3", + "UseFIPS": false, "UseDualStack": false } }, { - "documentation": "For region ca-central-1 with FIPS disabled and DualStack enabled", + "documentation": "For region me-south-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.ca-central-1.api.aws" + "url": "https://api.detective.me-south-1.amazonaws.com" } }, "params": { + "Region": "me-south-1", "UseFIPS": false, - "Region": "ca-central-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region ca-central-1 with FIPS disabled and DualStack disabled", + "documentation": "For region sa-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.ca-central-1.amazonaws.com" + "url": "https://api.detective.sa-east-1.amazonaws.com" } }, "params": { + "Region": "sa-east-1", "UseFIPS": false, - "Region": "ca-central-1", "UseDualStack": false } }, { - "documentation": "For region eu-central-1 with FIPS enabled and DualStack enabled", + "documentation": "For region us-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-central-1.api.aws" + "url": "https://api.detective.us-east-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "eu-central-1", - "UseDualStack": true + "Region": "us-east-1", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region eu-central-1 with FIPS enabled and DualStack disabled", + "documentation": "For region us-east-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-central-1.amazonaws.com" + "url": "https://api.detective-fips.us-east-1.amazonaws.com" } }, "params": { + "Region": "us-east-1", "UseFIPS": true, - "Region": "eu-central-1", "UseDualStack": false } }, { - "documentation": "For region eu-central-1 with FIPS disabled and DualStack enabled", + "documentation": "For region us-east-2 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-central-1.api.aws" + "url": "https://api.detective.us-east-2.amazonaws.com" } }, "params": { + "Region": "us-east-2", "UseFIPS": false, - "Region": "eu-central-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region eu-central-1 with FIPS disabled and DualStack disabled", + "documentation": "For region us-east-2 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-central-1.amazonaws.com" + "url": "https://api.detective-fips.us-east-2.amazonaws.com" } }, "params": { - "UseFIPS": false, - "Region": "eu-central-1", + "Region": "us-east-2", + "UseFIPS": true, "UseDualStack": false } }, { - "documentation": "For region us-west-1 with FIPS enabled and DualStack enabled", + "documentation": "For region us-west-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.us-west-1.api.aws" + "url": "https://api.detective.us-west-1.amazonaws.com" } }, "params": { - "UseFIPS": true, "Region": "us-west-1", - "UseDualStack": true + "UseFIPS": false, + "UseDualStack": false } }, { @@ -281,879 +281,312 @@ } }, "params": { - "UseFIPS": true, "Region": "us-west-1", + "UseFIPS": true, "UseDualStack": false } }, { - "documentation": "For region us-west-1 with FIPS disabled and DualStack enabled", + "documentation": "For region us-west-2 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.us-west-1.api.aws" + "url": "https://api.detective.us-west-2.amazonaws.com" } }, "params": { + "Region": "us-west-2", "UseFIPS": false, - "Region": "us-west-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region us-west-1 with FIPS disabled and DualStack disabled", + "documentation": "For region us-west-2 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.us-west-1.amazonaws.com" + "url": "https://api.detective-fips.us-west-2.amazonaws.com" } }, "params": { - "UseFIPS": false, - "Region": "us-west-1", + "Region": "us-west-2", + "UseFIPS": true, "UseDualStack": false } }, { - "documentation": "For region us-west-2 with FIPS enabled and DualStack enabled", + "documentation": "For region us-east-1 with FIPS enabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.us-west-2.api.aws" + "url": "https://api.detective-fips.us-east-1.api.aws" } }, "params": { + "Region": "us-east-1", "UseFIPS": true, - "Region": "us-west-2", "UseDualStack": true } }, { - "documentation": "For region us-west-2 with FIPS enabled and DualStack disabled", + "documentation": "For region us-east-1 with FIPS disabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.us-west-2.amazonaws.com" + "url": "https://api.detective.us-east-1.api.aws" } }, "params": { - "UseFIPS": true, - "Region": "us-west-2", - "UseDualStack": false + "Region": "us-east-1", + "UseFIPS": false, + "UseDualStack": true } }, { - "documentation": "For region us-west-2 with FIPS disabled and DualStack enabled", + "documentation": "For region cn-north-1 with FIPS enabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective.us-west-2.api.aws" + "url": "https://api.detective-fips.cn-north-1.api.amazonwebservices.com.cn" } }, "params": { - "UseFIPS": false, - "Region": "us-west-2", + "Region": "cn-north-1", + "UseFIPS": true, "UseDualStack": true } }, { - "documentation": "For region us-west-2 with FIPS disabled and DualStack disabled", + "documentation": "For region cn-north-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.us-west-2.amazonaws.com" + "url": "https://api.detective-fips.cn-north-1.amazonaws.com.cn" } }, "params": { - "UseFIPS": false, - "Region": "us-west-2", + "Region": "cn-north-1", + "UseFIPS": true, "UseDualStack": false } }, { - "documentation": "For region af-south-1 with FIPS enabled and DualStack enabled", + "documentation": "For region cn-north-1 with FIPS disabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.af-south-1.api.aws" + "url": "https://api.detective.cn-north-1.api.amazonwebservices.com.cn" } }, "params": { - "UseFIPS": true, - "Region": "af-south-1", + "Region": "cn-north-1", + "UseFIPS": false, "UseDualStack": true } }, { - "documentation": "For region af-south-1 with FIPS enabled and DualStack disabled", + "documentation": "For region cn-north-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.af-south-1.amazonaws.com" + "url": "https://api.detective.cn-north-1.amazonaws.com.cn" } }, "params": { - "UseFIPS": true, - "Region": "af-south-1", + "Region": "cn-north-1", + "UseFIPS": false, "UseDualStack": false } }, { - "documentation": "For region af-south-1 with FIPS disabled and DualStack enabled", + "documentation": "For region us-gov-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.af-south-1.api.aws" + "url": "https://api.detective.us-gov-east-1.amazonaws.com" } }, "params": { + "Region": "us-gov-east-1", "UseFIPS": false, - "Region": "af-south-1", - "UseDualStack": true + "UseDualStack": false } }, { - "documentation": "For region af-south-1 with FIPS disabled and DualStack disabled", + "documentation": "For region us-gov-east-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.af-south-1.amazonaws.com" + "url": "https://api.detective-fips.us-gov-east-1.amazonaws.com" } }, "params": { - "UseFIPS": false, - "Region": "af-south-1", + "Region": "us-gov-east-1", + "UseFIPS": true, "UseDualStack": false } }, { - "documentation": "For region eu-north-1 with FIPS enabled and DualStack enabled", + "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-north-1.api.aws" + "url": "https://api.detective.us-gov-west-1.amazonaws.com" } }, "params": { - "UseFIPS": true, - "Region": "eu-north-1", - "UseDualStack": true + "Region": "us-gov-west-1", + "UseFIPS": false, + "UseDualStack": false } }, { - "documentation": "For region eu-north-1 with FIPS enabled and DualStack disabled", + "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-north-1.amazonaws.com" + "url": "https://api.detective-fips.us-gov-west-1.amazonaws.com" } }, "params": { + "Region": "us-gov-west-1", "UseFIPS": true, - "Region": "eu-north-1", "UseDualStack": false } }, { - "documentation": "For region eu-north-1 with FIPS disabled and DualStack enabled", + "documentation": "For region us-gov-east-1 with FIPS enabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-north-1.api.aws" + "url": "https://api.detective-fips.us-gov-east-1.api.aws" } }, "params": { - "UseFIPS": false, - "Region": "eu-north-1", + "Region": "us-gov-east-1", + "UseFIPS": true, "UseDualStack": true } }, { - "documentation": "For region eu-north-1 with FIPS disabled and DualStack disabled", + "documentation": "For region us-gov-east-1 with FIPS disabled and DualStack enabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-north-1.amazonaws.com" + "url": "https://api.detective.us-gov-east-1.api.aws" } }, "params": { + "Region": "us-gov-east-1", "UseFIPS": false, - "Region": "eu-north-1", - "UseDualStack": false + "UseDualStack": true } }, { - "documentation": "For region eu-west-3 with FIPS enabled and DualStack enabled", + "documentation": "For region us-iso-east-1 with FIPS enabled and DualStack enabled", "expect": { - "endpoint": { - "url": "https://api.detective-fips.eu-west-3.api.aws" - } + "error": "FIPS and DualStack are enabled, but this partition does not support one or both" }, "params": { + "Region": "us-iso-east-1", "UseFIPS": true, - "Region": "eu-west-3", "UseDualStack": true } }, { - "documentation": "For region eu-west-3 with FIPS enabled and DualStack disabled", + "documentation": "For region us-iso-east-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-west-3.amazonaws.com" + "url": "https://api.detective-fips.us-iso-east-1.c2s.ic.gov" } }, "params": { + "Region": "us-iso-east-1", "UseFIPS": true, - "Region": "eu-west-3", "UseDualStack": false } }, { - "documentation": "For region eu-west-3 with FIPS disabled and DualStack enabled", + "documentation": "For region us-iso-east-1 with FIPS disabled and DualStack enabled", "expect": { - "endpoint": { - "url": "https://api.detective.eu-west-3.api.aws" - } + "error": "DualStack is enabled but this partition does not support DualStack" }, "params": { + "Region": "us-iso-east-1", "UseFIPS": false, - "Region": "eu-west-3", "UseDualStack": true } }, { - "documentation": "For region eu-west-3 with FIPS disabled and DualStack disabled", + "documentation": "For region us-iso-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-west-3.amazonaws.com" + "url": "https://api.detective.us-iso-east-1.c2s.ic.gov" } }, "params": { + "Region": "us-iso-east-1", "UseFIPS": false, - "Region": "eu-west-3", "UseDualStack": false } }, { - "documentation": "For region eu-west-2 with FIPS enabled and DualStack enabled", + "documentation": "For region us-isob-east-1 with FIPS enabled and DualStack enabled", "expect": { - "endpoint": { - "url": "https://api.detective-fips.eu-west-2.api.aws" - } + "error": "FIPS and DualStack are enabled, but this partition does not support one or both" }, "params": { + "Region": "us-isob-east-1", "UseFIPS": true, - "Region": "eu-west-2", "UseDualStack": true } }, { - "documentation": "For region eu-west-2 with FIPS enabled and DualStack disabled", + "documentation": "For region us-isob-east-1 with FIPS enabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-west-2.amazonaws.com" + "url": "https://api.detective-fips.us-isob-east-1.sc2s.sgov.gov" } }, "params": { + "Region": "us-isob-east-1", "UseFIPS": true, - "Region": "eu-west-2", "UseDualStack": false } }, { - "documentation": "For region eu-west-2 with FIPS disabled and DualStack enabled", + "documentation": "For region us-isob-east-1 with FIPS disabled and DualStack enabled", "expect": { - "endpoint": { - "url": "https://api.detective.eu-west-2.api.aws" - } + "error": "DualStack is enabled but this partition does not support DualStack" }, "params": { + "Region": "us-isob-east-1", "UseFIPS": false, - "Region": "eu-west-2", "UseDualStack": true } }, { - "documentation": "For region eu-west-2 with FIPS disabled and DualStack disabled", + "documentation": "For region us-isob-east-1 with FIPS disabled and DualStack disabled", "expect": { "endpoint": { - "url": "https://api.detective.eu-west-2.amazonaws.com" + "url": "https://api.detective.us-isob-east-1.sc2s.sgov.gov" } }, "params": { + "Region": "us-isob-east-1", "UseFIPS": false, - "Region": "eu-west-2", "UseDualStack": false } }, { - "documentation": "For region eu-west-1 with FIPS enabled and DualStack enabled", + "documentation": "For custom endpoint with region set and fips disabled and dualstack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-west-1.api.aws" + "url": "https://example.com" } }, "params": { - "UseFIPS": true, - "Region": "eu-west-1", - "UseDualStack": true + "Region": "us-east-1", + "UseFIPS": false, + "UseDualStack": false, + "Endpoint": "https://example.com" } }, { - "documentation": "For region eu-west-1 with FIPS enabled and DualStack disabled", + "documentation": "For custom endpoint with region not set and fips disabled and dualstack disabled", "expect": { "endpoint": { - "url": "https://api.detective-fips.eu-west-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "eu-west-1", - "UseDualStack": false - } - }, - { - "documentation": "For region eu-west-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.eu-west-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "eu-west-1", - "UseDualStack": true - } - }, - { - "documentation": "For region eu-west-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.eu-west-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "eu-west-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-northeast-2 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-northeast-2.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-northeast-2", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-northeast-2 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-northeast-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-northeast-2", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-northeast-2 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-northeast-2.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-northeast-2", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-northeast-2 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-northeast-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-northeast-2", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-northeast-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-northeast-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-northeast-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-northeast-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-northeast-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-northeast-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-northeast-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-northeast-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-northeast-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-northeast-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-northeast-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-northeast-1", - "UseDualStack": false - } - }, - { - "documentation": "For region me-south-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.me-south-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "me-south-1", - "UseDualStack": true - } - }, - { - "documentation": "For region me-south-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.me-south-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "me-south-1", - "UseDualStack": false - } - }, - { - "documentation": "For region me-south-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.me-south-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "me-south-1", - "UseDualStack": true - } - }, - { - "documentation": "For region me-south-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.me-south-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "me-south-1", - "UseDualStack": false - } - }, - { - "documentation": "For region sa-east-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.sa-east-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "sa-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region sa-east-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.sa-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "sa-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region sa-east-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.sa-east-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "sa-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region sa-east-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.sa-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "sa-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-east-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-east-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-east-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-east-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-east-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-east-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-gov-west-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-gov-west-1", - "UseDualStack": true - } - }, - { - "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-gov-west-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-gov-west-1", - "UseDualStack": false - } - }, - { - "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-gov-west-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-gov-west-1", - "UseDualStack": true - } - }, - { - "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-gov-west-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-gov-west-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-southeast-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-southeast-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-southeast-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-southeast-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-southeast-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-southeast-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-southeast-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-southeast-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-southeast-1", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-southeast-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-southeast-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-southeast-1", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-southeast-2 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-southeast-2.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-southeast-2", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-southeast-2 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.ap-southeast-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "ap-southeast-2", - "UseDualStack": false - } - }, - { - "documentation": "For region ap-southeast-2 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-southeast-2.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-southeast-2", - "UseDualStack": true - } - }, - { - "documentation": "For region ap-southeast-2 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.ap-southeast-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "ap-southeast-2", - "UseDualStack": false - } - }, - { - "documentation": "For region us-east-1 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-east-1.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region us-east-1 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region us-east-1 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-east-1.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-east-1", - "UseDualStack": true - } - }, - { - "documentation": "For region us-east-1 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-east-1.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-east-1", - "UseDualStack": false - } - }, - { - "documentation": "For region us-east-2 with FIPS enabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-east-2.api.aws" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-east-2", - "UseDualStack": true - } - }, - { - "documentation": "For region us-east-2 with FIPS enabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective-fips.us-east-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": true, - "Region": "us-east-2", - "UseDualStack": false - } - }, - { - "documentation": "For region us-east-2 with FIPS disabled and DualStack enabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-east-2.api.aws" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-east-2", - "UseDualStack": true - } - }, - { - "documentation": "For region us-east-2 with FIPS disabled and DualStack disabled", - "expect": { - "endpoint": { - "url": "https://api.detective.us-east-2.amazonaws.com" - } - }, - "params": { - "UseFIPS": false, - "Region": "us-east-2", - "UseDualStack": false - } - }, - { - "documentation": "For custom endpoint with fips disabled and dualstack disabled", - "expect": { - "endpoint": { - "url": "https://example.com" + "url": "https://example.com" } }, "params": { "UseFIPS": false, - "Region": "us-east-1", "UseDualStack": false, "Endpoint": "https://example.com" } @@ -1164,8 +597,8 @@ "error": "Invalid Configuration: FIPS and custom endpoint are not supported" }, "params": { - "UseFIPS": true, "Region": "us-east-1", + "UseFIPS": true, "UseDualStack": false, "Endpoint": "https://example.com" } @@ -1176,11 +609,17 @@ "error": "Invalid Configuration: Dualstack and custom endpoint are not supported" }, "params": { - "UseFIPS": false, "Region": "us-east-1", + "UseFIPS": false, "UseDualStack": true, "Endpoint": "https://example.com" } + }, + { + "documentation": "Missing region", + "expect": { + "error": "Invalid Configuration: Missing Region" + } } ], "version": "1.0" diff --git a/models/apis/directconnect/2012-10-25/docs-2.json b/models/apis/directconnect/2012-10-25/docs-2.json index a6144268dd8..214eba20f29 100644 --- a/models/apis/directconnect/2012-10-25/docs-2.json +++ b/models/apis/directconnect/2012-10-25/docs-2.json @@ -1163,9 +1163,9 @@ "NewPrivateVirtualInterface$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 9001. The default value is 1500.

", "NewPrivateVirtualInterfaceAllocation$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 9001. The default value is 1500.

", "NewTransitVirtualInterface$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 8500. The default value is 1500.

", - "NewTransitVirtualInterfaceAllocation$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 9001. The default value is 1500.

", + "NewTransitVirtualInterfaceAllocation$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 8500. The default value is 1500

", "UpdateVirtualInterfaceAttributesRequest$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 9001. The default value is 1500.

", - "VirtualInterface$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 9001. The default value is 1500.

" + "VirtualInterface$mtu": "

The maximum transmission unit (MTU), in bytes. The supported values are 1500 and 8500. The default value is 1500

" } }, "MacSecCapable": { diff --git a/models/apis/glue/2017-03-31/api-2.json b/models/apis/glue/2017-03-31/api-2.json index d9cdd7a67fa..1b7363b81e4 100644 --- a/models/apis/glue/2017-03-31/api-2.json +++ b/models/apis/glue/2017-03-31/api-2.json @@ -4926,7 +4926,8 @@ "members":{ "Name":{"shape":"NameString"}, "RegexString":{"shape":"NameString"}, - "ContextWords":{"shape":"ContextWords"} + "ContextWords":{"shape":"ContextWords"}, + "Tags":{"shape":"TagsMap"} } }, "CreateCustomEntityTypeResponse":{ @@ -8772,7 +8773,8 @@ "type":"structure", "members":{ "NextToken":{"shape":"PaginationToken"}, - "MaxResults":{"shape":"PageSize"} + "MaxResults":{"shape":"PageSize"}, + "Tags":{"shape":"TagsMap"} } }, "ListCustomEntityTypesResponse":{ diff --git a/models/apis/glue/2017-03-31/docs-2.json b/models/apis/glue/2017-03-31/docs-2.json index 3f819883df8..1a74935eecb 100644 --- a/models/apis/glue/2017-03-31/docs-2.json +++ b/models/apis/glue/2017-03-31/docs-2.json @@ -7593,6 +7593,7 @@ "CreateBlueprintRequest$Tags": "

The tags to be applied to this blueprint.

", "CreateConnectionRequest$Tags": "

The tags you assign to the connection.

", "CreateCrawlerRequest$Tags": "

The tags to use with this crawler request. You may use tags to limit access to the crawler. For more information about tags in Glue, see Amazon Web Services Tags in Glue in the developer guide.

", + "CreateCustomEntityTypeRequest$Tags": "

A list of tags applied to the custom entity type.

", "CreateDataQualityRulesetRequest$Tags": "

A list of tags applied to the data quality ruleset.

", "CreateDatabaseRequest$Tags": "

The tags you assign to the database.

", "CreateDevEndpointRequest$Tags": "

The tags to use with this DevEndpoint. You may use tags to limit access to the DevEndpoint. For more information about tags in Glue, see Amazon Web Services Tags in Glue in the developer guide.

", @@ -7608,6 +7609,7 @@ "GetTagsResponse$Tags": "

The requested tags.

", "ListBlueprintsRequest$Tags": "

Filters the list by an Amazon Web Services resource tag.

", "ListCrawlersRequest$Tags": "

Specifies to return only these tagged resources.

", + "ListCustomEntityTypesRequest$Tags": "

A list of key-value pair tags.

", "ListDataQualityRulesetsRequest$Tags": "

A list of key-value pair tags.

", "ListDevEndpointsRequest$Tags": "

Specifies to return only these tagged resources.

", "ListJobsRequest$Tags": "

Specifies to return only these tagged resources.

", diff --git a/models/apis/secretsmanager/2017-10-17/docs-2.json b/models/apis/secretsmanager/2017-10-17/docs-2.json index 5b9e7fe955f..03a9d9cf30d 100644 --- a/models/apis/secretsmanager/2017-10-17/docs-2.json +++ b/models/apis/secretsmanager/2017-10-17/docs-2.json @@ -43,7 +43,7 @@ "base": null, "refs": { "CreateSecretRequest$ForceOverwriteReplicaSecret": "

Specifies whether to overwrite a secret with the same name in the destination Region. By default, secrets aren't overwritten.

", - "DeleteSecretRequest$ForceDeleteWithoutRecovery": "

Specifies whether to delete the secret without any recovery window. You can't use both this parameter and RecoveryWindowInDays in the same call. If you don't use either, then by default Secrets Manager uses a 30 day recovery window.

Secrets Manager performs the actual deletion with an asynchronous background process, so there might be a short delay before the secret is permanently deleted. If you delete a secret and then immediately create a secret with the same name, use appropriate back off and retry logic.

Use this parameter with caution. This parameter causes the operation to skip the normal recovery window before the permanent deletion that Secrets Manager would normally impose with the RecoveryWindowInDays parameter. If you delete a secret with the ForceDeleteWithoutRecovery parameter, then you have no opportunity to recover the secret. You lose the secret permanently.

", + "DeleteSecretRequest$ForceDeleteWithoutRecovery": "

Specifies whether to delete the secret without any recovery window. You can't use both this parameter and RecoveryWindowInDays in the same call. If you don't use either, then by default Secrets Manager uses a 30 day recovery window.

Secrets Manager performs the actual deletion with an asynchronous background process, so there might be a short delay before the secret is permanently deleted. If you delete a secret and then immediately create a secret with the same name, use appropriate back off and retry logic.

If you forcibly delete an already deleted or nonexistent secret, the operation does not return ResourceNotFoundException.

Use this parameter with caution. This parameter causes the operation to skip the normal recovery window before the permanent deletion that Secrets Manager would normally impose with the RecoveryWindowInDays parameter. If you delete a secret with the ForceDeleteWithoutRecovery parameter, then you have no opportunity to recover the secret. You lose the secret permanently.

", "ListSecretVersionIdsRequest$IncludeDeprecated": "

Specifies whether to include versions of secrets that don't have any staging labels attached to them. Versions without staging labels are considered deprecated and are subject to deletion by Secrets Manager. By default, versions without staging labels aren't included.

", "ListSecretsRequest$IncludePlannedDeletion": "

Specifies whether to include secrets scheduled for deletion. By default, secrets scheduled for deletion aren't included.

", "PutResourcePolicyRequest$BlockPublicPolicy": "

Specifies whether to block resource-based policies that allow broad access to the secret, for example those that use a wildcard for the principal. By default, public policies aren't blocked.

", @@ -381,8 +381,8 @@ "NextRotationDateType": { "base": null, "refs": { - "DescribeSecretResponse$NextRotationDate": "

The next date and time that Secrets Manager will rotate the secret, rounded to the nearest hour. If the secret isn't configured for rotation, Secrets Manager returns null.

", - "SecretListEntry$NextRotationDate": "

The next date and time that Secrets Manager will attempt to rotate the secret, rounded to the nearest hour. This value is null if the secret is not set up for rotation.

" + "DescribeSecretResponse$NextRotationDate": "

The next rotation is scheduled to occur on or before this date. If the secret isn't configured for rotation, Secrets Manager returns null.

", + "SecretListEntry$NextRotationDate": "

The next rotation is scheduled to occur on or before this date. If the secret isn't configured for rotation, Secrets Manager returns null.

" } }, "NextTokenType": { diff --git a/models/apis/wafv2/2019-07-29/api-2.json b/models/apis/wafv2/2019-07-29/api-2.json index db13de515ac..5938d7ea6f2 100755 --- a/models/apis/wafv2/2019-07-29/api-2.json +++ b/models/apis/wafv2/2019-07-29/api-2.json @@ -419,7 +419,8 @@ {"shape":"WAFInternalErrorException"}, {"shape":"WAFInvalidParameterException"}, {"shape":"WAFNonexistentItemException"}, - {"shape":"WAFInvalidOperationException"} + {"shape":"WAFInvalidOperationException"}, + {"shape":"WAFUnsupportedAggregateKeyTypeException"} ] }, "GetRegexPatternSet":{ @@ -2362,6 +2363,12 @@ "LabelName":{"shape":"LabelName"} } }, + "LabelNamespace":{ + "type":"string", + "max":1024, + "min":1, + "pattern":"^[0-9A-Za-z_\\-:]+:$" + }, "LabelSummaries":{ "type":"list", "member":{"shape":"LabelSummary"} @@ -2883,7 +2890,9 @@ "CHALLENGE_CONFIG", "TOKEN_DOMAIN", "ATP_RULE_SET_RESPONSE_INSPECTION", - "ASSOCIATED_RESOURCE_TYPE" + "ASSOCIATED_RESOURCE_TYPE", + "SCOPE_DOWN", + "CUSTOM_KEYS" ] }, "ParameterExceptionParameter":{ @@ -3000,16 +3009,38 @@ "Limit":{"shape":"RateLimit"}, "AggregateKeyType":{"shape":"RateBasedStatementAggregateKeyType"}, "ScopeDownStatement":{"shape":"Statement"}, - "ForwardedIPConfig":{"shape":"ForwardedIPConfig"} + "ForwardedIPConfig":{"shape":"ForwardedIPConfig"}, + "CustomKeys":{"shape":"RateBasedStatementCustomKeys"} } }, "RateBasedStatementAggregateKeyType":{ "type":"string", "enum":[ "IP", - "FORWARDED_IP" + "FORWARDED_IP", + "CUSTOM_KEYS", + "CONSTANT" ] }, + "RateBasedStatementCustomKey":{ + "type":"structure", + "members":{ + "Header":{"shape":"RateLimitHeader"}, + "Cookie":{"shape":"RateLimitCookie"}, + "QueryArgument":{"shape":"RateLimitQueryArgument"}, + "QueryString":{"shape":"RateLimitQueryString"}, + "HTTPMethod":{"shape":"RateLimitHTTPMethod"}, + "ForwardedIP":{"shape":"RateLimitForwardedIP"}, + "IP":{"shape":"RateLimitIP"}, + "LabelNamespace":{"shape":"RateLimitLabelNamespace"} + } + }, + "RateBasedStatementCustomKeys":{ + "type":"list", + "member":{"shape":"RateBasedStatementCustomKey"}, + "max":5, + "min":1 + }, "RateBasedStatementManagedKeysIPSet":{ "type":"structure", "members":{ @@ -3022,6 +3053,68 @@ "max":2000000000, "min":100 }, + "RateLimitCookie":{ + "type":"structure", + "required":[ + "Name", + "TextTransformations" + ], + "members":{ + "Name":{"shape":"FieldToMatchData"}, + "TextTransformations":{"shape":"TextTransformations"} + } + }, + "RateLimitForwardedIP":{ + "type":"structure", + "members":{ + } + }, + "RateLimitHTTPMethod":{ + "type":"structure", + "members":{ + } + }, + "RateLimitHeader":{ + "type":"structure", + "required":[ + "Name", + "TextTransformations" + ], + "members":{ + "Name":{"shape":"FieldToMatchData"}, + "TextTransformations":{"shape":"TextTransformations"} + } + }, + "RateLimitIP":{ + "type":"structure", + "members":{ + } + }, + "RateLimitLabelNamespace":{ + "type":"structure", + "required":["Namespace"], + "members":{ + "Namespace":{"shape":"LabelNamespace"} + } + }, + "RateLimitQueryArgument":{ + "type":"structure", + "required":[ + "Name", + "TextTransformations" + ], + "members":{ + "Name":{"shape":"FieldToMatchData"}, + "TextTransformations":{"shape":"TextTransformations"} + } + }, + "RateLimitQueryString":{ + "type":"structure", + "required":["TextTransformations"], + "members":{ + "TextTransformations":{"shape":"TextTransformations"} + } + }, "RedactedFields":{ "type":"list", "member":{"shape":"FieldToMatch"}, @@ -3998,6 +4091,13 @@ }, "exception":true }, + "WAFUnsupportedAggregateKeyTypeException":{ + "type":"structure", + "members":{ + "Message":{"shape":"ErrorMessage"} + }, + "exception":true + }, "WebACL":{ "type":"structure", "required":[ diff --git a/models/apis/wafv2/2019-07-29/docs-2.json b/models/apis/wafv2/2019-07-29/docs-2.json index 81d0f343fca..8c94b05b6f4 100755 --- a/models/apis/wafv2/2019-07-29/docs-2.json +++ b/models/apis/wafv2/2019-07-29/docs-2.json @@ -25,7 +25,7 @@ "GetManagedRuleSet": "

Retrieves the specified managed rule set.

This is intended for use only by vendors of managed rule sets. Vendors are Amazon Web Services and Amazon Web Services Marketplace sellers.

Vendors, you can use the managed rule set APIs to provide controlled rollout of your versioned managed rule group offerings for your customers. The APIs are ListManagedRuleSets, GetManagedRuleSet, PutManagedRuleSetVersions, and UpdateManagedRuleSetVersionExpiryDate.

", "GetMobileSdkRelease": "

Retrieves information for the specified mobile SDK release, including release notes and tags.

The mobile SDK is not generally available. Customers who have access to the mobile SDK can use it to establish and manage WAF tokens for use in HTTP(S) requests from a mobile device to WAF. For more information, see WAF client application integration in the WAF Developer Guide.

", "GetPermissionPolicy": "

Returns the IAM policy that is attached to the specified rule group.

You must be the owner of the rule group to perform this operation.

", - "GetRateBasedStatementManagedKeys": "

Retrieves the keys that are currently blocked by a rate-based rule instance. The maximum number of managed keys that can be blocked for a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, those with the highest rates are blocked.

For a rate-based rule that you've defined inside a rule group, provide the name of the rule group reference statement in your request, in addition to the rate-based rule name and the web ACL name.

WAF monitors web requests and manages keys independently for each unique combination of web ACL, optional rule group, and rate-based rule. For example, if you define a rate-based rule inside a rule group, and then use the rule group in a web ACL, WAF monitors web requests and manages keys for that web ACL, rule group reference statement, and rate-based rule instance. If you use the same rule group in a second web ACL, WAF monitors web requests and manages keys for this second usage completely independent of your first.

", + "GetRateBasedStatementManagedKeys": "

Retrieves the IP addresses that are currently blocked by a rate-based rule instance. This is only available for rate-based rules that aggregate solely on the IP address or on the forwarded IP address.

The maximum number of addresses that can be blocked for a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, those with the highest rates are blocked.

For a rate-based rule that you've defined inside a rule group, provide the name of the rule group reference statement in your request, in addition to the rate-based rule name and the web ACL name.

WAF monitors web requests and manages keys independently for each unique combination of web ACL, optional rule group, and rate-based rule. For example, if you define a rate-based rule inside a rule group, and then use the rule group in a web ACL, WAF monitors web requests and manages keys for that web ACL, rule group reference statement, and rate-based rule instance. If you use the same rule group in a second web ACL, WAF monitors web requests and manages keys for this second usage completely independent of your first.

", "GetRegexPatternSet": "

Retrieves the specified RegexPatternSet.

", "GetRuleGroup": "

Retrieves the specified RuleGroup.

", "GetSampledRequests": "

Gets detailed information about a specified number of requests--a sample--that WAF randomly selects from among the first 5,000 requests that your Amazon Web Services resource received during a time range that you choose. You can specify a sample size of up to 500 requests, and you can specify any time range in the previous three hours.

GetSampledRequests returns a time range, which is usually the time range that you specified. However, if your resource (such as a CloudFront distribution) received 5,000 requests before the specified time range elapsed, GetSampledRequests returns an updated time range. This new time range indicates the actual period during which WAF selected the requests in the sample.

", @@ -669,7 +669,8 @@ "WAFSubscriptionNotFoundException$Message": null, "WAFTagOperationException$Message": null, "WAFTagOperationInternalErrorException$Message": null, - "WAFUnavailableEntityException$Message": null + "WAFUnavailableEntityException$Message": null, + "WAFUnsupportedAggregateKeyTypeException$Message": null } }, "ErrorReason": { @@ -743,6 +744,9 @@ "base": null, "refs": { "HeaderNames$member": null, + "RateLimitCookie$Name": "

The name of the cookie to use.

", + "RateLimitHeader$Name": "

The name of the header to use.

", + "RateLimitQueryArgument$Name": "

The name of the query argument to use.

", "SingleHeader$Name": "

The name of the query header to inspect.

", "SingleQueryArgument$Name": "

The name of the query argument to inspect.

" } @@ -795,7 +799,7 @@ "base": "

The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.

If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all.

This configuration is used for GeoMatchStatement and RateBasedStatement. For IPSetReferenceStatement, use IPSetForwardedIPConfig instead.

WAF only evaluates the first IP address found in the specified HTTP header.

", "refs": { "GeoMatchStatement$ForwardedIPConfig": "

The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.

If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all.

", - "RateBasedStatement$ForwardedIPConfig": "

The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.

If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all.

This is required if AggregateKeyType is set to FORWARDED_IP.

" + "RateBasedStatement$ForwardedIPConfig": "

The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify any header name.

If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all.

This is required if you specify a forwarded IP in the rule's aggregate key settings.

" } }, "ForwardedIPHeaderName": { @@ -1155,6 +1159,12 @@ "Condition$LabelNameCondition": "

A single label name condition. This is the fully qualified label name that a log record must contain in order to meet the condition. Fully qualified labels have a prefix, optional namespaces, and label name. The prefix identifies the rule group or web ACL context of the rule that added the label.

" } }, + "LabelNamespace": { + "base": null, + "refs": { + "RateLimitLabelNamespace$Namespace": "

The namespace to use for aggregation.

" + } + }, "LabelSummaries": { "base": null, "refs": { @@ -1642,19 +1652,31 @@ } }, "RateBasedStatement": { - "base": "

A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.

WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by WAF.

When the rule action triggers, WAF blocks additional requests from the IP address until the request rate falls below the limit.

You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:

In this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.

You cannot nest a RateBasedStatement inside another statement, for example inside a NotStatement or OrStatement. You can define a RateBasedStatement inside a web ACL and inside a rule group.

", + "base": "

A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. The rule categorizes requests according to your aggregation criteria, collects them into aggregation instances, and counts and rate limits the requests for each instance.

You can specify individual aggregation keys, like IP address or HTTP method. You can also specify aggregation key combinations, like IP address and HTTP method, or HTTP method, query argument, and cookie.

Each unique set of values for the aggregation keys that you specify is a separate aggregation instance, with the value from each key contributing to the aggregation instance definition.

For example, assume the rule evaluates web requests with the following IP address and HTTP method values:

The rule would create different aggregation instances according to your aggregation criteria, for example:

For any n-tuple of aggregation keys, each unique combination of values for the keys defines a separate aggregation instance, which WAF counts and rate-limits individually.

You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts and rate limits requests that match the nested statement. You can use this nested scope-down statement in conjunction with your aggregation key specifications or you can just count and rate limit all requests that match the scope-down statement, without additional aggregation. When you choose to just manage all requests that match a scope-down statement, the aggregation instance is singular for the rule.

You cannot nest a RateBasedStatement inside another statement, for example inside a NotStatement or OrStatement. You can define a RateBasedStatement inside a web ACL and inside a rule group.

For additional information about the options, see Rate limiting web requests using rate-based rules in the WAF Developer Guide.

If you only aggregate on the individual IP address or forwarded IP address, you can retrieve the list of IP addresses that WAF is currently rate limiting for a rule through the API call GetRateBasedStatementManagedKeys. This option is not available for other aggregation configurations.

WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by WAF.

", "refs": { - "Statement$RateBasedStatement": "

A rate-based rule tracks the rate of requests for each originating IP address, and triggers the rule action when the rate exceeds a limit that you specify on the number of requests in any 5-minute time span. You can use this to put a temporary block on requests from an IP address that is sending excessive requests.

WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by WAF.

When the rule action triggers, WAF blocks additional requests from the IP address until the request rate falls below the limit.

You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts requests that match the nested statement. For example, based on recent requests that you have seen from an attacker, you might create a rate-based rule with a nested AND rule statement that contains the following nested statements:

In this rate-based rule, you also define a rate limit. For this example, the rate limit is 1,000. Requests that meet the criteria of both of the nested statements are counted. If the count exceeds 1,000 requests per five minutes, the rule action triggers. Requests that do not meet the criteria of both of the nested statements are not counted towards the rate limit and are not affected by this rule.

You cannot nest a RateBasedStatement inside another statement, for example inside a NotStatement or OrStatement. You can define a RateBasedStatement inside a web ACL and inside a rule group.

" + "Statement$RateBasedStatement": "

A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. The rule categorizes requests according to your aggregation criteria, collects them into aggregation instances, and counts and rate limits the requests for each instance.

You can specify individual aggregation keys, like IP address or HTTP method. You can also specify aggregation key combinations, like IP address and HTTP method, or HTTP method, query argument, and cookie.

Each unique set of values for the aggregation keys that you specify is a separate aggregation instance, with the value from each key contributing to the aggregation instance definition.

For example, assume the rule evaluates web requests with the following IP address and HTTP method values:

The rule would create different aggregation instances according to your aggregation criteria, for example:

For any n-tuple of aggregation keys, each unique combination of values for the keys defines a separate aggregation instance, which WAF counts and rate-limits individually.

You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it only counts and rate limits requests that match the nested statement. You can use this nested scope-down statement in conjunction with your aggregation key specifications or you can just count and rate limit all requests that match the scope-down statement, without additional aggregation. When you choose to just manage all requests that match a scope-down statement, the aggregation instance is singular for the rule.

You cannot nest a RateBasedStatement inside another statement, for example inside a NotStatement or OrStatement. You can define a RateBasedStatement inside a web ACL and inside a rule group.

For additional information about the options, see Rate limiting web requests using rate-based rules in the WAF Developer Guide.

If you only aggregate on the individual IP address or forwarded IP address, you can retrieve the list of IP addresses that WAF is currently rate limiting for a rule through the API call GetRateBasedStatementManagedKeys. This option is not available for other aggregation configurations.

WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the rate-based rule that gets its own tracking and management by WAF.

" } }, "RateBasedStatementAggregateKeyType": { "base": null, "refs": { - "RateBasedStatement$AggregateKeyType": "

Setting that indicates how to aggregate the request counts. The options are the following:

" + "RateBasedStatement$AggregateKeyType": "

Setting that indicates how to aggregate the request counts.

Web requests that are missing any of the components specified in the aggregation keys are omitted from the rate-based rule evaluation and handling.

" + } + }, + "RateBasedStatementCustomKey": { + "base": "

Specifies a single custom aggregate key for a rate-base rule.

Web requests that are missing any of the components specified in the aggregation keys are omitted from the rate-based rule evaluation and handling.

", + "refs": { + "RateBasedStatementCustomKeys$member": null + } + }, + "RateBasedStatementCustomKeys": { + "base": null, + "refs": { + "RateBasedStatement$CustomKeys": "

Specifies the aggregate keys to use in a rate-base rule.

" } }, "RateBasedStatementManagedKeysIPSet": { - "base": "

The set of IP addresses that are currently blocked for a RateBasedStatement.

", + "base": "

The set of IP addresses that are currently blocked for a RateBasedStatement. This is only available for rate-based rules that aggregate on just the IP address, with the AggregateKeyType set to IP or FORWARDED_IP.

A rate-based rule applies its rule action to requests from IP addresses that are in the rule's managed keys list and that match the rule's scope-down statement. When a rule has no scope-down statement, it applies the action to all requests from the IP addresses that are in the list. The rule applies its rule action to rate limit the matching requests. The action is usually Block but it can be any valid rule action except for Allow.

The maximum number of IP addresses that can be rate limited by a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, WAF limits those with the highest rates.

", "refs": { "GetRateBasedStatementManagedKeysResponse$ManagedKeysIPV4": "

The keys that are of Internet Protocol version 4 (IPv4).

", "GetRateBasedStatementManagedKeysResponse$ManagedKeysIPV6": "

The keys that are of Internet Protocol version 6 (IPv6).

" @@ -1663,7 +1685,55 @@ "RateLimit": { "base": null, "refs": { - "RateBasedStatement$Limit": "

The limit on requests per 5-minute period for a single originating IP address. If the statement includes a ScopeDownStatement, this limit is applied only to the requests that match the statement.

" + "RateBasedStatement$Limit": "

The limit on requests per 5-minute period for a single aggregation instance for the rate-based rule. If the rate-based statement includes a ScopeDownStatement, this limit is applied only to the requests that match the statement.

Examples:

" + } + }, + "RateLimitCookie": { + "base": "

Specifies a cookie as an aggregate key for a rate-based rule. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.

", + "refs": { + "RateBasedStatementCustomKey$Cookie": "

Use the value of a cookie in the request as an aggregate key. Each distinct value in the cookie contributes to the aggregation instance. If you use a single cookie as your custom key, then each value fully defines an aggregation instance.

" + } + }, + "RateLimitForwardedIP": { + "base": "

Specifies the first IP address in an HTTP header as an aggregate key for a rate-based rule. Each distinct forwarded IP address contributes to the aggregation instance.

This setting is used only in the RateBasedStatementCustomKey specification of a rate-based rule statement. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying FORWARDED_IP in your rate-based statement's AggregateKeyType.

This data type supports using the forwarded IP address in the web request aggregation for a rate-based rule, in RateBasedStatementCustomKey. The JSON specification for using the forwarded IP address doesn't explicitly use this data type.

JSON specification: \"ForwardedIP\": {}

When you use this specification, you must also configure the forwarded IP address in the rate-based statement's ForwardedIPConfig.

", + "refs": { + "RateBasedStatementCustomKey$ForwardedIP": "

Use the first IP address in an HTTP header as an aggregate key. Each distinct forwarded IP address contributes to the aggregation instance.

When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the forwarded IP address by specifying FORWARDED_IP in your rate-based statement's AggregateKeyType.

With this option, you must specify the header to use in the rate-based rule's ForwardedIPConfig property.

" + } + }, + "RateLimitHTTPMethod": { + "base": "

Specifies the request's HTTP method as an aggregate key for a rate-based rule. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.

JSON specification: \"RateLimitHTTPMethod\": {}

", + "refs": { + "RateBasedStatementCustomKey$HTTPMethod": "

Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.

" + } + }, + "RateLimitHeader": { + "base": "

Specifies a header as an aggregate key for a rate-based rule. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.

", + "refs": { + "RateBasedStatementCustomKey$Header": "

Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.

" + } + }, + "RateLimitIP": { + "base": "

Specifies the IP address in the web request as an aggregate key for a rate-based rule. Each distinct IP address contributes to the aggregation instance.

This setting is used only in the RateBasedStatementCustomKey specification of a rate-based rule statement. To use this in the custom key settings, you must specify at least one other key to use, along with the IP address. To aggregate on only the IP address, in your rate-based statement's AggregateKeyType, specify IP.

JSON specification: \"RateLimitIP\": {}

", + "refs": { + "RateBasedStatementCustomKey$IP": "

Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance.

When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying IP in your rate-based statement's AggregateKeyType.

" + } + }, + "RateLimitLabelNamespace": { + "base": "

Specifies a label namespace to use as an aggregate key for a rate-based rule. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance.

This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL.

For information about label namespaces and names, see Label syntax and naming requirements in the WAF Developer Guide.

", + "refs": { + "RateBasedStatementCustomKey$LabelNamespace": "

Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance.

This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL.

For information about label namespaces and names, see Label syntax and naming requirements in the WAF Developer Guide.

" + } + }, + "RateLimitQueryArgument": { + "base": "

Specifies a query argument in the request as an aggregate key for a rate-based rule. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.

", + "refs": { + "RateBasedStatementCustomKey$QueryArgument": "

Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.

" + } + }, + "RateLimitQueryString": { + "base": "

Specifies the request's query string as an aggregate key for a rate-based rule. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.

", + "refs": { + "RateBasedStatementCustomKey$QueryString": "

Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.

" } }, "RedactedFields": { @@ -2130,7 +2200,7 @@ "refs": { "ManagedRuleGroupStatement$ScopeDownStatement": "

An optional nested statement that narrows the scope of the web requests that are evaluated by the managed rule group. Requests are only evaluated by the rule group if they match the scope-down statement. You can use any nestable Statement in the scope-down statement, and you can nest statements at any level, the same as you can for a rule statement.

", "NotStatement$Statement": "

The statement to negate. You can use any statement that can be nested.

", - "RateBasedStatement$ScopeDownStatement": "

An optional nested statement that narrows the scope of the web requests that are evaluated by the rate-based statement. Requests are only tracked by the rate-based statement if they match the scope-down statement. You can use any nestable Statement in the scope-down statement, and you can nest statements at any level, the same as you can for a rule statement.

", + "RateBasedStatement$ScopeDownStatement": "

An optional nested statement that narrows the scope of the web requests that are evaluated and managed by the rate-based statement. When you use a scope-down statement, the rate-based rule only tracks and rate limits requests that match the scope-down statement. You can use any nestable Statement in the scope-down statement, and you can nest statements at any level, the same as you can for a rule statement.

", "Rule$Statement": "

The WAF processing statement for the rule, for example ByteMatchStatement or SizeConstraintStatement.

", "Statements$member": null } @@ -2224,7 +2294,7 @@ "TextTransformationPriority": { "base": null, "refs": { - "TextTransformation$Priority": "

Sets the relative processing order for multiple transformations that are defined for a rule statement. WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content. The priorities don't need to be consecutive, but they must all be different.

" + "TextTransformation$Priority": "

Sets the relative processing order for multiple transformations. WAF processes all transformations, from lowest priority to highest, before inspecting the transformed content. The priorities don't need to be consecutive, but they must all be different.

" } }, "TextTransformationType": { @@ -2236,12 +2306,16 @@ "TextTransformations": { "base": null, "refs": { - "ByteMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

", - "RegexMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

", - "RegexPatternSetReferenceStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

", - "SizeConstraintStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

", - "SqliMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

", - "XssMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. If you specify one or more transformations in a rule statement, WAF performs all transformations on the content of the request component identified by FieldToMatch, starting from the lowest priority setting, before inspecting the content for a match.

" + "ByteMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RateLimitCookie$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RateLimitHeader$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RateLimitQueryArgument$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RateLimitQueryString$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RegexMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "RegexPatternSetReferenceStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "SizeConstraintStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "SqliMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

", + "XssMatchStatement$TextTransformations": "

Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection. Text transformations are used in rule match statements, to transform the FieldToMatch request component before inspecting it, and they're used in rate-based rule statements, to transform request components before using them as custom aggregation keys. If you specify one or more transformations to apply, WAF performs all transformations on the specified content, starting from the lowest priority setting, and then uses the component contents.

" } }, "TimeWindow": { @@ -2522,6 +2596,11 @@ "refs": { } }, + "WAFUnsupportedAggregateKeyTypeException": { + "base": "

The rule that you've named doesn't aggregate solely on the IP address or solely on the forwarded IP address. This call is only available for rate-based rules with an AggregateKeyType setting of IP or FORWARDED_IP.

", + "refs": { + } + }, "WebACL": { "base": "

A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has an action defined (allow, block, or count) for requests that match the statement of the rule. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types Rule, RuleGroup, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.

", "refs": { diff --git a/models/endpoints/endpoints.json b/models/endpoints/endpoints.json index 59da1fba439..6b9002532d2 100644 --- a/models/endpoints/endpoints.json +++ b/models/endpoints/endpoints.json @@ -11777,11 +11777,47 @@ "ap-northeast-2" : { }, "ap-southeast-1" : { }, "ap-southeast-2" : { }, - "ca-central-1" : { }, + "ca-central-1" : { + "variants" : [ { + "hostname" : "profile-fips.ca-central-1.amazonaws.com", + "tags" : [ "fips" ] + } ] + }, "eu-central-1" : { }, "eu-west-2" : { }, - "us-east-1" : { }, - "us-west-2" : { } + "fips-ca-central-1" : { + "credentialScope" : { + "region" : "ca-central-1" + }, + "deprecated" : true, + "hostname" : "profile-fips.ca-central-1.amazonaws.com" + }, + "fips-us-east-1" : { + "credentialScope" : { + "region" : "us-east-1" + }, + "deprecated" : true, + "hostname" : "profile-fips.us-east-1.amazonaws.com" + }, + "fips-us-west-2" : { + "credentialScope" : { + "region" : "us-west-2" + }, + "deprecated" : true, + "hostname" : "profile-fips.us-west-2.amazonaws.com" + }, + "us-east-1" : { + "variants" : [ { + "hostname" : "profile-fips.us-east-1.amazonaws.com", + "tags" : [ "fips" ] + } ] + }, + "us-west-2" : { + "variants" : [ { + "hostname" : "profile-fips.us-west-2.amazonaws.com", + "tags" : [ "fips" ] + } ] + } } }, "projects.iot1click" : { @@ -23522,6 +23558,23 @@ "us-iso-west-1" : { } } }, + "rbin" : { + "endpoints" : { + "fips-us-iso-east-1" : { + "credentialScope" : { + "region" : "us-iso-east-1" + }, + "deprecated" : true, + "hostname" : "rbin-fips.us-iso-east-1.c2s.ic.gov" + }, + "us-iso-east-1" : { + "variants" : [ { + "hostname" : "rbin-fips.us-iso-east-1.c2s.ic.gov", + "tags" : [ "fips" ] + } ] + } + } + }, "rds" : { "endpoints" : { "us-iso-east-1" : { }, @@ -23981,6 +24034,23 @@ "us-isob-east-1" : { } } }, + "rbin" : { + "endpoints" : { + "fips-us-isob-east-1" : { + "credentialScope" : { + "region" : "us-isob-east-1" + }, + "deprecated" : true, + "hostname" : "rbin-fips.us-isob-east-1.sc2s.sgov.gov" + }, + "us-isob-east-1" : { + "variants" : [ { + "hostname" : "rbin-fips.us-isob-east-1.sc2s.sgov.gov", + "tags" : [ "fips" ] + } ] + } + } + }, "rds" : { "endpoints" : { "us-isob-east-1" : { } diff --git a/service/detective/api.go b/service/detective/api.go index 5f2bbbeb545..a16562bca18 100644 --- a/service/detective/api.go +++ b/service/detective/api.go @@ -5962,6 +5962,9 @@ const ( // DatasourcePackageEksAudit is a DatasourcePackage enum value DatasourcePackageEksAudit = "EKS_AUDIT" + + // DatasourcePackageAsffSecurityhubFinding is a DatasourcePackage enum value + DatasourcePackageAsffSecurityhubFinding = "ASFF_SECURITYHUB_FINDING" ) // DatasourcePackage_Values returns all elements of the DatasourcePackage enum @@ -5969,6 +5972,7 @@ func DatasourcePackage_Values() []string { return []string{ DatasourcePackageDetectiveCore, DatasourcePackageEksAudit, + DatasourcePackageAsffSecurityhubFinding, } } diff --git a/service/directconnect/api.go b/service/directconnect/api.go index 06ecbfbe9cc..c20adbce31e 100644 --- a/service/directconnect/api.go +++ b/service/directconnect/api.go @@ -12938,7 +12938,7 @@ type NewTransitVirtualInterfaceAllocation struct { CustomerAddress *string `locationName:"customerAddress" type:"string"` // The maximum transmission unit (MTU), in bytes. The supported values are 1500 - // and 9001. The default value is 1500. + // and 8500. The default value is 1500 Mtu *int64 `locationName:"mtu" type:"integer"` // The tags associated with the transitive virtual interface. @@ -14435,7 +14435,7 @@ type UpdateVirtualInterfaceAttributesOutput struct { Location *string `locationName:"location" type:"string"` // The maximum transmission unit (MTU), in bytes. The supported values are 1500 - // and 9001. The default value is 1500. + // and 8500. The default value is 1500 Mtu *int64 `locationName:"mtu" type:"integer"` // The ID of the Amazon Web Services account that owns the virtual interface. @@ -14780,7 +14780,7 @@ type VirtualInterface struct { Location *string `locationName:"location" type:"string"` // The maximum transmission unit (MTU), in bytes. The supported values are 1500 - // and 9001. The default value is 1500. + // and 8500. The default value is 1500 Mtu *int64 `locationName:"mtu" type:"integer"` // The ID of the Amazon Web Services account that owns the virtual interface. diff --git a/service/glue/api.go b/service/glue/api.go index 2a95c0e6cdd..a0deffb2410 100644 --- a/service/glue/api.go +++ b/service/glue/api.go @@ -29921,6 +29921,9 @@ type CreateCustomEntityTypeInput struct { // // RegexString is a required field RegexString *string `min:"1" type:"string" required:"true"` + + // A list of tags applied to the custom entity type. + Tags map[string]*string `type:"map"` } // String returns the string representation. @@ -29984,6 +29987,12 @@ func (s *CreateCustomEntityTypeInput) SetRegexString(v string) *CreateCustomEnti return s } +// SetTags sets the Tags field's value. +func (s *CreateCustomEntityTypeInput) SetTags(v map[string]*string) *CreateCustomEntityTypeInput { + s.Tags = v + return s +} + type CreateCustomEntityTypeOutput struct { _ struct{} `type:"structure"` @@ -52849,6 +52858,9 @@ type ListCustomEntityTypesInput struct { // A paginated token to offset the results. NextToken *string `type:"string"` + + // A list of key-value pair tags. + Tags map[string]*string `type:"map"` } // String returns the string representation. @@ -52894,6 +52906,12 @@ func (s *ListCustomEntityTypesInput) SetNextToken(v string) *ListCustomEntityTyp return s } +// SetTags sets the Tags field's value. +func (s *ListCustomEntityTypesInput) SetTags(v map[string]*string) *ListCustomEntityTypesInput { + s.Tags = v + return s +} + type ListCustomEntityTypesOutput struct { _ struct{} `type:"structure"` diff --git a/service/secretsmanager/api.go b/service/secretsmanager/api.go index 4380a5c3236..44b2f36afcd 100644 --- a/service/secretsmanager/api.go +++ b/service/secretsmanager/api.go @@ -3427,6 +3427,9 @@ type DeleteSecretInput struct { // deleted. If you delete a secret and then immediately create a secret with // the same name, use appropriate back off and retry logic. // + // If you forcibly delete an already deleted or nonexistent secret, the operation + // does not return ResourceNotFoundException. + // // Use this parameter with caution. This parameter causes the operation to skip // the normal recovery window before the permanent deletion that Secrets Manager // would normally impose with the RecoveryWindowInDays parameter. If you delete @@ -3647,9 +3650,8 @@ type DescribeSecretOutput struct { // The name of the secret. Name *string `min:"1" type:"string"` - // The next date and time that Secrets Manager will rotate the secret, rounded - // to the nearest hour. If the secret isn't configured for rotation, Secrets - // Manager returns null. + // The next rotation is scheduled to occur on or before this date. If the secret + // isn't configured for rotation, Secrets Manager returns null. NextRotationDate *time.Time `type:"timestamp"` // The ID of the service that created this secret. For more information, see @@ -6500,9 +6502,8 @@ type SecretListEntry struct { // in the folder prod. Name *string `min:"1" type:"string"` - // The next date and time that Secrets Manager will attempt to rotate the secret, - // rounded to the nearest hour. This value is null if the secret is not set - // up for rotation. + // The next rotation is scheduled to occur on or before this date. If the secret + // isn't configured for rotation, Secrets Manager returns null. NextRotationDate *time.Time `type:"timestamp"` // Returns the name of the service that created the secret. diff --git a/service/wafv2/api.go b/service/wafv2/api.go index 7c55ad895f3..f8f980dc312 100644 --- a/service/wafv2/api.go +++ b/service/wafv2/api.go @@ -2814,8 +2814,11 @@ func (c *WAFV2) GetRateBasedStatementManagedKeysRequest(input *GetRateBasedState // GetRateBasedStatementManagedKeys API operation for AWS WAFV2. // -// Retrieves the keys that are currently blocked by a rate-based rule instance. -// The maximum number of managed keys that can be blocked for a single rate-based +// Retrieves the IP addresses that are currently blocked by a rate-based rule +// instance. This is only available for rate-based rules that aggregate solely +// on the IP address or on the forwarded IP address. +// +// The maximum number of addresses that can be blocked for a single rate-based // rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, // those with the highest rates are blocked. // @@ -2868,6 +2871,11 @@ func (c *WAFV2) GetRateBasedStatementManagedKeysRequest(input *GetRateBasedState // - WAFInvalidOperationException // The operation isn't valid. // +// - WAFUnsupportedAggregateKeyTypeException +// The rule that you've named doesn't aggregate solely on the IP address or +// solely on the forwarded IP address. This call is only available for rate-based +// rules with an AggregateKeyType setting of IP or FORWARDED_IP. +// // See also, https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/GetRateBasedStatementManagedKeys func (c *WAFV2) GetRateBasedStatementManagedKeys(input *GetRateBasedStatementManagedKeysInput) (*GetRateBasedStatementManagedKeysOutput, error) { req, out := c.GetRateBasedStatementManagedKeysRequest(input) @@ -6910,10 +6918,13 @@ type ByteMatchStatement struct { SearchString []byte `type:"blob" required:"true"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -17314,60 +17325,121 @@ func (s QueryString) GoString() string { return s.String() } -// A rate-based rule tracks the rate of requests for each originating IP address, -// and triggers the rule action when the rate exceeds a limit that you specify -// on the number of requests in any 5-minute time span. You can use this to -// put a temporary block on requests from an IP address that is sending excessive -// requests. +// A rate-based rule counts incoming requests and rate limits requests when +// they are coming at too fast a rate. The rule categorizes requests according +// to your aggregation criteria, collects them into aggregation instances, and +// counts and rate limits the requests for each instance. // -// WAF tracks and manages web requests separately for each instance of a rate-based -// rule that you use. For example, if you provide the same rate-based rule settings -// in two web ACLs, each of the two rule statements represents a separate instance -// of the rate-based rule and gets its own tracking and management by WAF. If -// you define a rate-based rule inside a rule group, and then use that rule -// group in multiple places, each use creates a separate instance of the rate-based -// rule that gets its own tracking and management by WAF. +// You can specify individual aggregation keys, like IP address or HTTP method. +// You can also specify aggregation key combinations, like IP address and HTTP +// method, or HTTP method, query argument, and cookie. // -// When the rule action triggers, WAF blocks additional requests from the IP -// address until the request rate falls below the limit. +// Each unique set of values for the aggregation keys that you specify is a +// separate aggregation instance, with the value from each key contributing +// to the aggregation instance definition. // -// You can optionally nest another statement inside the rate-based statement, -// to narrow the scope of the rule so that it only counts requests that match -// the nested statement. For example, based on recent requests that you have -// seen from an attacker, you might create a rate-based rule with a nested AND -// rule statement that contains the following nested statements: +// For example, assume the rule evaluates web requests with the following IP +// address and HTTP method values: +// +// - IP address 10.1.1.1, HTTP method POST +// +// - IP address 10.1.1.1, HTTP method GET +// +// - IP address 127.0.0.0, HTTP method POST +// +// - IP address 10.1.1.1, HTTP method GET +// +// The rule would create different aggregation instances according to your aggregation +// criteria, for example: +// +// - If the aggregation criteria is just the IP address, then each individual +// address is an aggregation instance, and WAF counts requests separately +// for each. The aggregation instances and request counts for our example +// would be the following: IP address 10.1.1.1: count 3 IP address 127.0.0.0: +// count 1 // -// - An IP match statement with an IP set that specifies the address 192.0.2.44. +// - If the aggregation criteria is HTTP method, then each individual HTTP +// method is an aggregation instance. The aggregation instances and request +// counts for our example would be the following: HTTP method POST: count +// 2 HTTP method GET: count 2 // -// - A string match statement that searches in the User-Agent header for -// the string BadBot. +// - If the aggregation criteria is IP address and HTTP method, then each +// IP address and each HTTP method would contribute to the combined aggregation +// instance. The aggregation instances and request counts for our example +// would be the following: IP address 10.1.1.1, HTTP method POST: count 1 +// IP address 10.1.1.1, HTTP method GET: count 2 IP address 127.0.0.0, HTTP +// method POST: count 1 // -// In this rate-based rule, you also define a rate limit. For this example, -// the rate limit is 1,000. Requests that meet the criteria of both of the nested -// statements are counted. If the count exceeds 1,000 requests per five minutes, -// the rule action triggers. Requests that do not meet the criteria of both -// of the nested statements are not counted towards the rate limit and are not -// affected by this rule. +// For any n-tuple of aggregation keys, each unique combination of values for +// the keys defines a separate aggregation instance, which WAF counts and rate-limits +// individually. +// +// You can optionally nest another statement inside the rate-based statement, +// to narrow the scope of the rule so that it only counts and rate limits requests +// that match the nested statement. You can use this nested scope-down statement +// in conjunction with your aggregation key specifications or you can just count +// and rate limit all requests that match the scope-down statement, without +// additional aggregation. When you choose to just manage all requests that +// match a scope-down statement, the aggregation instance is singular for the +// rule. // // You cannot nest a RateBasedStatement inside another statement, for example // inside a NotStatement or OrStatement. You can define a RateBasedStatement // inside a web ACL and inside a rule group. +// +// For additional information about the options, see Rate limiting web requests +// using rate-based rules (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rate-based-rules.html) +// in the WAF Developer Guide. +// +// If you only aggregate on the individual IP address or forwarded IP address, +// you can retrieve the list of IP addresses that WAF is currently rate limiting +// for a rule through the API call GetRateBasedStatementManagedKeys. This option +// is not available for other aggregation configurations. +// +// WAF tracks and manages web requests separately for each instance of a rate-based +// rule that you use. For example, if you provide the same rate-based rule settings +// in two web ACLs, each of the two rule statements represents a separate instance +// of the rate-based rule and gets its own tracking and management by WAF. If +// you define a rate-based rule inside a rule group, and then use that rule +// group in multiple places, each use creates a separate instance of the rate-based +// rule that gets its own tracking and management by WAF. type RateBasedStatement struct { _ struct{} `type:"structure"` - // Setting that indicates how to aggregate the request counts. The options are - // the following: + // Setting that indicates how to aggregate the request counts. // - // * IP - Aggregate the request counts on the IP address from the web request - // origin. + // Web requests that are missing any of the components specified in the aggregation + // keys are omitted from the rate-based rule evaluation and handling. + // + // * CONSTANT - Count and limit the requests that match the rate-based rule's + // scope-down statement. With this option, the counted requests aren't further + // aggregated. The scope-down statement is the only specification used. When + // the count of all requests that satisfy the scope-down statement goes over + // the limit, WAF applies the rule action to all requests that satisfy the + // scope-down statement. With this option, you must configure the ScopeDownStatement + // property. + // + // * CUSTOM_KEYS - Aggregate the request counts using one or more web request + // components as the aggregate keys. With this option, you must specify the + // aggregate keys in the CustomKeys property. To aggregate on only the IP + // address or only the forwarded IP address, don't use custom keys. Instead, + // set the aggregate key type to IP or FORWARDED_IP. // // * FORWARDED_IP - Aggregate the request counts on the first IP address - // in an HTTP header. If you use this, configure the ForwardedIPConfig, to - // specify the header to use. + // in an HTTP header. With this option, you must specify the header to use + // in the ForwardedIPConfig property. To aggregate on a combination of the + // forwarded IP address with other aggregate keys, use CUSTOM_KEYS. + // + // * IP - Aggregate the request counts on the IP address from the web request + // origin. To aggregate on a combination of the IP address with other aggregate + // keys, use CUSTOM_KEYS. // // AggregateKeyType is a required field AggregateKeyType *string `type:"string" required:"true" enum:"RateBasedStatementAggregateKeyType"` + // Specifies the aggregate keys to use in a rate-base rule. + CustomKeys []*RateBasedStatementCustomKey `min:"1" type:"list"` + // The configuration for inspecting IP addresses in an HTTP header that you // specify, instead of using the IP address that's reported by the web request // origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify @@ -17376,21 +17448,31 @@ type RateBasedStatement struct { // If the specified header isn't present in the request, WAF doesn't apply the // rule to the web request at all. // - // This is required if AggregateKeyType is set to FORWARDED_IP. + // This is required if you specify a forwarded IP in the rule's aggregate key + // settings. ForwardedIPConfig *ForwardedIPConfig `type:"structure"` - // The limit on requests per 5-minute period for a single originating IP address. - // If the statement includes a ScopeDownStatement, this limit is applied only - // to the requests that match the statement. + // The limit on requests per 5-minute period for a single aggregation instance + // for the rate-based rule. If the rate-based statement includes a ScopeDownStatement, + // this limit is applied only to the requests that match the statement. + // + // Examples: + // + // * If you aggregate on just the IP address, this is the limit on requests + // from any single IP address. + // + // * If you aggregate on the HTTP method and the query argument name "city", + // then this is the limit on requests for any single method, city pair. // // Limit is a required field Limit *int64 `min:"100" type:"long" required:"true"` // An optional nested statement that narrows the scope of the web requests that - // are evaluated by the rate-based statement. Requests are only tracked by the - // rate-based statement if they match the scope-down statement. You can use - // any nestable Statement in the scope-down statement, and you can nest statements - // at any level, the same as you can for a rule statement. + // are evaluated and managed by the rate-based statement. When you use a scope-down + // statement, the rate-based rule only tracks and rate limits requests that + // match the scope-down statement. You can use any nestable Statement in the + // scope-down statement, and you can nest statements at any level, the same + // as you can for a rule statement. ScopeDownStatement *Statement `type:"structure"` } @@ -17418,12 +17500,25 @@ func (s *RateBasedStatement) Validate() error { if s.AggregateKeyType == nil { invalidParams.Add(request.NewErrParamRequired("AggregateKeyType")) } + if s.CustomKeys != nil && len(s.CustomKeys) < 1 { + invalidParams.Add(request.NewErrParamMinLen("CustomKeys", 1)) + } if s.Limit == nil { invalidParams.Add(request.NewErrParamRequired("Limit")) } if s.Limit != nil && *s.Limit < 100 { invalidParams.Add(request.NewErrParamMinValue("Limit", 100)) } + if s.CustomKeys != nil { + for i, v := range s.CustomKeys { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "CustomKeys", i), err.(request.ErrInvalidParams)) + } + } + } if s.ForwardedIPConfig != nil { if err := s.ForwardedIPConfig.Validate(); err != nil { invalidParams.AddNested("ForwardedIPConfig", err.(request.ErrInvalidParams)) @@ -17447,6 +17542,12 @@ func (s *RateBasedStatement) SetAggregateKeyType(v string) *RateBasedStatement { return s } +// SetCustomKeys sets the CustomKeys field's value. +func (s *RateBasedStatement) SetCustomKeys(v []*RateBasedStatementCustomKey) *RateBasedStatement { + s.CustomKeys = v + return s +} + // SetForwardedIPConfig sets the ForwardedIPConfig field's value. func (s *RateBasedStatement) SetForwardedIPConfig(v *ForwardedIPConfig) *RateBasedStatement { s.ForwardedIPConfig = v @@ -17465,15 +17566,73 @@ func (s *RateBasedStatement) SetScopeDownStatement(v *Statement) *RateBasedState return s } -// The set of IP addresses that are currently blocked for a RateBasedStatement. -type RateBasedStatementManagedKeysIPSet struct { +// Specifies a single custom aggregate key for a rate-base rule. +// +// Web requests that are missing any of the components specified in the aggregation +// keys are omitted from the rate-based rule evaluation and handling. +type RateBasedStatementCustomKey struct { _ struct{} `type:"structure"` - // The IP addresses that are currently blocked. - Addresses []*string `type:"list"` + // Use the value of a cookie in the request as an aggregate key. Each distinct + // value in the cookie contributes to the aggregation instance. If you use a + // single cookie as your custom key, then each value fully defines an aggregation + // instance. + Cookie *RateLimitCookie `type:"structure"` + + // Use the first IP address in an HTTP header as an aggregate key. Each distinct + // forwarded IP address contributes to the aggregation instance. + // + // When you specify an IP or forwarded IP in the custom key settings, you must + // also specify at least one other key to use. You can aggregate on only the + // forwarded IP address by specifying FORWARDED_IP in your rate-based statement's + // AggregateKeyType. + // + // With this option, you must specify the header to use in the rate-based rule's + // ForwardedIPConfig property. + ForwardedIP *RateLimitForwardedIP `type:"structure"` + + // Use the request's HTTP method as an aggregate key. Each distinct HTTP method + // contributes to the aggregation instance. If you use just the HTTP method + // as your custom key, then each method fully defines an aggregation instance. + HTTPMethod *RateLimitHTTPMethod `type:"structure"` + + // Use the value of a header in the request as an aggregate key. Each distinct + // value in the header contributes to the aggregation instance. If you use a + // single header as your custom key, then each value fully defines an aggregation + // instance. + Header *RateLimitHeader `type:"structure"` + + // Use the request's originating IP address as an aggregate key. Each distinct + // IP address contributes to the aggregation instance. + // + // When you specify an IP or forwarded IP in the custom key settings, you must + // also specify at least one other key to use. You can aggregate on only the + // IP address by specifying IP in your rate-based statement's AggregateKeyType. + IP *RateLimitIP `type:"structure"` + + // Use the specified label namespace as an aggregate key. Each distinct fully + // qualified label name that has the specified label namespace contributes to + // the aggregation instance. If you use just one label namespace as your custom + // key, then each label name fully defines an aggregation instance. + // + // This uses only labels that have been added to the request by rules that are + // evaluated before this rate-based rule in the web ACL. + // + // For information about label namespaces and names, see Label syntax and naming + // requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) + // in the WAF Developer Guide. + LabelNamespace *RateLimitLabelNamespace `type:"structure"` - // The version of the IP addresses, either IPV4 or IPV6. - IPAddressVersion *string `type:"string" enum:"IPAddressVersion"` + // Use the specified query argument as an aggregate key. Each distinct value + // for the named query argument contributes to the aggregation instance. If + // you use a single query argument as your custom key, then each value fully + // defines an aggregation instance. + QueryArgument *RateLimitQueryArgument `type:"structure"` + + // Use the request's query string as an aggregate key. Each distinct string + // contributes to the aggregation instance. If you use just the query string + // as your custom key, then each string fully defines an aggregation instance. + QueryString *RateLimitQueryString `type:"structure"` } // String returns the string representation. @@ -17481,7 +17640,7 @@ type RateBasedStatementManagedKeysIPSet struct { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RateBasedStatementManagedKeysIPSet) String() string { +func (s RateBasedStatementCustomKey) String() string { return awsutil.Prettify(s) } @@ -17490,28 +17649,115 @@ func (s RateBasedStatementManagedKeysIPSet) String() string { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RateBasedStatementManagedKeysIPSet) GoString() string { +func (s RateBasedStatementCustomKey) GoString() string { return s.String() } -// SetAddresses sets the Addresses field's value. -func (s *RateBasedStatementManagedKeysIPSet) SetAddresses(v []*string) *RateBasedStatementManagedKeysIPSet { - s.Addresses = v +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateBasedStatementCustomKey) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateBasedStatementCustomKey"} + if s.Cookie != nil { + if err := s.Cookie.Validate(); err != nil { + invalidParams.AddNested("Cookie", err.(request.ErrInvalidParams)) + } + } + if s.Header != nil { + if err := s.Header.Validate(); err != nil { + invalidParams.AddNested("Header", err.(request.ErrInvalidParams)) + } + } + if s.LabelNamespace != nil { + if err := s.LabelNamespace.Validate(); err != nil { + invalidParams.AddNested("LabelNamespace", err.(request.ErrInvalidParams)) + } + } + if s.QueryArgument != nil { + if err := s.QueryArgument.Validate(); err != nil { + invalidParams.AddNested("QueryArgument", err.(request.ErrInvalidParams)) + } + } + if s.QueryString != nil { + if err := s.QueryString.Validate(); err != nil { + invalidParams.AddNested("QueryString", err.(request.ErrInvalidParams)) + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetCookie sets the Cookie field's value. +func (s *RateBasedStatementCustomKey) SetCookie(v *RateLimitCookie) *RateBasedStatementCustomKey { + s.Cookie = v return s } -// SetIPAddressVersion sets the IPAddressVersion field's value. -func (s *RateBasedStatementManagedKeysIPSet) SetIPAddressVersion(v string) *RateBasedStatementManagedKeysIPSet { - s.IPAddressVersion = &v +// SetForwardedIP sets the ForwardedIP field's value. +func (s *RateBasedStatementCustomKey) SetForwardedIP(v *RateLimitForwardedIP) *RateBasedStatementCustomKey { + s.ForwardedIP = v return s } -// A single regular expression. This is used in a RegexPatternSet. -type Regex struct { +// SetHTTPMethod sets the HTTPMethod field's value. +func (s *RateBasedStatementCustomKey) SetHTTPMethod(v *RateLimitHTTPMethod) *RateBasedStatementCustomKey { + s.HTTPMethod = v + return s +} + +// SetHeader sets the Header field's value. +func (s *RateBasedStatementCustomKey) SetHeader(v *RateLimitHeader) *RateBasedStatementCustomKey { + s.Header = v + return s +} + +// SetIP sets the IP field's value. +func (s *RateBasedStatementCustomKey) SetIP(v *RateLimitIP) *RateBasedStatementCustomKey { + s.IP = v + return s +} + +// SetLabelNamespace sets the LabelNamespace field's value. +func (s *RateBasedStatementCustomKey) SetLabelNamespace(v *RateLimitLabelNamespace) *RateBasedStatementCustomKey { + s.LabelNamespace = v + return s +} + +// SetQueryArgument sets the QueryArgument field's value. +func (s *RateBasedStatementCustomKey) SetQueryArgument(v *RateLimitQueryArgument) *RateBasedStatementCustomKey { + s.QueryArgument = v + return s +} + +// SetQueryString sets the QueryString field's value. +func (s *RateBasedStatementCustomKey) SetQueryString(v *RateLimitQueryString) *RateBasedStatementCustomKey { + s.QueryString = v + return s +} + +// The set of IP addresses that are currently blocked for a RateBasedStatement. +// This is only available for rate-based rules that aggregate on just the IP +// address, with the AggregateKeyType set to IP or FORWARDED_IP. +// +// A rate-based rule applies its rule action to requests from IP addresses that +// are in the rule's managed keys list and that match the rule's scope-down +// statement. When a rule has no scope-down statement, it applies the action +// to all requests from the IP addresses that are in the list. The rule applies +// its rule action to rate limit the matching requests. The action is usually +// Block but it can be any valid rule action except for Allow. +// +// The maximum number of IP addresses that can be rate limited by a single rate-based +// rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, +// WAF limits those with the highest rates. +type RateBasedStatementManagedKeysIPSet struct { _ struct{} `type:"structure"` - // The string representing the regular expression. - RegexString *string `min:"1" type:"string"` + // The IP addresses that are currently blocked. + Addresses []*string `type:"list"` + + // The version of the IP addresses, either IPV4 or IPV6. + IPAddressVersion *string `type:"string" enum:"IPAddressVersion"` } // String returns the string representation. @@ -17519,7 +17765,7 @@ type Regex struct { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s Regex) String() string { +func (s RateBasedStatementManagedKeysIPSet) String() string { return awsutil.Prettify(s) } @@ -17528,49 +17774,42 @@ func (s Regex) String() string { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s Regex) GoString() string { +func (s RateBasedStatementManagedKeysIPSet) GoString() string { return s.String() } -// Validate inspects the fields of the type to determine if they are valid. -func (s *Regex) Validate() error { - invalidParams := request.ErrInvalidParams{Context: "Regex"} - if s.RegexString != nil && len(*s.RegexString) < 1 { - invalidParams.Add(request.NewErrParamMinLen("RegexString", 1)) - } - - if invalidParams.Len() > 0 { - return invalidParams - } - return nil +// SetAddresses sets the Addresses field's value. +func (s *RateBasedStatementManagedKeysIPSet) SetAddresses(v []*string) *RateBasedStatementManagedKeysIPSet { + s.Addresses = v + return s } -// SetRegexString sets the RegexString field's value. -func (s *Regex) SetRegexString(v string) *Regex { - s.RegexString = &v +// SetIPAddressVersion sets the IPAddressVersion field's value. +func (s *RateBasedStatementManagedKeysIPSet) SetIPAddressVersion(v string) *RateBasedStatementManagedKeysIPSet { + s.IPAddressVersion = &v return s } -// A rule statement used to search web request components for a match against -// a single regular expression. -type RegexMatchStatement struct { +// Specifies a cookie as an aggregate key for a rate-based rule. Each distinct +// value in the cookie contributes to the aggregation instance. If you use a +// single cookie as your custom key, then each value fully defines an aggregation +// instance. +type RateLimitCookie struct { _ struct{} `type:"structure"` - // The part of the web request that you want WAF to inspect. - // - // FieldToMatch is a required field - FieldToMatch *FieldToMatch `type:"structure" required:"true"` - - // The string representing the regular expression. + // The name of the cookie to use. // - // RegexString is a required field - RegexString *string `min:"1" type:"string" required:"true"` + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -17581,7 +17820,7 @@ type RegexMatchStatement struct { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RegexMatchStatement) String() string { +func (s RateLimitCookie) String() string { return awsutil.Prettify(s) } @@ -17590,21 +17829,18 @@ func (s RegexMatchStatement) String() string { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RegexMatchStatement) GoString() string { +func (s RateLimitCookie) GoString() string { return s.String() } // Validate inspects the fields of the type to determine if they are valid. -func (s *RegexMatchStatement) Validate() error { - invalidParams := request.ErrInvalidParams{Context: "RegexMatchStatement"} - if s.FieldToMatch == nil { - invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) - } - if s.RegexString == nil { - invalidParams.Add(request.NewErrParamRequired("RegexString")) +func (s *RateLimitCookie) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateLimitCookie"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) } - if s.RegexString != nil && len(*s.RegexString) < 1 { - invalidParams.Add(request.NewErrParamMinLen("RegexString", 1)) + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) } if s.TextTransformations == nil { invalidParams.Add(request.NewErrParamRequired("TextTransformations")) @@ -17612,11 +17848,6 @@ func (s *RegexMatchStatement) Validate() error { if s.TextTransformations != nil && len(s.TextTransformations) < 1 { invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) } - if s.FieldToMatch != nil { - if err := s.FieldToMatch.Validate(); err != nil { - invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) - } - } if s.TextTransformations != nil { for i, v := range s.TextTransformations { if v == nil { @@ -17634,46 +17865,39 @@ func (s *RegexMatchStatement) Validate() error { return nil } -// SetFieldToMatch sets the FieldToMatch field's value. -func (s *RegexMatchStatement) SetFieldToMatch(v *FieldToMatch) *RegexMatchStatement { - s.FieldToMatch = v - return s -} - -// SetRegexString sets the RegexString field's value. -func (s *RegexMatchStatement) SetRegexString(v string) *RegexMatchStatement { - s.RegexString = &v +// SetName sets the Name field's value. +func (s *RateLimitCookie) SetName(v string) *RateLimitCookie { + s.Name = &v return s } // SetTextTransformations sets the TextTransformations field's value. -func (s *RegexMatchStatement) SetTextTransformations(v []*TextTransformation) *RegexMatchStatement { +func (s *RateLimitCookie) SetTextTransformations(v []*TextTransformation) *RateLimitCookie { s.TextTransformations = v return s } -// Contains one or more regular expressions. +// Specifies the first IP address in an HTTP header as an aggregate key for +// a rate-based rule. Each distinct forwarded IP address contributes to the +// aggregation instance. // -// WAF assigns an ARN to each RegexPatternSet that you create. To use a set -// in a rule, you provide the ARN to the Rule statement RegexPatternSetReferenceStatement. -type RegexPatternSet struct { +// This setting is used only in the RateBasedStatementCustomKey specification +// of a rate-based rule statement. When you specify an IP or forwarded IP in +// the custom key settings, you must also specify at least one other key to +// use. You can aggregate on only the forwarded IP address by specifying FORWARDED_IP +// in your rate-based statement's AggregateKeyType. +// +// This data type supports using the forwarded IP address in the web request +// aggregation for a rate-based rule, in RateBasedStatementCustomKey. The JSON +// specification for using the forwarded IP address doesn't explicitly use this +// data type. +// +// JSON specification: "ForwardedIP": {} +// +// When you use this specification, you must also configure the forwarded IP +// address in the rate-based statement's ForwardedIPConfig. +type RateLimitForwardedIP struct { _ struct{} `type:"structure"` - - // The Amazon Resource Name (ARN) of the entity. - ARN *string `min:"20" type:"string"` - - // A description of the set that helps with identification. - Description *string `min:"1" type:"string"` - - // A unique identifier for the set. This ID is returned in the responses to - // create and list commands. You provide it to operations like update and delete. - Id *string `min:"1" type:"string"` - - // The name of the set. You cannot change the name after you create the set. - Name *string `min:"1" type:"string"` - - // The regular expression patterns in the set. - RegularExpressionList []*Regex `type:"list"` } // String returns the string representation. @@ -17681,7 +17905,7 @@ type RegexPatternSet struct { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RegexPatternSet) String() string { +func (s RateLimitForwardedIP) String() string { return awsutil.Prettify(s) } @@ -17690,37 +17914,592 @@ func (s RegexPatternSet) String() string { // API parameter values that are decorated as "sensitive" in the API will not // be included in the string output. The member name will be present, but the // value will be replaced with "sensitive". -func (s RegexPatternSet) GoString() string { +func (s RateLimitForwardedIP) GoString() string { return s.String() } -// SetARN sets the ARN field's value. -func (s *RegexPatternSet) SetARN(v string) *RegexPatternSet { - s.ARN = &v - return s +// Specifies the request's HTTP method as an aggregate key for a rate-based +// rule. Each distinct HTTP method contributes to the aggregation instance. +// If you use just the HTTP method as your custom key, then each method fully +// defines an aggregation instance. +// +// JSON specification: "RateLimitHTTPMethod": {} +type RateLimitHTTPMethod struct { + _ struct{} `type:"structure"` } -// SetDescription sets the Description field's value. -func (s *RegexPatternSet) SetDescription(v string) *RegexPatternSet { - s.Description = &v - return s +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitHTTPMethod) String() string { + return awsutil.Prettify(s) } -// SetId sets the Id field's value. -func (s *RegexPatternSet) SetId(v string) *RegexPatternSet { - s.Id = &v - return s +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitHTTPMethod) GoString() string { + return s.String() } -// SetName sets the Name field's value. -func (s *RegexPatternSet) SetName(v string) *RegexPatternSet { - s.Name = &v - return s -} +// Specifies a header as an aggregate key for a rate-based rule. Each distinct +// value in the header contributes to the aggregation instance. If you use a +// single header as your custom key, then each value fully defines an aggregation +// instance. +type RateLimitHeader struct { + _ struct{} `type:"structure"` -// SetRegularExpressionList sets the RegularExpressionList field's value. -func (s *RegexPatternSet) SetRegularExpressionList(v []*Regex) *RegexPatternSet { - s.RegularExpressionList = v + // The name of the header to use. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitHeader) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitHeader) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateLimitHeader) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateLimitHeader"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *RateLimitHeader) SetName(v string) *RateLimitHeader { + s.Name = &v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *RateLimitHeader) SetTextTransformations(v []*TextTransformation) *RateLimitHeader { + s.TextTransformations = v + return s +} + +// Specifies the IP address in the web request as an aggregate key for a rate-based +// rule. Each distinct IP address contributes to the aggregation instance. +// +// This setting is used only in the RateBasedStatementCustomKey specification +// of a rate-based rule statement. To use this in the custom key settings, you +// must specify at least one other key to use, along with the IP address. To +// aggregate on only the IP address, in your rate-based statement's AggregateKeyType, +// specify IP. +// +// JSON specification: "RateLimitIP": {} +type RateLimitIP struct { + _ struct{} `type:"structure"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitIP) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitIP) GoString() string { + return s.String() +} + +// Specifies a label namespace to use as an aggregate key for a rate-based rule. +// Each distinct fully qualified label name that has the specified label namespace +// contributes to the aggregation instance. If you use just one label namespace +// as your custom key, then each label name fully defines an aggregation instance. +// +// This uses only labels that have been added to the request by rules that are +// evaluated before this rate-based rule in the web ACL. +// +// For information about label namespaces and names, see Label syntax and naming +// requirements (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html) +// in the WAF Developer Guide. +type RateLimitLabelNamespace struct { + _ struct{} `type:"structure"` + + // The namespace to use for aggregation. + // + // Namespace is a required field + Namespace *string `min:"1" type:"string" required:"true"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitLabelNamespace) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitLabelNamespace) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateLimitLabelNamespace) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateLimitLabelNamespace"} + if s.Namespace == nil { + invalidParams.Add(request.NewErrParamRequired("Namespace")) + } + if s.Namespace != nil && len(*s.Namespace) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Namespace", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetNamespace sets the Namespace field's value. +func (s *RateLimitLabelNamespace) SetNamespace(v string) *RateLimitLabelNamespace { + s.Namespace = &v + return s +} + +// Specifies a query argument in the request as an aggregate key for a rate-based +// rule. Each distinct value for the named query argument contributes to the +// aggregation instance. If you use a single query argument as your custom key, +// then each value fully defines an aggregation instance. +type RateLimitQueryArgument struct { + _ struct{} `type:"structure"` + + // The name of the query argument to use. + // + // Name is a required field + Name *string `min:"1" type:"string" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitQueryArgument) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitQueryArgument) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateLimitQueryArgument) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateLimitQueryArgument"} + if s.Name == nil { + invalidParams.Add(request.NewErrParamRequired("Name")) + } + if s.Name != nil && len(*s.Name) < 1 { + invalidParams.Add(request.NewErrParamMinLen("Name", 1)) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetName sets the Name field's value. +func (s *RateLimitQueryArgument) SetName(v string) *RateLimitQueryArgument { + s.Name = &v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *RateLimitQueryArgument) SetTextTransformations(v []*TextTransformation) *RateLimitQueryArgument { + s.TextTransformations = v + return s +} + +// Specifies the request's query string as an aggregate key for a rate-based +// rule. Each distinct string contributes to the aggregation instance. If you +// use just the query string as your custom key, then each string fully defines +// an aggregation instance. +type RateLimitQueryString struct { + _ struct{} `type:"structure"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitQueryString) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RateLimitQueryString) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RateLimitQueryString) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RateLimitQueryString"} + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *RateLimitQueryString) SetTextTransformations(v []*TextTransformation) *RateLimitQueryString { + s.TextTransformations = v + return s +} + +// A single regular expression. This is used in a RegexPatternSet. +type Regex struct { + _ struct{} `type:"structure"` + + // The string representing the regular expression. + RegexString *string `min:"1" type:"string"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s Regex) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s Regex) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *Regex) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "Regex"} + if s.RegexString != nil && len(*s.RegexString) < 1 { + invalidParams.Add(request.NewErrParamMinLen("RegexString", 1)) + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetRegexString sets the RegexString field's value. +func (s *Regex) SetRegexString(v string) *Regex { + s.RegexString = &v + return s +} + +// A rule statement used to search web request components for a match against +// a single regular expression. +type RegexMatchStatement struct { + _ struct{} `type:"structure"` + + // The part of the web request that you want WAF to inspect. + // + // FieldToMatch is a required field + FieldToMatch *FieldToMatch `type:"structure" required:"true"` + + // The string representing the regular expression. + // + // RegexString is a required field + RegexString *string `min:"1" type:"string" required:"true"` + + // Text transformations eliminate some of the unusual formatting that attackers + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. + // + // TextTransformations is a required field + TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RegexMatchStatement) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RegexMatchStatement) GoString() string { + return s.String() +} + +// Validate inspects the fields of the type to determine if they are valid. +func (s *RegexMatchStatement) Validate() error { + invalidParams := request.ErrInvalidParams{Context: "RegexMatchStatement"} + if s.FieldToMatch == nil { + invalidParams.Add(request.NewErrParamRequired("FieldToMatch")) + } + if s.RegexString == nil { + invalidParams.Add(request.NewErrParamRequired("RegexString")) + } + if s.RegexString != nil && len(*s.RegexString) < 1 { + invalidParams.Add(request.NewErrParamMinLen("RegexString", 1)) + } + if s.TextTransformations == nil { + invalidParams.Add(request.NewErrParamRequired("TextTransformations")) + } + if s.TextTransformations != nil && len(s.TextTransformations) < 1 { + invalidParams.Add(request.NewErrParamMinLen("TextTransformations", 1)) + } + if s.FieldToMatch != nil { + if err := s.FieldToMatch.Validate(); err != nil { + invalidParams.AddNested("FieldToMatch", err.(request.ErrInvalidParams)) + } + } + if s.TextTransformations != nil { + for i, v := range s.TextTransformations { + if v == nil { + continue + } + if err := v.Validate(); err != nil { + invalidParams.AddNested(fmt.Sprintf("%s[%v]", "TextTransformations", i), err.(request.ErrInvalidParams)) + } + } + } + + if invalidParams.Len() > 0 { + return invalidParams + } + return nil +} + +// SetFieldToMatch sets the FieldToMatch field's value. +func (s *RegexMatchStatement) SetFieldToMatch(v *FieldToMatch) *RegexMatchStatement { + s.FieldToMatch = v + return s +} + +// SetRegexString sets the RegexString field's value. +func (s *RegexMatchStatement) SetRegexString(v string) *RegexMatchStatement { + s.RegexString = &v + return s +} + +// SetTextTransformations sets the TextTransformations field's value. +func (s *RegexMatchStatement) SetTextTransformations(v []*TextTransformation) *RegexMatchStatement { + s.TextTransformations = v + return s +} + +// Contains one or more regular expressions. +// +// WAF assigns an ARN to each RegexPatternSet that you create. To use a set +// in a rule, you provide the ARN to the Rule statement RegexPatternSetReferenceStatement. +type RegexPatternSet struct { + _ struct{} `type:"structure"` + + // The Amazon Resource Name (ARN) of the entity. + ARN *string `min:"20" type:"string"` + + // A description of the set that helps with identification. + Description *string `min:"1" type:"string"` + + // A unique identifier for the set. This ID is returned in the responses to + // create and list commands. You provide it to operations like update and delete. + Id *string `min:"1" type:"string"` + + // The name of the set. You cannot change the name after you create the set. + Name *string `min:"1" type:"string"` + + // The regular expression patterns in the set. + RegularExpressionList []*Regex `type:"list"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RegexPatternSet) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s RegexPatternSet) GoString() string { + return s.String() +} + +// SetARN sets the ARN field's value. +func (s *RegexPatternSet) SetARN(v string) *RegexPatternSet { + s.ARN = &v + return s +} + +// SetDescription sets the Description field's value. +func (s *RegexPatternSet) SetDescription(v string) *RegexPatternSet { + s.Description = &v + return s +} + +// SetId sets the Id field's value. +func (s *RegexPatternSet) SetId(v string) *RegexPatternSet { + s.Id = &v + return s +} + +// SetName sets the Name field's value. +func (s *RegexPatternSet) SetName(v string) *RegexPatternSet { + s.Name = &v + return s +} + +// SetRegularExpressionList sets the RegularExpressionList field's value. +func (s *RegexPatternSet) SetRegularExpressionList(v []*Regex) *RegexPatternSet { + s.RegularExpressionList = v return s } @@ -17750,10 +18529,13 @@ type RegexPatternSetReferenceStatement struct { FieldToMatch *FieldToMatch `type:"structure" required:"true"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -19735,10 +20517,13 @@ type SizeConstraintStatement struct { Size *int64 `type:"long" required:"true"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -19852,10 +20637,13 @@ type SqliMatchStatement struct { SensitivityLevel *string `type:"string" enum:"SensitivityLevel"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -20026,44 +20814,84 @@ type Statement struct { // You provide more than one Statement within the OrStatement. OrStatement *OrStatement `type:"structure"` - // A rate-based rule tracks the rate of requests for each originating IP address, - // and triggers the rule action when the rate exceeds a limit that you specify - // on the number of requests in any 5-minute time span. You can use this to - // put a temporary block on requests from an IP address that is sending excessive - // requests. + // A rate-based rule counts incoming requests and rate limits requests when + // they are coming at too fast a rate. The rule categorizes requests according + // to your aggregation criteria, collects them into aggregation instances, and + // counts and rate limits the requests for each instance. // - // WAF tracks and manages web requests separately for each instance of a rate-based - // rule that you use. For example, if you provide the same rate-based rule settings - // in two web ACLs, each of the two rule statements represents a separate instance - // of the rate-based rule and gets its own tracking and management by WAF. If - // you define a rate-based rule inside a rule group, and then use that rule - // group in multiple places, each use creates a separate instance of the rate-based - // rule that gets its own tracking and management by WAF. + // You can specify individual aggregation keys, like IP address or HTTP method. + // You can also specify aggregation key combinations, like IP address and HTTP + // method, or HTTP method, query argument, and cookie. // - // When the rule action triggers, WAF blocks additional requests from the IP - // address until the request rate falls below the limit. + // Each unique set of values for the aggregation keys that you specify is a + // separate aggregation instance, with the value from each key contributing + // to the aggregation instance definition. // - // You can optionally nest another statement inside the rate-based statement, - // to narrow the scope of the rule so that it only counts requests that match - // the nested statement. For example, based on recent requests that you have - // seen from an attacker, you might create a rate-based rule with a nested AND - // rule statement that contains the following nested statements: + // For example, assume the rule evaluates web requests with the following IP + // address and HTTP method values: + // + // * IP address 10.1.1.1, HTTP method POST + // + // * IP address 10.1.1.1, HTTP method GET // - // * An IP match statement with an IP set that specifies the address 192.0.2.44. + // * IP address 127.0.0.0, HTTP method POST // - // * A string match statement that searches in the User-Agent header for - // the string BadBot. + // * IP address 10.1.1.1, HTTP method GET // - // In this rate-based rule, you also define a rate limit. For this example, - // the rate limit is 1,000. Requests that meet the criteria of both of the nested - // statements are counted. If the count exceeds 1,000 requests per five minutes, - // the rule action triggers. Requests that do not meet the criteria of both - // of the nested statements are not counted towards the rate limit and are not - // affected by this rule. + // The rule would create different aggregation instances according to your aggregation + // criteria, for example: + // + // * If the aggregation criteria is just the IP address, then each individual + // address is an aggregation instance, and WAF counts requests separately + // for each. The aggregation instances and request counts for our example + // would be the following: IP address 10.1.1.1: count 3 IP address 127.0.0.0: + // count 1 + // + // * If the aggregation criteria is HTTP method, then each individual HTTP + // method is an aggregation instance. The aggregation instances and request + // counts for our example would be the following: HTTP method POST: count + // 2 HTTP method GET: count 2 + // + // * If the aggregation criteria is IP address and HTTP method, then each + // IP address and each HTTP method would contribute to the combined aggregation + // instance. The aggregation instances and request counts for our example + // would be the following: IP address 10.1.1.1, HTTP method POST: count 1 + // IP address 10.1.1.1, HTTP method GET: count 2 IP address 127.0.0.0, HTTP + // method POST: count 1 + // + // For any n-tuple of aggregation keys, each unique combination of values for + // the keys defines a separate aggregation instance, which WAF counts and rate-limits + // individually. + // + // You can optionally nest another statement inside the rate-based statement, + // to narrow the scope of the rule so that it only counts and rate limits requests + // that match the nested statement. You can use this nested scope-down statement + // in conjunction with your aggregation key specifications or you can just count + // and rate limit all requests that match the scope-down statement, without + // additional aggregation. When you choose to just manage all requests that + // match a scope-down statement, the aggregation instance is singular for the + // rule. // // You cannot nest a RateBasedStatement inside another statement, for example // inside a NotStatement or OrStatement. You can define a RateBasedStatement // inside a web ACL and inside a rule group. + // + // For additional information about the options, see Rate limiting web requests + // using rate-based rules (https://docs.aws.amazon.com/waf/latest/developerguide/waf-rate-based-rules.html) + // in the WAF Developer Guide. + // + // If you only aggregate on the individual IP address or forwarded IP address, + // you can retrieve the list of IP addresses that WAF is currently rate limiting + // for a rule through the API call GetRateBasedStatementManagedKeys. This option + // is not available for other aggregation configurations. + // + // WAF tracks and manages web requests separately for each instance of a rate-based + // rule that you use. For example, if you provide the same rate-based rule settings + // in two web ACLs, each of the two rule statements represents a separate instance + // of the rate-based rule and gets its own tracking and management by WAF. If + // you define a rate-based rule inside a rule group, and then use that rule + // group in multiple places, each use creates a separate instance of the rate-based + // rule that gets its own tracking and management by WAF. RateBasedStatement *RateBasedStatement `type:"structure"` // A rule statement used to search web request components for a match against @@ -20548,10 +21376,10 @@ func (s TagResourceOutput) GoString() string { type TextTransformation struct { _ struct{} `type:"structure"` - // Sets the relative processing order for multiple transformations that are - // defined for a rule statement. WAF processes all transformations, from lowest - // priority to highest, before inspecting the transformed content. The priorities - // don't need to be consecutive, but they must all be different. + // Sets the relative processing order for multiple transformations. WAF processes + // all transformations, from lowest priority to highest, before inspecting the + // transformed content. The priorities don't need to be consecutive, but they + // must all be different. // // Priority is a required field Priority *int64 `type:"integer" required:"true"` @@ -23523,6 +24351,72 @@ func (s *WAFUnavailableEntityException) RequestID() string { return s.RespMetadata.RequestID } +// The rule that you've named doesn't aggregate solely on the IP address or +// solely on the forwarded IP address. This call is only available for rate-based +// rules with an AggregateKeyType setting of IP or FORWARDED_IP. +type WAFUnsupportedAggregateKeyTypeException struct { + _ struct{} `type:"structure"` + RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"` + + Message_ *string `locationName:"Message" type:"string"` +} + +// String returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s WAFUnsupportedAggregateKeyTypeException) String() string { + return awsutil.Prettify(s) +} + +// GoString returns the string representation. +// +// API parameter values that are decorated as "sensitive" in the API will not +// be included in the string output. The member name will be present, but the +// value will be replaced with "sensitive". +func (s WAFUnsupportedAggregateKeyTypeException) GoString() string { + return s.String() +} + +func newErrorWAFUnsupportedAggregateKeyTypeException(v protocol.ResponseMetadata) error { + return &WAFUnsupportedAggregateKeyTypeException{ + RespMetadata: v, + } +} + +// Code returns the exception type name. +func (s *WAFUnsupportedAggregateKeyTypeException) Code() string { + return "WAFUnsupportedAggregateKeyTypeException" +} + +// Message returns the exception's message. +func (s *WAFUnsupportedAggregateKeyTypeException) Message() string { + if s.Message_ != nil { + return *s.Message_ + } + return "" +} + +// OrigErr always returns nil, satisfies awserr.Error interface. +func (s *WAFUnsupportedAggregateKeyTypeException) OrigErr() error { + return nil +} + +func (s *WAFUnsupportedAggregateKeyTypeException) Error() string { + return fmt.Sprintf("%s: %s", s.Code(), s.Message()) +} + +// Status code returns the HTTP status code for the request's response error. +func (s *WAFUnsupportedAggregateKeyTypeException) StatusCode() int { + return s.RespMetadata.StatusCode +} + +// RequestID returns the service's response RequestID for request. +func (s *WAFUnsupportedAggregateKeyTypeException) RequestID() string { + return s.RespMetadata.RequestID +} + // A web ACL defines a collection of rules to use to inspect and control web // requests. Each rule has an action defined (allow, block, or count) for requests // that match the statement of the rule. In the web ACL, you assign a default @@ -23884,10 +24778,13 @@ type XssMatchStatement struct { FieldToMatch *FieldToMatch `type:"structure" required:"true"` // Text transformations eliminate some of the unusual formatting that attackers - // use in web requests in an effort to bypass detection. If you specify one - // or more transformations in a rule statement, WAF performs all transformations - // on the content of the request component identified by FieldToMatch, starting - // from the lowest priority setting, before inspecting the content for a match. + // use in web requests in an effort to bypass detection. Text transformations + // are used in rule match statements, to transform the FieldToMatch request + // component before inspecting it, and they're used in rate-based rule statements, + // to transform request components before using them as custom aggregation keys. + // If you specify one or more transformations to apply, WAF performs all transformations + // on the specified content, starting from the lowest priority setting, and + // then uses the component contents. // // TextTransformations is a required field TextTransformations []*TextTransformation `min:"1" type:"list" required:"true"` @@ -25462,6 +26359,12 @@ const ( // ParameterExceptionFieldAssociatedResourceType is a ParameterExceptionField enum value ParameterExceptionFieldAssociatedResourceType = "ASSOCIATED_RESOURCE_TYPE" + + // ParameterExceptionFieldScopeDown is a ParameterExceptionField enum value + ParameterExceptionFieldScopeDown = "SCOPE_DOWN" + + // ParameterExceptionFieldCustomKeys is a ParameterExceptionField enum value + ParameterExceptionFieldCustomKeys = "CUSTOM_KEYS" ) // ParameterExceptionField_Values returns all elements of the ParameterExceptionField enum @@ -25534,6 +26437,8 @@ func ParameterExceptionField_Values() []string { ParameterExceptionFieldTokenDomain, ParameterExceptionFieldAtpRuleSetResponseInspection, ParameterExceptionFieldAssociatedResourceType, + ParameterExceptionFieldScopeDown, + ParameterExceptionFieldCustomKeys, } } @@ -25603,6 +26508,12 @@ const ( // RateBasedStatementAggregateKeyTypeForwardedIp is a RateBasedStatementAggregateKeyType enum value RateBasedStatementAggregateKeyTypeForwardedIp = "FORWARDED_IP" + + // RateBasedStatementAggregateKeyTypeCustomKeys is a RateBasedStatementAggregateKeyType enum value + RateBasedStatementAggregateKeyTypeCustomKeys = "CUSTOM_KEYS" + + // RateBasedStatementAggregateKeyTypeConstant is a RateBasedStatementAggregateKeyType enum value + RateBasedStatementAggregateKeyTypeConstant = "CONSTANT" ) // RateBasedStatementAggregateKeyType_Values returns all elements of the RateBasedStatementAggregateKeyType enum @@ -25610,6 +26521,8 @@ func RateBasedStatementAggregateKeyType_Values() []string { return []string{ RateBasedStatementAggregateKeyTypeIp, RateBasedStatementAggregateKeyTypeForwardedIp, + RateBasedStatementAggregateKeyTypeCustomKeys, + RateBasedStatementAggregateKeyTypeConstant, } } diff --git a/service/wafv2/errors.go b/service/wafv2/errors.go index 22c6d79316b..c2844c7ae87 100644 --- a/service/wafv2/errors.go +++ b/service/wafv2/errors.go @@ -184,6 +184,14 @@ const ( // a number of minutes for changes to propagate. Verify the resources that you // are specifying in your request parameters and then retry the operation. ErrCodeWAFUnavailableEntityException = "WAFUnavailableEntityException" + + // ErrCodeWAFUnsupportedAggregateKeyTypeException for service response error code + // "WAFUnsupportedAggregateKeyTypeException". + // + // The rule that you've named doesn't aggregate solely on the IP address or + // solely on the forwarded IP address. This call is only available for rate-based + // rules with an AggregateKeyType setting of IP or FORWARDED_IP. + ErrCodeWAFUnsupportedAggregateKeyTypeException = "WAFUnsupportedAggregateKeyTypeException" ) var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{ @@ -205,4 +213,5 @@ var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{ "WAFTagOperationException": newErrorWAFTagOperationException, "WAFTagOperationInternalErrorException": newErrorWAFTagOperationInternalErrorException, "WAFUnavailableEntityException": newErrorWAFUnavailableEntityException, + "WAFUnsupportedAggregateKeyTypeException": newErrorWAFUnsupportedAggregateKeyTypeException, }