aws-sdk-wafv2 1.143.0 → 1.144.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 42be5085c3ad2c3e642860a980b19343a7240ada4c7803bb6763dac716b04229
-  data.tar.gz: 419005866500240b6494c81ded91545d9001c55bd5f73695667be72e6c66b6f3
+  metadata.gz: a3e4ee4581b2e0819771af79ff1f680b8a53d69192036569c5fe63c8bf3b9223
+  data.tar.gz: e60442868d679da069d2cf3ae40791b2207972251bfdb8ead92e7ff4635f45eb
 SHA512:
-  metadata.gz: e7e8263d546c8916cdcd750ac3514f04483b829ff8d45d027fede412d6a60fbf3069dd13b28b4ebf71b48d4ea2034141d3008b6f82f9200cea83133f0e7670d3
-  data.tar.gz: f61c1105b303148904842eaaf863b39240bd579debe5a254c60debbe30bafced0ca1a83ea189e0a395f8200a15f4110bdd708d213413480ed5fc1a001eb4d52d
+  metadata.gz: a3d19f61fe1954fc522ceb36d16694910d1b52bc3d5ab1592a01077fb671c3c92b535f2cfdb5559704300d0be1f83caa300d7eef92adcf4752a7b75108fa4458
+  data.tar.gz: 30455dd8a42c395bacb5fd4546a0e55509de8cace195c719a6963051e3ba555d0af34adbedf43cbeb31a00c33c46f22f71663a45fd1d513c558c28ef52ba22c3

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.144.0 (2026-10-29)
+------------------
+
+* Feature - AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration.
+
 1.143.0 (2026-10-28)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.143.0
+1.144.0

data/lib/aws-sdk-wafv2/client.rb

@@ -3023,6 +3023,11 @@ module Aws::WAFV2
     #   For Application Load Balancer and AppSync, the limit is fixed at 8 KB
     #   (8,192 bytes).
     #
+    #   You can also use this to have your CloudFront distributions insert the
+    #   WAF challenge JavaScript SDK into the HTML responses that they return.
+    #   For more information, see the `ChallengeJavascriptSdkInjection`
+    #   setting.
+    #
     #
     #
     #   [1]: http://aws.amazon.com/waf/pricing/
@@ -8336,6 +8341,11 @@ module Aws::WAFV2
     #   For Application Load Balancer and AppSync, the limit is fixed at 8 KB
     #   (8,192 bytes).
     #
+    #   You can also use this to have your CloudFront distributions insert the
+    #   WAF challenge JavaScript SDK into the HTML responses that they return.
+    #   For more information, see the `ChallengeJavascriptSdkInjection`
+    #   setting.
+    #
     #
     #
     #   [1]: http://aws.amazon.com/waf/pricing/
@@ -8401,7 +8411,7 @@ module Aws::WAFV2
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-wafv2'
-      context[:gem_version] = '1.143.0'
+      context[:gem_version] = '1.144.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-wafv2/client_api.rb

@@ -59,6 +59,8 @@ module Aws::WAFV2
     CaptchaResponse = Shapes::StructureShape.new(name: 'CaptchaResponse')
     ChallengeAction = Shapes::StructureShape.new(name: 'ChallengeAction')
     ChallengeConfig = Shapes::StructureShape.new(name: 'ChallengeConfig')
+    ChallengeJavascriptSdkInjection = Shapes::MapShape.new(name: 'ChallengeJavascriptSdkInjection')
+    ChallengeJavascriptSdkInjectionConfig = Shapes::StructureShape.new(name: 'ChallengeJavascriptSdkInjectionConfig')
     ChallengeResponse = Shapes::StructureShape.new(name: 'ChallengeResponse')
     CheckCapacityRequest = Shapes::StructureShape.new(name: 'CheckCapacityRequest')
     CheckCapacityResponse = Shapes::StructureShape.new(name: 'CheckCapacityResponse')
@@ -597,6 +599,7 @@ module Aws::WAFV2
     AssociateWebACLResponse.struct_class = Types::AssociateWebACLResponse
 
     AssociationConfig.add_member(:request_body, Shapes::ShapeRef.new(shape: RequestBody, location_name: "RequestBody"))
+    AssociationConfig.add_member(:challenge_javascript_sdk_injection, Shapes::ShapeRef.new(shape: ChallengeJavascriptSdkInjection, location_name: "ChallengeJavascriptSdkInjection"))
     AssociationConfig.struct_class = Types::AssociationConfig
 
     AttributeValues.member = Shapes::ShapeRef.new(shape: AttributeValue)
@@ -638,6 +641,11 @@ module Aws::WAFV2
     ChallengeConfig.add_member(:immunity_time_property, Shapes::ShapeRef.new(shape: ImmunityTimeProperty, location_name: "ImmunityTimeProperty"))
     ChallengeConfig.struct_class = Types::ChallengeConfig
 
+    ChallengeJavascriptSdkInjection.key = Shapes::ShapeRef.new(shape: AssociatedResourceType)
+    ChallengeJavascriptSdkInjection.value = Shapes::ShapeRef.new(shape: ChallengeJavascriptSdkInjectionConfig)
+
+    ChallengeJavascriptSdkInjectionConfig.struct_class = Types::ChallengeJavascriptSdkInjectionConfig
+
     ChallengeResponse.add_member(:response_code, Shapes::ShapeRef.new(shape: ResponseCode, location_name: "ResponseCode"))
     ChallengeResponse.add_member(:solve_timestamp, Shapes::ShapeRef.new(shape: SolveTimestamp, location_name: "SolveTimestamp"))
     ChallengeResponse.add_member(:failure_reason, Shapes::ShapeRef.new(shape: FailureReason, location_name: "FailureReason"))

data/lib/aws-sdk-wafv2/types.rb

@@ -590,6 +590,11 @@ module Aws::WAFV2
     # For Application Load Balancer and AppSync, the limit is fixed at 8 KB
     # (8,192 bytes).
     #
+    # You can also use this to have your CloudFront distributions insert the
+    # WAF challenge JavaScript SDK into the HTML responses that they return.
+    # For more information, see the `ChallengeJavascriptSdkInjection`
+    # setting.
+    #
     #
     #
     # [1]: http://aws.amazon.com/waf/pricing/
@@ -618,10 +623,55 @@ module Aws::WAFV2
     #   [1]: http://aws.amazon.com/waf/pricing/
     #   @return [Hash<String,Types::RequestBodyAssociatedResourceTypeConfig>]
     #
+    # @!attribute [rw] challenge_javascript_sdk_injection
+    #   Specifies the CloudFront distributions that insert the WAF challenge
+    #   JavaScript SDK into the HTML responses that they return. When you
+    #   enable this setting for a distribution, you do not add the SDK to
+    #   your web pages yourself.
+    #
+    #   You can configure this setting only for CloudFront distributions,
+    #   using the `CLOUDFRONT` map key. WAF rejects any other resource type,
+    #   and the setting is not available for regional resources. To
+    #   configure it, use the CloudFront scope.
+    #
+    #   Your web ACL must also contain at least one of the following
+    #   qualifying managed rule groups. WAF Bot Control qualifies only at
+    #   the `TARGETED` inspection level, not at `COMMON`:
+    #
+    #   * The WAF Bot Control managed rule group
+    #     `AWSManagedRulesBotControlRuleSet`, with the inspection level set
+    #     to `TARGETED`.
+    #
+    #   * The WAF Fraud Control account takeover prevention (ATP) managed
+    #     rule group `AWSManagedRulesATPRuleSet`.
+    #
+    #   * The WAF Fraud Control account creation fraud prevention (ACFP)
+    #     managed rule group `AWSManagedRulesACFPRuleSet`.
+    #
+    #   If you remove the last qualifying managed rule group from the web
+    #   ACL, or lower the WAF Bot Control inspection level from `TARGETED`
+    #   to `COMMON`, you must remove this setting in the same update.
+    #   Otherwise, WAF rejects the update.
+    #
+    #   Example JSON: ` { "CLOUDFRONT": {} }`
+    #
+    #   If you omit this setting, CloudFront does not insert the SDK. When
+    #   you omit it from a web ACL that previously used it, cached HTML that
+    #   already contains the SDK is still served until it expires, or until
+    #   you invalidate the cache for that distribution. For more
+    #   information, see [Automatic SDK integration for CloudFront
+    #   distributions][1] in the *WAF Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/waf/latest/developerguide/waf-challenge-javascript-sdk-injection.html
+    #   @return [Hash<String,Types::ChallengeJavascriptSdkInjectionConfig>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/AssociationConfig AWS API Documentation
     #
     class AssociationConfig < Struct.new(
-      :request_body)
+      :request_body,
+      :challenge_javascript_sdk_injection)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -1047,6 +1097,23 @@ module Aws::WAFV2
       include Aws::Structure
     end
 
+    # Specifies whether the associated CloudFront distribution inserts the
+    # WAF challenge JavaScript SDK into the HTML responses that it returns.
+    # The structure is empty: including it turns insertion on, and removing
+    # it turns insertion off.
+    #
+    # This is used in the `ChallengeJavascriptSdkInjection` map of the
+    # `AssociationConfig` of the web ACL. The map key identifies the
+    # resource type and must be `CLOUDFRONT`.
+    #
+    # JSON specification: `"CLOUDFRONT": {}`
+    #
+    # @api private
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29/ChallengeJavascriptSdkInjectionConfig AWS API Documentation
+    #
+    class ChallengeJavascriptSdkInjectionConfig < Aws::EmptyStructure; end
+
     # The result from the inspection of the web request for a valid
     # challenge token.
     #
@@ -1839,6 +1906,11 @@ module Aws::WAFV2
     #   For Application Load Balancer and AppSync, the limit is fixed at 8
     #   KB (8,192 bytes).
     #
+    #   You can also use this to have your CloudFront distributions insert
+    #   the WAF challenge JavaScript SDK into the HTML responses that they
+    #   return. For more information, see the
+    #   `ChallengeJavascriptSdkInjection` setting.
+    #
     #
     #
     #   [1]: http://aws.amazon.com/waf/pricing/
@@ -11142,6 +11214,11 @@ module Aws::WAFV2
     #   For Application Load Balancer and AppSync, the limit is fixed at 8
     #   KB (8,192 bytes).
     #
+    #   You can also use this to have your CloudFront distributions insert
+    #   the WAF challenge JavaScript SDK into the HTML responses that they
+    #   return. For more information, see the
+    #   `ChallengeJavascriptSdkInjection` setting.
+    #
     #
     #
     #   [1]: http://aws.amazon.com/waf/pricing/
@@ -11978,6 +12055,11 @@ module Aws::WAFV2
     #   For Application Load Balancer and AppSync, the limit is fixed at 8
     #   KB (8,192 bytes).
     #
+    #   You can also use this to have your CloudFront distributions insert
+    #   the WAF challenge JavaScript SDK into the HTML responses that they
+    #   return. For more information, see the
+    #   `ChallengeJavascriptSdkInjection` setting.
+    #
     #
     #
     #   [1]: http://aws.amazon.com/waf/pricing/

data/lib/aws-sdk-wafv2.rb

@@ -54,7 +54,7 @@ module Aws::WAFV2
   autoload :EndpointProvider, 'aws-sdk-wafv2/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-wafv2/endpoints'
 
-  GEM_VERSION = '1.143.0'
+  GEM_VERSION = '1.144.0'
 
 end
 

data/sig/client.rbs

@@ -232,6 +232,8 @@ module Aws
                             ?association_config: {
                               request_body: Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), {
                                   default_size_inspection_limit: ("KB_16" | "KB_32" | "KB_48" | "KB_64")
+                                }]?,
+                              challenge_javascript_sdk_injection: Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), {
                                 }]?
                             },
                             ?on_source_d_do_s_protection_config: {
@@ -1050,6 +1052,8 @@ module Aws
                             ?association_config: {
                               request_body: Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), {
                                   default_size_inspection_limit: ("KB_16" | "KB_32" | "KB_48" | "KB_64")
+                                }]?,
+                              challenge_javascript_sdk_injection: Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), {
                                 }]?
                             },
                             ?on_source_d_do_s_protection_config: {

data/sig/types.rbs

@@ -99,6 +99,7 @@ module Aws::WAFV2
 
     class AssociationConfig
       attr_accessor request_body: ::Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), Types::RequestBodyAssociatedResourceTypeConfig]
+      attr_accessor challenge_javascript_sdk_injection: ::Hash[("CLOUDFRONT" | "API_GATEWAY" | "COGNITO_USER_POOL" | "APP_RUNNER_SERVICE" | "VERIFIED_ACCESS_INSTANCE" | "AGENTCORE_GATEWAY"), Types::ChallengeJavascriptSdkInjectionConfig]
       SENSITIVE: []
     end
 
@@ -155,6 +156,9 @@ module Aws::WAFV2
       SENSITIVE: []
     end
 
+    class ChallengeJavascriptSdkInjectionConfig < Aws::EmptyStructure
+    end
+
     class ChallengeResponse
       attr_accessor response_code: ::Integer
       attr_accessor solve_timestamp: ::Integer
@@ -1888,7 +1892,7 @@ module Aws::WAFV2
 
     class WAFInvalidParameterException
       attr_accessor message: ::String
-      attr_accessor field: ("WEB_ACL" | "RULE_GROUP" | "REGEX_PATTERN_SET" | "IP_SET" | "MANAGED_RULE_SET" | "RULE" | "EXCLUDED_RULE" | "STATEMENT" | "BYTE_MATCH_STATEMENT" | "SQLI_MATCH_STATEMENT" | "XSS_MATCH_STATEMENT" | "SIZE_CONSTRAINT_STATEMENT" | "GEO_MATCH_STATEMENT" | "RATE_BASED_STATEMENT" | "RULE_GROUP_REFERENCE_STATEMENT" | "REGEX_PATTERN_REFERENCE_STATEMENT" | "IP_SET_REFERENCE_STATEMENT" | "MANAGED_RULE_SET_STATEMENT" | "LABEL_MATCH_STATEMENT" | "AND_STATEMENT" | "OR_STATEMENT" | "NOT_STATEMENT" | "IP_ADDRESS" | "IP_ADDRESS_VERSION" | "FIELD_TO_MATCH" | "TEXT_TRANSFORMATION" | "SINGLE_QUERY_ARGUMENT" | "SINGLE_HEADER" | "DEFAULT_ACTION" | "RULE_ACTION" | "ENTITY_LIMIT" | "OVERRIDE_ACTION" | "SCOPE_VALUE" | "RESOURCE_ARN" | "RESOURCE_TYPE" | "TAGS" | "TAG_KEYS" | "METRIC_NAME" | "FIREWALL_MANAGER_STATEMENT" | "FALLBACK_BEHAVIOR" | "POSITION" | "FORWARDED_IP_CONFIG" | "IP_SET_FORWARDED_IP_CONFIG" | "HEADER_NAME" | "CUSTOM_REQUEST_HANDLING" | "RESPONSE_CONTENT_TYPE" | "CUSTOM_RESPONSE" | "CUSTOM_RESPONSE_BODY" | "JSON_MATCH_PATTERN" | "JSON_MATCH_SCOPE" | "BODY_PARSING_FALLBACK_BEHAVIOR" | "LOGGING_FILTER" | "FILTER_CONDITION" | "EXPIRE_TIMESTAMP" | "CHANGE_PROPAGATION_STATUS" | "ASSOCIABLE_RESOURCE" | "LOG_DESTINATION" | "MANAGED_RULE_GROUP_CONFIG" | "PAYLOAD_TYPE" | "HEADER_MATCH_PATTERN" | "COOKIE_MATCH_PATTERN" | "MAP_MATCH_SCOPE" | "OVERSIZE_HANDLING" | "CHALLENGE_CONFIG" | "TOKEN_DOMAIN" | "ATP_RULE_SET_RESPONSE_INSPECTION" | "ASSOCIATED_RESOURCE_TYPE" | "SCOPE_DOWN" | "CUSTOM_KEYS" | "ACP_RULE_SET_RESPONSE_INSPECTION" | "DATA_PROTECTION_CONFIG" | "LOW_REPUTATION_MODE" | "MONETIZATION_CONFIG" | "WALLET_ADDRESS" | "PRICE_AMOUNT" | "PAYMENT_NETWORK" | "PRE_PARSE_TEXT_TRANSFORMATION")
+      attr_accessor field: ("WEB_ACL" | "RULE_GROUP" | "REGEX_PATTERN_SET" | "IP_SET" | "MANAGED_RULE_SET" | "RULE" | "EXCLUDED_RULE" | "STATEMENT" | "BYTE_MATCH_STATEMENT" | "SQLI_MATCH_STATEMENT" | "XSS_MATCH_STATEMENT" | "SIZE_CONSTRAINT_STATEMENT" | "GEO_MATCH_STATEMENT" | "RATE_BASED_STATEMENT" | "RULE_GROUP_REFERENCE_STATEMENT" | "REGEX_PATTERN_REFERENCE_STATEMENT" | "IP_SET_REFERENCE_STATEMENT" | "MANAGED_RULE_SET_STATEMENT" | "LABEL_MATCH_STATEMENT" | "AND_STATEMENT" | "OR_STATEMENT" | "NOT_STATEMENT" | "IP_ADDRESS" | "IP_ADDRESS_VERSION" | "FIELD_TO_MATCH" | "TEXT_TRANSFORMATION" | "SINGLE_QUERY_ARGUMENT" | "SINGLE_HEADER" | "DEFAULT_ACTION" | "RULE_ACTION" | "ENTITY_LIMIT" | "OVERRIDE_ACTION" | "SCOPE_VALUE" | "RESOURCE_ARN" | "RESOURCE_TYPE" | "TAGS" | "TAG_KEYS" | "METRIC_NAME" | "FIREWALL_MANAGER_STATEMENT" | "FALLBACK_BEHAVIOR" | "POSITION" | "FORWARDED_IP_CONFIG" | "IP_SET_FORWARDED_IP_CONFIG" | "HEADER_NAME" | "CUSTOM_REQUEST_HANDLING" | "RESPONSE_CONTENT_TYPE" | "CUSTOM_RESPONSE" | "CUSTOM_RESPONSE_BODY" | "JSON_MATCH_PATTERN" | "JSON_MATCH_SCOPE" | "BODY_PARSING_FALLBACK_BEHAVIOR" | "LOGGING_FILTER" | "FILTER_CONDITION" | "EXPIRE_TIMESTAMP" | "CHANGE_PROPAGATION_STATUS" | "ASSOCIABLE_RESOURCE" | "LOG_DESTINATION" | "MANAGED_RULE_GROUP_CONFIG" | "PAYLOAD_TYPE" | "HEADER_MATCH_PATTERN" | "COOKIE_MATCH_PATTERN" | "MAP_MATCH_SCOPE" | "OVERSIZE_HANDLING" | "CHALLENGE_CONFIG" | "TOKEN_DOMAIN" | "ATP_RULE_SET_RESPONSE_INSPECTION" | "ASSOCIATED_RESOURCE_TYPE" | "SCOPE_DOWN" | "CUSTOM_KEYS" | "ACP_RULE_SET_RESPONSE_INSPECTION" | "DATA_PROTECTION_CONFIG" | "LOW_REPUTATION_MODE" | "MONETIZATION_CONFIG" | "WALLET_ADDRESS" | "PRICE_AMOUNT" | "PAYMENT_NETWORK" | "PRE_PARSE_TEXT_TRANSFORMATION" | "CHALLENGE_JAVASCRIPT_SDK_INJECTION_CONFIG")
       attr_accessor parameter: ::String
       attr_accessor reason: ::String
       SENSITIVE: []

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-wafv2
 version: !ruby/object:Gem::Version
-  version: 1.143.0
+  version: 1.144.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.262.0
+        version: 3.263.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.262.0
+        version: 3.263.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement