[ { "Name": "string", "Priority": integer, "Statement": { "ByteMatchStatement": { "SearchString": blob, "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ], "PositionalConstraint": "EXACTLY"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS"|"CONTAINS_WORD" }, "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "SizeConstraintStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "ComparisonOperator": "EQ"|"NE"|"LE"|"LT"|"GE"|"GT", "Size": long, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "GeoMatchStatement": { "CountryCodes": ["AF"|"AX"|"AL"|"DZ"|"AS"|"AD"|"AO"|"AI"|"AQ"|"AG"|"AR"|"AM"|"AW"|"AU"|"AT"|"AZ"|"BS"|"BH"|"BD"|"BB"|"BY"|"BE"|"BZ"|"BJ"|"BM"|"BT"|"BO"|"BQ"|"BA"|"BW"|"BV"|"BR"|"IO"|"BN"|"BG"|"BF"|"BI"|"KH"|"CM"|"CA"|"CV"|"KY"|"CF"|"TD"|"CL"|"CN"|"CX"|"CC"|"CO"|"KM"|"CG"|"CD"|"CK"|"CR"|"CI"|"HR"|"CU"|"CW"|"CY"|"CZ"|"DK"|"DJ"|"DM"|"DO"|"EC"|"EG"|"SV"|"GQ"|"ER"|"EE"|"ET"|"FK"|"FO"|"FJ"|"FI"|"FR"|"GF"|"PF"|"TF"|"GA"|"GM"|"GE"|"DE"|"GH"|"GI"|"GR"|"GL"|"GD"|"GP"|"GU"|"GT"|"GG"|"GN"|"GW"|"GY"|"HT"|"HM"|"VA"|"HN"|"HK"|"HU"|"IS"|"IN"|"ID"|"IR"|"IQ"|"IE"|"IM"|"IL"|"IT"|"JM"|"JP"|"JE"|"JO"|"KZ"|"KE"|"KI"|"KP"|"KR"|"KW"|"KG"|"LA"|"LV"|"LB"|"LS"|"LR"|"LY"|"LI"|"LT"|"LU"|"MO"|"MK"|"MG"|"MW"|"MY"|"MV"|"ML"|"MT"|"MH"|"MQ"|"MR"|"MU"|"YT"|"MX"|"FM"|"MD"|"MC"|"MN"|"ME"|"MS"|"MA"|"MZ"|"MM"|"NA"|"NR"|"NP"|"NL"|"NC"|"NZ"|"NI"|"NE"|"NG"|"NU"|"NF"|"MP"|"NO"|"OM"|"PK"|"PW"|"PS"|"PA"|"PG"|"PY"|"PE"|"PH"|"PN"|"PL"|"PT"|"PR"|"QA"|"RE"|"RO"|"RU"|"RW"|"BL"|"SH"|"KN"|"LC"|"MF"|"PM"|"VC"|"WS"|"SM"|"ST"|"SA"|"SN"|"RS"|"SC"|"SL"|"SG"|"SX"|"SK"|"SI"|"SB"|"SO"|"ZA"|"GS"|"SS"|"ES"|"LK"|"SD"|"SR"|"SJ"|"SZ"|"SE"|"CH"|"SY"|"TW"|"TJ"|"TZ"|"TH"|"TL"|"TG"|"TK"|"TO"|"TT"|"TN"|"TR"|"TM"|"TC"|"TV"|"UG"|"UA"|"AE"|"GB"|"US"|"UM"|"UY"|"UZ"|"VU"|"VE"|"VN"|"VG"|"VI"|"WF"|"EH"|"YE"|"ZM"|"ZW", ...], "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "RuleGroupReferenceStatement": { "ARN": "string", "ExcludedRules": [ { "Name": "string" } ... ] }, "IPSetReferenceStatement": { "ARN": "string", "IPSetForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH", "Position": "FIRST"|"LAST"|"ANY" } }, "RegexPatternSetReferenceStatement": { "ARN": "string", "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "RateBasedStatement": { "Limit": long, "AggregateKeyType": "IP"|"FORWARDED_IP", "ScopeDownStatement": { "ByteMatchStatement": { "SearchString": blob, "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ], "PositionalConstraint": "EXACTLY"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS"|"CONTAINS_WORD" }, "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "SizeConstraintStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "ComparisonOperator": "EQ"|"NE"|"LE"|"LT"|"GE"|"GT", "Size": long, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "GeoMatchStatement": { "CountryCodes": ["AF"|"AX"|"AL"|"DZ"|"AS"|"AD"|"AO"|"AI"|"AQ"|"AG"|"AR"|"AM"|"AW"|"AU"|"AT"|"AZ"|"BS"|"BH"|"BD"|"BB"|"BY"|"BE"|"BZ"|"BJ"|"BM"|"BT"|"BO"|"BQ"|"BA"|"BW"|"BV"|"BR"|"IO"|"BN"|"BG"|"BF"|"BI"|"KH"|"CM"|"CA"|"CV"|"KY"|"CF"|"TD"|"CL"|"CN"|"CX"|"CC"|"CO"|"KM"|"CG"|"CD"|"CK"|"CR"|"CI"|"HR"|"CU"|"CW"|"CY"|"CZ"|"DK"|"DJ"|"DM"|"DO"|"EC"|"EG"|"SV"|"GQ"|"ER"|"EE"|"ET"|"FK"|"FO"|"FJ"|"FI"|"FR"|"GF"|"PF"|"TF"|"GA"|"GM"|"GE"|"DE"|"GH"|"GI"|"GR"|"GL"|"GD"|"GP"|"GU"|"GT"|"GG"|"GN"|"GW"|"GY"|"HT"|"HM"|"VA"|"HN"|"HK"|"HU"|"IS"|"IN"|"ID"|"IR"|"IQ"|"IE"|"IM"|"IL"|"IT"|"JM"|"JP"|"JE"|"JO"|"KZ"|"KE"|"KI"|"KP"|"KR"|"KW"|"KG"|"LA"|"LV"|"LB"|"LS"|"LR"|"LY"|"LI"|"LT"|"LU"|"MO"|"MK"|"MG"|"MW"|"MY"|"MV"|"ML"|"MT"|"MH"|"MQ"|"MR"|"MU"|"YT"|"MX"|"FM"|"MD"|"MC"|"MN"|"ME"|"MS"|"MA"|"MZ"|"MM"|"NA"|"NR"|"NP"|"NL"|"NC"|"NZ"|"NI"|"NE"|"NG"|"NU"|"NF"|"MP"|"NO"|"OM"|"PK"|"PW"|"PS"|"PA"|"PG"|"PY"|"PE"|"PH"|"PN"|"PL"|"PT"|"PR"|"QA"|"RE"|"RO"|"RU"|"RW"|"BL"|"SH"|"KN"|"LC"|"MF"|"PM"|"VC"|"WS"|"SM"|"ST"|"SA"|"SN"|"RS"|"SC"|"SL"|"SG"|"SX"|"SK"|"SI"|"SB"|"SO"|"ZA"|"GS"|"SS"|"ES"|"LK"|"SD"|"SR"|"SJ"|"SZ"|"SE"|"CH"|"SY"|"TW"|"TJ"|"TZ"|"TH"|"TL"|"TG"|"TK"|"TO"|"TT"|"TN"|"TR"|"TM"|"TC"|"TV"|"UG"|"UA"|"AE"|"GB"|"US"|"UM"|"UY"|"UZ"|"VU"|"VE"|"VN"|"VG"|"VI"|"WF"|"EH"|"YE"|"ZM"|"ZW", ...], "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "RuleGroupReferenceStatement": { "ARN": "string", "ExcludedRules": [ { "Name": "string" } ... ] }, "IPSetReferenceStatement": { "ARN": "string", "IPSetForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH", "Position": "FIRST"|"LAST"|"ANY" } }, "RegexPatternSetReferenceStatement": { "ARN": "string", "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "RateBasedStatement": { "Limit": long, "AggregateKeyType": "IP"|"FORWARDED_IP", "ScopeDownStatement": { ... recursive ... }, "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "AndStatement": { "Statements": [ { ... recursive ... } ... ] }, "OrStatement": { "Statements": [ { ... recursive ... } ... ] }, "NotStatement": { "Statement": { ... recursive ... } }, "ManagedRuleGroupStatement": { "VendorName": "string", "Name": "string", "ExcludedRules": [ { "Name": "string" } ... ] } }, "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "AndStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": blob, "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ], "PositionalConstraint": "EXACTLY"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS"|"CONTAINS_WORD" }, "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "SizeConstraintStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "ComparisonOperator": "EQ"|"NE"|"LE"|"LT"|"GE"|"GT", "Size": long, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "GeoMatchStatement": { "CountryCodes": ["AF"|"AX"|"AL"|"DZ"|"AS"|"AD"|"AO"|"AI"|"AQ"|"AG"|"AR"|"AM"|"AW"|"AU"|"AT"|"AZ"|"BS"|"BH"|"BD"|"BB"|"BY"|"BE"|"BZ"|"BJ"|"BM"|"BT"|"BO"|"BQ"|"BA"|"BW"|"BV"|"BR"|"IO"|"BN"|"BG"|"BF"|"BI"|"KH"|"CM"|"CA"|"CV"|"KY"|"CF"|"TD"|"CL"|"CN"|"CX"|"CC"|"CO"|"KM"|"CG"|"CD"|"CK"|"CR"|"CI"|"HR"|"CU"|"CW"|"CY"|"CZ"|"DK"|"DJ"|"DM"|"DO"|"EC"|"EG"|"SV"|"GQ"|"ER"|"EE"|"ET"|"FK"|"FO"|"FJ"|"FI"|"FR"|"GF"|"PF"|"TF"|"GA"|"GM"|"GE"|"DE"|"GH"|"GI"|"GR"|"GL"|"GD"|"GP"|"GU"|"GT"|"GG"|"GN"|"GW"|"GY"|"HT"|"HM"|"VA"|"HN"|"HK"|"HU"|"IS"|"IN"|"ID"|"IR"|"IQ"|"IE"|"IM"|"IL"|"IT"|"JM"|"JP"|"JE"|"JO"|"KZ"|"KE"|"KI"|"KP"|"KR"|"KW"|"KG"|"LA"|"LV"|"LB"|"LS"|"LR"|"LY"|"LI"|"LT"|"LU"|"MO"|"MK"|"MG"|"MW"|"MY"|"MV"|"ML"|"MT"|"MH"|"MQ"|"MR"|"MU"|"YT"|"MX"|"FM"|"MD"|"MC"|"MN"|"ME"|"MS"|"MA"|"MZ"|"MM"|"NA"|"NR"|"NP"|"NL"|"NC"|"NZ"|"NI"|"NE"|"NG"|"NU"|"NF"|"MP"|"NO"|"OM"|"PK"|"PW"|"PS"|"PA"|"PG"|"PY"|"PE"|"PH"|"PN"|"PL"|"PT"|"PR"|"QA"|"RE"|"RO"|"RU"|"RW"|"BL"|"SH"|"KN"|"LC"|"MF"|"PM"|"VC"|"WS"|"SM"|"ST"|"SA"|"SN"|"RS"|"SC"|"SL"|"SG"|"SX"|"SK"|"SI"|"SB"|"SO"|"ZA"|"GS"|"SS"|"ES"|"LK"|"SD"|"SR"|"SJ"|"SZ"|"SE"|"CH"|"SY"|"TW"|"TJ"|"TZ"|"TH"|"TL"|"TG"|"TK"|"TO"|"TT"|"TN"|"TR"|"TM"|"TC"|"TV"|"UG"|"UA"|"AE"|"GB"|"US"|"UM"|"UY"|"UZ"|"VU"|"VE"|"VN"|"VG"|"VI"|"WF"|"EH"|"YE"|"ZM"|"ZW", ...], "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "RuleGroupReferenceStatement": { "ARN": "string", "ExcludedRules": [ { "Name": "string" } ... ] }, "IPSetReferenceStatement": { "ARN": "string", "IPSetForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH", "Position": "FIRST"|"LAST"|"ANY" } }, "RegexPatternSetReferenceStatement": { "ARN": "string", "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "RateBasedStatement": { "Limit": long, "AggregateKeyType": "IP"|"FORWARDED_IP", "ScopeDownStatement": { ... recursive ... }, "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "AndStatement": { "Statements": [ { ... recursive ... } ... ] }, "OrStatement": { "Statements": [ { ... recursive ... } ... ] }, "NotStatement": { "Statement": { ... recursive ... } }, "ManagedRuleGroupStatement": { "VendorName": "string", "Name": "string", "ExcludedRules": [ { "Name": "string" } ... ] } } ... ] }, "OrStatement": { "Statements": [ { "ByteMatchStatement": { "SearchString": blob, "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ], "PositionalConstraint": "EXACTLY"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS"|"CONTAINS_WORD" }, "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "SizeConstraintStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "ComparisonOperator": "EQ"|"NE"|"LE"|"LT"|"GE"|"GT", "Size": long, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "GeoMatchStatement": { "CountryCodes": ["AF"|"AX"|"AL"|"DZ"|"AS"|"AD"|"AO"|"AI"|"AQ"|"AG"|"AR"|"AM"|"AW"|"AU"|"AT"|"AZ"|"BS"|"BH"|"BD"|"BB"|"BY"|"BE"|"BZ"|"BJ"|"BM"|"BT"|"BO"|"BQ"|"BA"|"BW"|"BV"|"BR"|"IO"|"BN"|"BG"|"BF"|"BI"|"KH"|"CM"|"CA"|"CV"|"KY"|"CF"|"TD"|"CL"|"CN"|"CX"|"CC"|"CO"|"KM"|"CG"|"CD"|"CK"|"CR"|"CI"|"HR"|"CU"|"CW"|"CY"|"CZ"|"DK"|"DJ"|"DM"|"DO"|"EC"|"EG"|"SV"|"GQ"|"ER"|"EE"|"ET"|"FK"|"FO"|"FJ"|"FI"|"FR"|"GF"|"PF"|"TF"|"GA"|"GM"|"GE"|"DE"|"GH"|"GI"|"GR"|"GL"|"GD"|"GP"|"GU"|"GT"|"GG"|"GN"|"GW"|"GY"|"HT"|"HM"|"VA"|"HN"|"HK"|"HU"|"IS"|"IN"|"ID"|"IR"|"IQ"|"IE"|"IM"|"IL"|"IT"|"JM"|"JP"|"JE"|"JO"|"KZ"|"KE"|"KI"|"KP"|"KR"|"KW"|"KG"|"LA"|"LV"|"LB"|"LS"|"LR"|"LY"|"LI"|"LT"|"LU"|"MO"|"MK"|"MG"|"MW"|"MY"|"MV"|"ML"|"MT"|"MH"|"MQ"|"MR"|"MU"|"YT"|"MX"|"FM"|"MD"|"MC"|"MN"|"ME"|"MS"|"MA"|"MZ"|"MM"|"NA"|"NR"|"NP"|"NL"|"NC"|"NZ"|"NI"|"NE"|"NG"|"NU"|"NF"|"MP"|"NO"|"OM"|"PK"|"PW"|"PS"|"PA"|"PG"|"PY"|"PE"|"PH"|"PN"|"PL"|"PT"|"PR"|"QA"|"RE"|"RO"|"RU"|"RW"|"BL"|"SH"|"KN"|"LC"|"MF"|"PM"|"VC"|"WS"|"SM"|"ST"|"SA"|"SN"|"RS"|"SC"|"SL"|"SG"|"SX"|"SK"|"SI"|"SB"|"SO"|"ZA"|"GS"|"SS"|"ES"|"LK"|"SD"|"SR"|"SJ"|"SZ"|"SE"|"CH"|"SY"|"TW"|"TJ"|"TZ"|"TH"|"TL"|"TG"|"TK"|"TO"|"TT"|"TN"|"TR"|"TM"|"TC"|"TV"|"UG"|"UA"|"AE"|"GB"|"US"|"UM"|"UY"|"UZ"|"VU"|"VE"|"VN"|"VG"|"VI"|"WF"|"EH"|"YE"|"ZM"|"ZW", ...], "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "RuleGroupReferenceStatement": { "ARN": "string", "ExcludedRules": [ { "Name": "string" } ... ] }, "IPSetReferenceStatement": { "ARN": "string", "IPSetForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH", "Position": "FIRST"|"LAST"|"ANY" } }, "RegexPatternSetReferenceStatement": { "ARN": "string", "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "RateBasedStatement": { "Limit": long, "AggregateKeyType": "IP"|"FORWARDED_IP", "ScopeDownStatement": { ... recursive ... }, "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "AndStatement": { "Statements": [ { ... recursive ... } ... ] }, "OrStatement": { "Statements": [ { ... recursive ... } ... ] }, "NotStatement": { "Statement": { ... recursive ... } }, "ManagedRuleGroupStatement": { "VendorName": "string", "Name": "string", "ExcludedRules": [ { "Name": "string" } ... ] } } ... ] }, "NotStatement": { "Statement": { "ByteMatchStatement": { "SearchString": blob, "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ], "PositionalConstraint": "EXACTLY"|"STARTS_WITH"|"ENDS_WITH"|"CONTAINS"|"CONTAINS_WORD" }, "SqliMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "XssMatchStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "SizeConstraintStatement": { "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "ComparisonOperator": "EQ"|"NE"|"LE"|"LT"|"GE"|"GT", "Size": long, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "GeoMatchStatement": { "CountryCodes": ["AF"|"AX"|"AL"|"DZ"|"AS"|"AD"|"AO"|"AI"|"AQ"|"AG"|"AR"|"AM"|"AW"|"AU"|"AT"|"AZ"|"BS"|"BH"|"BD"|"BB"|"BY"|"BE"|"BZ"|"BJ"|"BM"|"BT"|"BO"|"BQ"|"BA"|"BW"|"BV"|"BR"|"IO"|"BN"|"BG"|"BF"|"BI"|"KH"|"CM"|"CA"|"CV"|"KY"|"CF"|"TD"|"CL"|"CN"|"CX"|"CC"|"CO"|"KM"|"CG"|"CD"|"CK"|"CR"|"CI"|"HR"|"CU"|"CW"|"CY"|"CZ"|"DK"|"DJ"|"DM"|"DO"|"EC"|"EG"|"SV"|"GQ"|"ER"|"EE"|"ET"|"FK"|"FO"|"FJ"|"FI"|"FR"|"GF"|"PF"|"TF"|"GA"|"GM"|"GE"|"DE"|"GH"|"GI"|"GR"|"GL"|"GD"|"GP"|"GU"|"GT"|"GG"|"GN"|"GW"|"GY"|"HT"|"HM"|"VA"|"HN"|"HK"|"HU"|"IS"|"IN"|"ID"|"IR"|"IQ"|"IE"|"IM"|"IL"|"IT"|"JM"|"JP"|"JE"|"JO"|"KZ"|"KE"|"KI"|"KP"|"KR"|"KW"|"KG"|"LA"|"LV"|"LB"|"LS"|"LR"|"LY"|"LI"|"LT"|"LU"|"MO"|"MK"|"MG"|"MW"|"MY"|"MV"|"ML"|"MT"|"MH"|"MQ"|"MR"|"MU"|"YT"|"MX"|"FM"|"MD"|"MC"|"MN"|"ME"|"MS"|"MA"|"MZ"|"MM"|"NA"|"NR"|"NP"|"NL"|"NC"|"NZ"|"NI"|"NE"|"NG"|"NU"|"NF"|"MP"|"NO"|"OM"|"PK"|"PW"|"PS"|"PA"|"PG"|"PY"|"PE"|"PH"|"PN"|"PL"|"PT"|"PR"|"QA"|"RE"|"RO"|"RU"|"RW"|"BL"|"SH"|"KN"|"LC"|"MF"|"PM"|"VC"|"WS"|"SM"|"ST"|"SA"|"SN"|"RS"|"SC"|"SL"|"SG"|"SX"|"SK"|"SI"|"SB"|"SO"|"ZA"|"GS"|"SS"|"ES"|"LK"|"SD"|"SR"|"SJ"|"SZ"|"SE"|"CH"|"SY"|"TW"|"TJ"|"TZ"|"TH"|"TL"|"TG"|"TK"|"TO"|"TT"|"TN"|"TR"|"TM"|"TC"|"TV"|"UG"|"UA"|"AE"|"GB"|"US"|"UM"|"UY"|"UZ"|"VU"|"VE"|"VN"|"VG"|"VI"|"WF"|"EH"|"YE"|"ZM"|"ZW", ...], "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "RuleGroupReferenceStatement": { "ARN": "string", "ExcludedRules": [ { "Name": "string" } ... ] }, "IPSetReferenceStatement": { "ARN": "string", "IPSetForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH", "Position": "FIRST"|"LAST"|"ANY" } }, "RegexPatternSetReferenceStatement": { "ARN": "string", "FieldToMatch": { "SingleHeader": { "Name": "string" }, "SingleQueryArgument": { "Name": "string" }, "AllQueryArguments": { }, "UriPath": { }, "QueryString": { }, "Body": { }, "Method": { }, "JsonBody": { "MatchPattern": { "All": { }, "IncludedPaths": ["string", ...] }, "MatchScope": "ALL"|"KEY"|"VALUE", "InvalidFallbackBehavior": "MATCH"|"NO_MATCH"|"EVALUATE_AS_STRING" } }, "TextTransformations": [ { "Priority": integer, "Type": "NONE"|"COMPRESS_WHITE_SPACE"|"HTML_ENTITY_DECODE"|"LOWERCASE"|"CMD_LINE"|"URL_DECODE" } ... ] }, "RateBasedStatement": { "Limit": long, "AggregateKeyType": "IP"|"FORWARDED_IP", "ScopeDownStatement": { ... recursive ... }, "ForwardedIPConfig": { "HeaderName": "string", "FallbackBehavior": "MATCH"|"NO_MATCH" } }, "AndStatement": { "Statements": [ { ... recursive ... } ... ] }, "OrStatement": { "Statements": [ { ... recursive ... } ... ] }, "NotStatement": { "Statement": { ... recursive ... } }, "ManagedRuleGroupStatement": { "VendorName": "string", "Name": "string", "ExcludedRules": [ { "Name": "string" } ... ] } } }, "ManagedRuleGroupStatement": { "VendorName": "string", "Name": "string", "ExcludedRules": [ { "Name": "string" } ... ] } }, "Action": { "Block": { }, "Allow": { }, "Count": { } }, "OverrideAction": { "Count": { }, "None": { } }, "VisibilityConfig": { "SampledRequestsEnabled": true|false, "CloudWatchMetricsEnabled": true|false, "MetricName": "string" } } ...] 
