@aws-sdk/client-wafv2 3.743.0 → 3.749.0

package/dist-types/models/models_0.d.ts

@@ -709,7 +709,8 @@ export interface UriPath {
  *                   </li>
  *                   <li>
  *                      <p>If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling.
- *                   The only way to exclude fields from request sampling is by disabling sampling in the web ACL visibility configuration. </p>
+ *                         You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration
+ *                       or by configuring data protection for the web ACL.</p>
  *                   </li>
  *                </ul>
  *             </li>
@@ -2132,38 +2133,38 @@ export interface AWSManagedRulesBotControlRuleSet {
  */
 export interface ManagedRuleGroupConfig {
     /**
-     * @deprecated
-     *
      * <note>
      *             <p>Instead of this setting, provide your configuration under <code>AWSManagedRulesATPRuleSet</code>. </p>
      *          </note>
+     *
+     * @deprecated
      * @public
      */
     LoginPath?: string | undefined;
     /**
-     * @deprecated
-     *
      * <note>
      *             <p>Instead of this setting, provide your configuration under the request inspection configuration for <code>AWSManagedRulesATPRuleSet</code> or <code>AWSManagedRulesACFPRuleSet</code>. </p>
      *          </note>
+     *
+     * @deprecated
      * @public
      */
     PayloadType?: PayloadType | undefined;
     /**
-     * @deprecated
-     *
      * <note>
      *             <p>Instead of this setting, provide your configuration under the request inspection configuration for <code>AWSManagedRulesATPRuleSet</code> or <code>AWSManagedRulesACFPRuleSet</code>. </p>
      *          </note>
+     *
+     * @deprecated
      * @public
      */
     UsernameField?: UsernameField | undefined;
     /**
-     * @deprecated
-     *
      * <note>
      *             <p>Instead of this setting, provide your configuration under the request inspection configuration for <code>AWSManagedRulesATPRuleSet</code> or <code>AWSManagedRulesACFPRuleSet</code>. </p>
      *          </note>
+     *
+     * @deprecated
      * @public
      */
     PasswordField?: PasswordField | undefined;
@@ -2386,12 +2387,18 @@ export interface RuleAction {
 }
 /**
  * <p>Action setting to use in the place of a rule action that is configured inside the rule group. You specify one override for each rule whose action you want to change. </p>
+ *          <note>
+ *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+ *          </note>
  *          <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>
  * @public
  */
 export interface RuleActionOverride {
     /**
      * <p>The name of the rule to override.</p>
+     *          <note>
+     *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+     *          </note>
      * @public
      */
     Name: string | undefined;
@@ -2672,6 +2679,9 @@ export interface RuleGroupReferenceStatement {
     ExcludedRules?: ExcludedRule[] | undefined;
     /**
      * <p>Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. </p>
+     *          <note>
+     *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+     *          </note>
      *          <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>
      * @public
      */
@@ -2926,6 +2936,7 @@ export declare const ParameterExceptionField: {
     readonly CUSTOM_REQUEST_HANDLING: "CUSTOM_REQUEST_HANDLING";
     readonly CUSTOM_RESPONSE: "CUSTOM_RESPONSE";
     readonly CUSTOM_RESPONSE_BODY: "CUSTOM_RESPONSE_BODY";
+    readonly DATA_PROTECTION_CONFIG: "DATA_PROTECTION_CONFIG";
     readonly DEFAULT_ACTION: "DEFAULT_ACTION";
     readonly ENTITY_LIMIT: "ENTITY_LIMIT";
     readonly EXCLUDED_RULE: "EXCLUDED_RULE";
@@ -3052,7 +3063,7 @@ export declare class WAFNonexistentItemException extends __BaseException {
  * <p>WAF couldn’t retrieve a resource that you specified for this operation.
  *        If you've just created a resource that you're using in this operation, you might
  *        just need to wait a few minutes. It can take from a few seconds to a number of minutes
- *        for changes to propagate. Verify the resources that you are specifying in your request
+ *        for changes to propagate. Verify the resource specifications in your request
  *        parameters and then retry the operation.</p>
  * @public
  */
@@ -3225,9 +3236,11 @@ export interface VisibilityConfig {
     /**
      * <p>Indicates whether WAF should store a sampling of the web requests that
      *          match the rules. You can view the sampled requests through the WAF console. </p>
+     *          <p>If you configure data protection for the web ACL, the protection applies to the web ACL's sampled web request data. </p>
      *          <note>
      *             <p>Request sampling doesn't provide a field redaction option, and any field redaction that you specify in your logging configuration doesn't affect sampling.
-     *                   The only way to exclude fields from request sampling is by disabling sampling in the web ACL visibility configuration. </p>
+     *                 You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration
+     *                       or by configuring data protection for the web ACL.</p>
      *          </note>
      * @public
      */
@@ -3343,7 +3356,7 @@ export declare class WAFSubscriptionNotFoundException extends __BaseException {
  */
 export interface CreateAPIKeyRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -3425,7 +3438,7 @@ export interface CreateIPSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -3612,7 +3625,7 @@ export interface CreateRegexPatternSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -3759,6 +3772,110 @@ export interface CreateRuleGroupResponse {
      */
     Summary?: RuleGroupSummary | undefined;
 }
+/**
+ * @public
+ * @enum
+ */
+export declare const DataProtectionAction: {
+    readonly HASH: "HASH";
+    readonly SUBSTITUTION: "SUBSTITUTION";
+};
+/**
+ * @public
+ */
+export type DataProtectionAction = (typeof DataProtectionAction)[keyof typeof DataProtectionAction];
+/**
+ * @public
+ * @enum
+ */
+export declare const FieldToProtectType: {
+    readonly BODY: "BODY";
+    readonly QUERY_STRING: "QUERY_STRING";
+    readonly SINGLE_COOKIE: "SINGLE_COOKIE";
+    readonly SINGLE_HEADER: "SINGLE_HEADER";
+    readonly SINGLE_QUERY_ARGUMENT: "SINGLE_QUERY_ARGUMENT";
+};
+/**
+ * @public
+ */
+export type FieldToProtectType = (typeof FieldToProtectType)[keyof typeof FieldToProtectType];
+/**
+ * <p>Specifies a field type and keys to protect in stored web request data. This is part of the data protection configuration for a web ACL. </p>
+ * @public
+ */
+export interface FieldToProtect {
+    /**
+     * <p>Specifies the web request component type to protect.  </p>
+     * @public
+     */
+    FieldType: FieldToProtectType | undefined;
+    /**
+     * <p>Specifies the keys to protect for the specified field type. If you don't specify any key, then all keys for the field type are protected.  </p>
+     * @public
+     */
+    FieldKeys?: string[] | undefined;
+}
+/**
+ * <p>Specifies the protection behavior for a field type. This is part of the data protection configuration for a web ACL. </p>
+ * @public
+ */
+export interface DataProtection {
+    /**
+     * <p>Specifies the field type and optional keys to apply the protection behavior to. </p>
+     * @public
+     */
+    Field: FieldToProtect | undefined;
+    /**
+     * <p>Specifies how to protect the field. WAF can apply a one-way hash to the field or hard code a string substitution. </p>
+     *          <ul>
+     *             <li>
+     *                <p>One-way hash example: <code>ade099751dEXAMPLEHASH2ea9f3393f80dd5d3bEXAMPLEHASH966ae0d3cd5a1e</code>
+     *                </p>
+     *             </li>
+     *             <li>
+     *                <p>Substitution example: <code>REDACTED</code>
+     *                </p>
+     *             </li>
+     *          </ul>
+     * @public
+     */
+    Action: DataProtectionAction | undefined;
+    /**
+     * <p>Specifies whether to also protect any rule match details from the web ACL logs when applying data protection this field type and keys. WAF logs these details for non-terminating
+     *            matching rules and for the terminating matching rule. For additional information, see
+     *             <a href="https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html">Log fields for web ACL traffic</a> in the
+     *             <i>WAF Developer Guide</i>.</p>
+     *          <p>Default: <code>FALSE</code>
+     *          </p>
+     * @public
+     */
+    ExcludeRuleMatchDetails?: boolean | undefined;
+    /**
+     * <p>Specifies whether to also protect any rate-based rule details from the web ACL logs when applying data protection for this field type and keys.
+     *            For additional information, see the log field <code>rateBasedRuleList</code> at
+     *             <a href="https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html">Log fields for web ACL traffic</a> in the
+     *             <i>WAF Developer Guide</i>.</p>
+     *          <p>Default: <code>FALSE</code>
+     *          </p>
+     * @public
+     */
+    ExcludeRateBasedDetails?: boolean | undefined;
+}
+/**
+ * <p>Specifies data protection to apply to the web request data that WAF stores for the web ACL. This is a web ACL level data protection option. </p>
+ *          <p>The data protection that you configure for the web ACL alters the data that's available for any other data collection activity,
+ *   including WAF logging, web ACL request sampling, Amazon Web Services Managed Rules, and Amazon Security Lake data collection and management. Your other option for data protection is in the logging configuration, which only affects logging. </p>
+ *          <p>This is part of the data protection configuration for a web ACL. </p>
+ * @public
+ */
+export interface DataProtectionConfig {
+    /**
+     * <p>An array of data protection configurations for specific web request field types. This is defined for each
+     *            web ACL. WAF applies the specified protection to all web requests that the web ACL inspects.  </p>
+     * @public
+     */
+    DataProtections: DataProtection[] | undefined;
+}
 /**
  * <p>In a <a>WebACL</a>, this is the action that you want WAF to perform
  *          when a web request doesn't match any of the rules in the <code>WebACL</code>. The default
@@ -3846,7 +3963,7 @@ export declare class WAFConfigurationWarningException extends __BaseException {
  */
 export interface DeleteAPIKeyRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -3905,7 +4022,7 @@ export interface DeleteIPSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4030,7 +4147,7 @@ export interface DeleteRegexPatternSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4069,7 +4186,7 @@ export interface DeleteRuleGroupRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4108,7 +4225,7 @@ export interface DeleteWebACLRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4142,7 +4259,7 @@ export interface DeleteWebACLResponse {
  */
 export interface DescribeAllManagedProductsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4231,7 +4348,7 @@ export interface DescribeManagedProductsByVendorRequest {
      */
     VendorName: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4270,7 +4387,7 @@ export interface DescribeManagedRuleGroupRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4486,7 +4603,7 @@ export interface GenerateMobileSdkReleaseUrlResponse {
  */
 export interface GetDecryptedAPIKeyRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4530,7 +4647,7 @@ export interface GetIPSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -4768,6 +4885,7 @@ export interface LoggingFilter {
  *          from WAF. As part of the association, you can specify parts of the standard logging
  *          fields to keep out of the logs and you can specify filters so that you log only a subset of
  *          the logging records. </p>
+ *          <p>If you configure data protection for the web ACL, the protection applies to the data that WAF sends to the logs. </p>
  *          <note>
  *             <p>You can define one logging destination per web ACL.</p>
  *          </note>
@@ -4817,6 +4935,7 @@ export interface LoggingConfiguration {
      *          redact the <code>SingleHeader</code> field, the <code>HEADER</code> field in the logs will
      *          be <code>REDACTED</code> for all rules that use the <code>SingleHeader</code>
      *             <code>FieldToMatch</code> setting. </p>
+     *          <p>If you configure data protection for the web ACL, the protection applies to the data that WAF sends to the logs. </p>
      *          <p>Redaction applies only to the component that's specified in the rule's <code>FieldToMatch</code> setting, so the <code>SingleHeader</code> redaction
      *          doesn't apply to rules that use the <code>Headers</code>
      *             <code>FieldToMatch</code>.</p>
@@ -4825,8 +4944,8 @@ export interface LoggingConfiguration {
      *          <code>QueryString</code>, <code>SingleHeader</code>, and <code>Method</code>.</p>
      *          </note>
      *          <note>
-     *             <p>This setting has no impact on request sampling. With request sampling,
-     *                 the only way to exclude fields is by disabling sampling in the web ACL visibility configuration. </p>
+     *             <p>This setting has no impact on request sampling. You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration
+     *                       or by configuring data protection for the web ACL.</p>
      *          </note>
      * @public
      */
@@ -4888,7 +5007,7 @@ export interface GetManagedRuleSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5115,7 +5234,7 @@ export interface GetPermissionPolicyResponse {
  */
 export interface GetRateBasedStatementManagedKeysRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5210,7 +5329,7 @@ export interface GetRegexPatternSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5287,7 +5406,7 @@ export interface GetRuleGroupRequest {
      */
     Name?: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5365,7 +5484,7 @@ export interface GetSampledRequestsRequest {
      */
     RuleMetricName: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5648,7 +5767,7 @@ export interface GetWebACLRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5715,7 +5834,7 @@ export interface GetWebACLForResourceRequest {
  */
 export interface ListAPIKeysRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5770,7 +5889,7 @@ export interface ListAPIKeysResponse {
  */
 export interface ListAvailableManagedRuleGroupsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5857,7 +5976,7 @@ export interface ListAvailableManagedRuleGroupVersionsRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5929,7 +6048,7 @@ export interface ListAvailableManagedRuleGroupVersionsResponse {
  */
 export interface ListIPSetsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -5979,7 +6098,7 @@ export interface ListIPSetsResponse {
  */
 export interface ListLoggingConfigurationsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6039,7 +6158,7 @@ export interface ListLoggingConfigurationsResponse {
  */
 export interface ListManagedRuleSetsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6200,7 +6319,7 @@ export interface ListMobileSdkReleasesResponse {
  */
 export interface ListRegexPatternSetsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6271,8 +6390,10 @@ export interface ListResourcesForWebACLRequest {
      */
     WebACLArn: string | undefined;
     /**
-     * <p>Used for web ACLs that are scoped for regional applications.
-     *          A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. </p>
+     * <p>Retrieves the web ACLs that are used by the specified resource type. </p>
+     *          <p>For Amazon CloudFront, don't use this call. Instead, use the CloudFront call
+     *           <code>ListDistributionsByWebACLId</code>. For information, see <a href="https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html">ListDistributionsByWebACLId</a>
+     *           in the <i>Amazon CloudFront API Reference</i>. </p>
      *          <note>
      *             <p>If you don't provide a resource type, the call uses the resource type <code>APPLICATION_LOAD_BALANCER</code>. </p>
      *          </note>
@@ -6297,7 +6418,7 @@ export interface ListResourcesForWebACLResponse {
  */
 export interface ListRuleGroupsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6413,7 +6534,7 @@ export interface ListTagsForResourceResponse {
  */
 export interface ListWebACLsRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6546,7 +6667,7 @@ export interface PutManagedRuleSetVersionsRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6722,7 +6843,7 @@ export interface UpdateIPSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6812,7 +6933,7 @@ export interface UpdateManagedRuleSetVersionExpiryDateRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -6879,7 +7000,7 @@ export interface UpdateRegexPatternSetRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7184,6 +7305,9 @@ export interface ManagedRuleGroupStatement {
     ManagedRuleGroupConfigs?: ManagedRuleGroupConfig[] | undefined;
     /**
      * <p>Action settings to use in the place of the rule actions that are configured inside the rule group. You specify one override for each rule whose action you want to change. </p>
+     *          <note>
+     *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+     *          </note>
      *          <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>
      * @public
      */
@@ -7274,7 +7398,7 @@ export interface NotStatement {
  */
 export interface RateBasedStatement {
     /**
-     * <p>The limit on requests per 5-minute period for a single aggregation instance for the rate-based rule.
+     * <p>The limit on requests during the specified evaluation window for a single aggregation instance for the rate-based rule.
      *        If the rate-based statement includes a <code>ScopeDownStatement</code>, this limit is applied only to the
      *          requests that match the statement.</p>
      *          <p>Examples: </p>
@@ -7421,6 +7545,9 @@ export interface Rule {
      *          fully qualified labels to matching web requests. A fully qualified label is the
      *          concatenation of a label namespace and a rule label. The rule's rule group or web ACL
      *          defines the label namespace. </p>
+     *          <note>
+     *             <p>Any rule that isn't a rule group reference statement or managed rule group statement can add labels to matching web requests.</p>
+     *          </note>
      *          <p>Rules that run after this rule in the web ACL can match against these labels using a
      *             <code>LabelMatchStatement</code>.</p>
      *          <p>For each label, provide a case-sensitive string containing optional namespaces and a
@@ -7549,7 +7676,7 @@ export interface FirewallManagerRuleGroup {
  */
 export interface CheckCapacityRequest {
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7579,7 +7706,7 @@ export interface CreateRuleGroupRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7652,7 +7779,7 @@ export interface CreateWebACLRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7688,6 +7815,13 @@ export interface CreateWebACLRequest {
      * @public
      */
     VisibilityConfig: VisibilityConfig | undefined;
+    /**
+     * <p>Specifies data protection to apply to the web request data that WAF stores for the web ACL. This is a web ACL level data protection option. </p>
+     *          <p>The data protection that you configure for the web ACL alters the data that's available for any other data collection activity,
+     *   including WAF logging, web ACL request sampling, Amazon Web Services Managed Rules, and Amazon Security Lake data collection and management. Your other option for data protection is in the logging configuration, which only affects logging. </p>
+     * @public
+     */
+    DataProtectionConfig?: DataProtectionConfig | undefined;
     /**
      * <p>An array of key:value pairs to associate with the resource.</p>
      * @public
@@ -7838,7 +7972,7 @@ export interface UpdateRuleGroupRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7900,7 +8034,7 @@ export interface UpdateWebACLRequest {
      */
     Name: string | undefined;
     /**
-     * <p>Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+     * <p>Specifies whether this is for a global resource type, such as a Amazon CloudFront distribution. </p>
      *          <p>To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: </p>
      *          <ul>
      *             <li>
@@ -7941,6 +8075,13 @@ export interface UpdateWebACLRequest {
      * @public
      */
     VisibilityConfig: VisibilityConfig | undefined;
+    /**
+     * <p>Specifies data protection to apply to the web request data that WAF stores for the web ACL. This is a web ACL level data protection option. </p>
+     *          <p>The data protection that you configure for the web ACL alters the data that's available for any other data collection activity,
+     *   including WAF logging, web ACL request sampling, Amazon Web Services Managed Rules, and Amazon Security Lake data collection and management. Your other option for data protection is in the logging configuration, which only affects logging. </p>
+     * @public
+     */
+    DataProtectionConfig?: DataProtectionConfig | undefined;
     /**
      * <p>A token used for optimistic locking. WAF returns a token to your <code>get</code> and <code>list</code> requests, to mark the state of the entity at the time of the request. To make changes to the entity associated with the token, you provide the token to operations like <code>update</code> and <code>delete</code>. WAF uses the token to ensure that no changes have been made to the entity since you last retrieved it. If a change has been made, the update fails with a <code>WAFOptimisticLockException</code>. If this happens, perform another <code>get</code>, and use the new token returned by that operation. </p>
      * @public
@@ -8003,7 +8144,7 @@ export interface GetRuleGroupResponse {
     LockToken?: string | undefined;
 }
 /**
- * <p> A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types <a>Rule</a>, <a>RuleGroup</a>, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.  </p>
+ * <p> A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types <a>Rule</a>, <a>RuleGroup</a>, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resource types include Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, AppSync GraphQL API, Amazon Cognito user pool, App Runner service, and Amazon Web Services Verified Access instance.  </p>
  * @public
  */
 export interface WebACL {
@@ -8048,6 +8189,13 @@ export interface WebACL {
      * @public
      */
     VisibilityConfig: VisibilityConfig | undefined;
+    /**
+     * <p>Specifies data protection to apply to the web request data that WAF stores for the web ACL. This is a web ACL level data protection option. </p>
+     *          <p>The data protection that you configure for the web ACL alters the data that's available for any other data collection activity,
+     *   including WAF logging, web ACL request sampling, Amazon Web Services Managed Rules, and Amazon Security Lake data collection and management. Your other option for data protection is in the logging configuration, which only affects logging. </p>
+     * @public
+     */
+    DataProtectionConfig?: DataProtectionConfig | undefined;
     /**
      * <p>The web ACL capacity units (WCUs) currently being used by this web ACL. </p>
      *          <p>WAF uses WCUs to calculate and control the operating