@composurecdk/wafv2 0.0.0-stage → 0.13.0

package/dist/esm/defaults.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Defaults for {@link createWebAclBuilder}. Each can be overridden through the
+ * builder's fluent API.
+ */
+export declare const WEB_ACL_DEFAULTS: {
+    /**
+     * Regional, for API Gateway, Application Load Balancers, AppSync, Cognito,
+     * App Runner and Verified Access. A web ACL for CloudFront must say
+     * `.scope("CLOUDFRONT")` and be deployed in `us-east-1`.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works-resources.html
+     */
+    readonly scope: "REGIONAL";
+    /**
+     * Off, because a sampled request keeps every header, including the
+     * credentials that logging redacts. Turn it on only with a
+     * `dataProtectionConfig`, which does apply to samples.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-data-protection-and-logging.html
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+     */
+    readonly sampledRequests: false;
+    /**
+     * On, to a created `aws-waf-logs-` log group, keeping the requests WAF does
+     * not allow ({@link DEFAULT_LOGGING_FILTER}) and redacting
+     * {@link DEFAULT_LOGGING_REDACTED_HEADERS}.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    readonly logging: {};
+};
+/**
+ * Visibility settings that are not configurable. CloudWatch metrics are always
+ * on for the web ACL and every rule: they are free, and the recommended alarms
+ * and `metrics` helper read them.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
+ */
+export declare const WEB_ACL_VISIBILITY_DEFAULTS: {
+    readonly cloudWatchMetricsEnabled: true;
+};
+/**
+ * Gap between the priorities of consecutive rules, so a rule can be inserted
+ * with an explicit `.priority(n)` without renumbering the others.
+ */
+export declare const DEFAULT_RULE_PRIORITY_STEP = 10;
+/**
+ * The prefix AWS WAF requires of a CloudWatch log group, S3 bucket or Firehose
+ * stream it logs to.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-cw-logs.html
+ */
+export declare const WAF_LOG_GROUP_NAME_PREFIX = "aws-waf-logs-";
+/**
+ * Headers always redacted from WAF logs. Both carry credentials a log reader
+ * could replay, and neither helps tune a rule.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ */
+export declare const DEFAULT_LOGGING_REDACTED_HEADERS: readonly string[];
+/**
+ * Logs every request WAF does not simply allow, and drops the rest. Filtering
+ * is AWS's main lever on log volume and cost, and the allowed requests are
+ * rarely what a rule is tuned against.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ */
+export declare const DEFAULT_LOGGING_FILTER: {
+    readonly defaultBehavior: "DROP";
+    readonly filters: readonly [{
+        readonly behavior: "KEEP";
+        readonly requirement: "MEETS_ANY";
+        readonly conditions: readonly [{
+            readonly action: "BLOCK";
+        }, {
+            readonly action: "COUNT";
+        }, {
+            readonly action: "CAPTCHA";
+        }, {
+            readonly action: "CHALLENGE";
+        }, {
+            readonly action: "EXCLUDED_AS_COUNT";
+        }];
+    }];
+};
+//# sourceMappingURL=defaults.d.ts.map

package/dist/esm/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,gBAAgB;IAC3B;;;;;;OAMG;;IAGH;;;;;;;OAOG;;IAGH;;;;;;OAMG;;CAEK,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;CAE9B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAAgC,CAAC;AAE/F;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;CAeK,CAAC"}

package/dist/esm/defaults.js

@@ -0,0 +1,87 @@
+/**
+ * Defaults for {@link createWebAclBuilder}. Each can be overridden through the
+ * builder's fluent API.
+ */
+export const WEB_ACL_DEFAULTS = {
+    /**
+     * Regional, for API Gateway, Application Load Balancers, AppSync, Cognito,
+     * App Runner and Verified Access. A web ACL for CloudFront must say
+     * `.scope("CLOUDFRONT")` and be deployed in `us-east-1`.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works-resources.html
+     */
+    scope: "REGIONAL",
+    /**
+     * Off, because a sampled request keeps every header, including the
+     * credentials that logging redacts. Turn it on only with a
+     * `dataProtectionConfig`, which does apply to samples.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-data-protection-and-logging.html
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+     */
+    sampledRequests: false,
+    /**
+     * On, to a created `aws-waf-logs-` log group, keeping the requests WAF does
+     * not allow ({@link DEFAULT_LOGGING_FILTER}) and redacting
+     * {@link DEFAULT_LOGGING_REDACTED_HEADERS}.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+     */
+    logging: {},
+};
+/**
+ * Visibility settings that are not configurable. CloudWatch metrics are always
+ * on for the web ACL and every rule: they are free, and the recommended alarms
+ * and `metrics` helper read them.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
+ */
+export const WEB_ACL_VISIBILITY_DEFAULTS = {
+    cloudWatchMetricsEnabled: true,
+};
+/**
+ * Gap between the priorities of consecutive rules, so a rule can be inserted
+ * with an explicit `.priority(n)` without renumbering the others.
+ */
+export const DEFAULT_RULE_PRIORITY_STEP = 10;
+/**
+ * The prefix AWS WAF requires of a CloudWatch log group, S3 bucket or Firehose
+ * stream it logs to.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-cw-logs.html
+ */
+export const WAF_LOG_GROUP_NAME_PREFIX = "aws-waf-logs-";
+/**
+ * Headers always redacted from WAF logs. Both carry credentials a log reader
+ * could replay, and neither helps tune a rule.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_data_classification_define_protection.html
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ */
+export const DEFAULT_LOGGING_REDACTED_HEADERS = ["authorization", "cookie"];
+/**
+ * Logs every request WAF does not simply allow, and drops the rest. Filtering
+ * is AWS's main lever on log volume and cost, and the allowed requests are
+ * rarely what a rule is tuned against.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/logging-management.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
+ */
+export const DEFAULT_LOGGING_FILTER = {
+    defaultBehavior: "DROP",
+    filters: [
+        {
+            behavior: "KEEP",
+            requirement: "MEETS_ANY",
+            conditions: [
+                { action: "BLOCK" },
+                { action: "COUNT" },
+                { action: "CAPTCHA" },
+                { action: "CHALLENGE" },
+                { action: "EXCLUDED_AS_COUNT" },
+            ],
+        },
+    ],
+};
+//# sourceMappingURL=defaults.js.map

package/dist/esm/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/defaults.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;;;;;;OAMG;IACH,KAAK,EAAE,UAAU;IAEjB;;;;;;;OAOG;IACH,eAAe,EAAE,KAAK;IAEtB;;;;;;OAMG;IACH,OAAO,EAAE,EAAE;CACH,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,wBAAwB,EAAE,IAAI;CACtB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AAE/F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe,EAAE,MAAM;IACvB,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,WAAW;YACxB,UAAU,EAAE;gBACV,EAAE,MAAM,EAAE,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,SAAS,EAAE;gBACrB,EAAE,MAAM,EAAE,WAAW,EAAE;gBACvB,EAAE,MAAM,EAAE,mBAAmB,EAAE;aAChC;SACF;KACF;CACqC,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,30 @@
+import { validateMetricName, validateRuleLabel, validateRuleName, validateWebAclName } from "./names.js";
+export { createWebAclBuilder, type IWebAclBuilder, type WebAclBuilderProps, type WebAclBuilderResult, } from "./web-acl-builder.js";
+export { type IWebAclRuleBuilder, type WebAclRuleAction, type WebAclRuleBuilderProps, } from "./rule-builder.js";
+export { type WebAclAssociationTarget } from "./association.js";
+export { type CustomResponse, type CustomResponseBody, SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES, } from "./custom-response.js";
+export { type WebAclScope } from "./scope.js";
+export { type ManagedRuleGroupVersion, type WebAclMetrics, type WebAclRequestMetrics, } from "./metrics.js";
+export { type WebAclAlarmConfig, type WebAclRuleAlarmConfig } from "./alarm-config.js";
+export { WEB_ACL_RULE_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { type WebAclLoggingConfig, type WebAclLogRedaction } from "./logging.js";
+export { type WebAclLogAction, type WebAclLogCondition, type WebAclLoggingFilter, } from "./logging-filter.js";
+export { DEFAULT_LOGGING_FILTER, DEFAULT_LOGGING_REDACTED_HEADERS, DEFAULT_RULE_PRIORITY_STEP, WEB_ACL_DEFAULTS, WEB_ACL_VISIBILITY_DEFAULTS, WAF_LOG_GROUP_NAME_PREFIX, } from "./defaults.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical
+ * in every builder package, so it is discoverable without importing anything
+ * beyond the package you already use. The underlying constraint definitions
+ * stay module-private — this namespace is the only public surface for them.
+ * See ADR-0010.
+ */
+export declare const constraints: {
+    validate: {
+        webAclName: typeof validateWebAclName;
+        ruleName: typeof validateRuleName;
+        metricName: typeof validateMetricName;
+        ruleLabel: typeof validateRuleLabel;
+    };
+    sanitize: {};
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW;;;;;;;;CAQO,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,23 @@
+import { validateMetricName, validateRuleLabel, validateRuleName, validateWebAclName, } from "./names.js";
+export { createWebAclBuilder, } from "./web-acl-builder.js";
+export { SUPPORTED_CUSTOM_RESPONSE_STATUS_CODES, } from "./custom-response.js";
+export { WEB_ACL_RULE_ALARM_DEFAULTS } from "./alarm-defaults.js";
+export { DEFAULT_LOGGING_FILTER, DEFAULT_LOGGING_REDACTED_HEADERS, DEFAULT_RULE_PRIORITY_STEP, WEB_ACL_DEFAULTS, WEB_ACL_VISIBILITY_DEFAULTS, WAF_LOG_GROUP_NAME_PREFIX, } from "./defaults.js";
+/**
+ * This package's AWS-property constraints, grouped by application strategy.
+ * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical
+ * in every builder package, so it is discoverable without importing anything
+ * beyond the package you already use. The underlying constraint definitions
+ * stay module-private — this namespace is the only public surface for them.
+ * See ADR-0010.
+ */
+export const constraints = {
+    validate: {
+        webAclName: validateWebAclName,
+        ruleName: validateRuleName,
+        metricName: validateMetricName,
+        ruleLabel: validateRuleLabel,
+    },
+    sanitize: {},
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,GAIpB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAGL,sCAAsC,GACvC,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAOlE,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,0BAA0B,EAC1B,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE;QACR,UAAU,EAAE,kBAAkB;QAC9B,QAAQ,EAAE,gBAAgB;QAC1B,UAAU,EAAE,kBAAkB;QAC9B,SAAS,EAAE,iBAAiB;KAC7B;IACD,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/dist/esm/logging-filter.d.ts

@@ -0,0 +1,27 @@
+/** An action a logging filter condition can match on. */
+export type WebAclLogAction = "ALLOW" | "BLOCK" | "COUNT" | "CAPTCHA" | "CHALLENGE" | "EXCLUDED_AS_COUNT";
+/** One condition of a {@link WebAclLoggingFilter} filter: an action or a label. */
+export type WebAclLogCondition = {
+    action: WebAclLogAction;
+} | {
+    label: string;
+};
+/**
+ * Which requests WAF writes to the log, typed. The builder turns it into the
+ * PascalCase JSON CloudFormation's `LoggingFilter` expects, which CDK types
+ * as `any`.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/APIReference/API_LoggingFilter.html
+ */
+export interface WebAclLoggingFilter {
+    /** What to do with a request no filter matches. */
+    readonly defaultBehavior: "KEEP" | "DROP";
+    readonly filters: readonly {
+        readonly behavior: "KEEP" | "DROP";
+        readonly requirement: "MEETS_ALL" | "MEETS_ANY";
+        readonly conditions: readonly WebAclLogCondition[];
+    }[];
+}
+/** @internal — `LoggingFilter` is `any` in CDK, so this emits CloudFormation's PascalCase. */
+export declare function toFilterProperty(filter: WebAclLoggingFilter): unknown;
+//# sourceMappingURL=logging-filter.d.ts.map

package/dist/esm/logging-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-filter.d.ts","sourceRoot":"","sources":["../../src/logging-filter.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,MAAM,MAAM,eAAe,GACzB,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAE9E,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAAC;QAChD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;KACpD,EAAE,CAAC;CACL;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAarE"}

package/dist/esm/logging-filter.js

@@ -0,0 +1,14 @@
+/** @internal — `LoggingFilter` is `any` in CDK, so this emits CloudFormation's PascalCase. */
+export function toFilterProperty(filter) {
+    return {
+        DefaultBehavior: filter.defaultBehavior,
+        Filters: filter.filters.map((f) => ({
+            Behavior: f.behavior,
+            Requirement: f.requirement,
+            Conditions: f.conditions.map((c) => "action" in c
+                ? { ActionCondition: { Action: c.action } }
+                : { LabelNameCondition: { LabelName: c.label } }),
+        })),
+    };
+}
+//# sourceMappingURL=logging-filter.js.map

package/dist/esm/logging-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-filter.js","sourceRoot":"","sources":["../../src/logging-filter.ts"],"names":[],"mappings":"AAwBA,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAA2B;IAC1D,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjC,QAAQ,IAAI,CAAC;gBACX,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3C,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/esm/logging.d.ts

@@ -0,0 +1,59 @@
+import { type CfnLoggingConfigurationProps, type CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+import type { IConstruct } from "constructs";
+import { type Resolvable } from "@composurecdk/core";
+import { type ILogGroupBuilder } from "@composurecdk/logs";
+import { type WebAclLoggingFilter } from "./logging-filter.js";
+import type { WebAclBuilderResult } from "./web-acl-builder.js";
+/** Request fields to redact from the log. */
+export interface WebAclLogRedaction {
+    /**
+     * Header names to redact, **in addition to** `authorization` and `cookie`,
+     * which are always redacted.
+     */
+    readonly headers?: readonly string[];
+    /** Redact the query string. */
+    readonly queryString?: boolean;
+    /** Redact the URI path. */
+    readonly uriPath?: boolean;
+    /** Redact the HTTP method. */
+    readonly method?: boolean;
+}
+/**
+ * Configures the web ACL's logging. On by default: WAF writes the requests it
+ * does not allow to a created `aws-waf-logs-` CloudWatch log group, with the
+ * `authorization` and `cookie` headers redacted. `false` turns it off.
+ */
+export interface WebAclLoggingConfig {
+    /**
+     * Customize the created log group. It starts with an `aws-waf-logs-` name,
+     * which WAF requires, and the `@composurecdk/logs` retention and removal
+     * defaults. The callback's builder resolves `ref`s against the build
+     * context. Cannot be combined with {@link destination}.
+     */
+    readonly configure?: (b: ILogGroupBuilder) => ILogGroupBuilder;
+    /**
+     * Log to an existing destination instead of a created log group: a
+     * CloudWatch log group, S3 bucket or Firehose stream ARN, or a reference
+     * CDK's `CfnLoggingConfiguration` accepts. Its name must start with
+     * `aws-waf-logs-`, a log group ARN must not end in `:*`, an S3 bucket must
+     * use SSE-S3 or a customer managed key, and a Firehose stream must be
+     * DirectPut. Cannot be combined with {@link configure}.
+     */
+    readonly destination?: Resolvable<NonNullable<CfnLoggingConfigurationProps["logDestinationConfigs"]>[number]>;
+    /**
+     * Which requests to log. `"non-allow"`, the default, keeps every request
+     * WAF blocks, counts, or answers with a CAPTCHA or challenge, and drops the
+     * rest. `"all"` keeps everything.
+     */
+    readonly filter?: "non-allow" | "all" | WebAclLoggingFilter;
+    /** Fields to redact, merged with the defaults. */
+    readonly redact?: WebAclLogRedaction;
+}
+/**
+ * Creates the web ACL's logging configuration and, unless a destination was
+ * given, its log group.
+ *
+ * @internal
+ */
+export declare function configureLogging(scope: IConstruct, id: string, owner: string, webAcl: CfnWebACL, config: WebAclLoggingConfig | false, context: Record<string, object>): Pick<WebAclBuilderResult, "logGroup" | "logging">;
+//# sourceMappingURL=logging.d.ts.map

package/dist/esm/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/logging.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,SAAS,EACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMlF,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+BAA+B;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,gBAAgB,CAAC;IAE/D;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAC/B,WAAW,CAAC,4BAA4B,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAC3E,CAAC;IAEF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,GAAG,mBAAmB,CAAC;IAE5D,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAwED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,mBAAmB,GAAG,KAAK,EACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,IAAI,CAAC,mBAAmB,EAAE,UAAU,GAAG,SAAS,CAAC,CAwBnD"}

package/dist/esm/logging.js

@@ -0,0 +1,88 @@
+import { ArnFormat, Token } from "aws-cdk-lib";
+import { CfnLoggingConfiguration, } from "aws-cdk-lib/aws-wafv2";
+import { resolve } from "@composurecdk/core";
+import { createLogGroupBuilder } from "@composurecdk/logs";
+import { DEFAULT_LOGGING_FILTER, DEFAULT_LOGGING_REDACTED_HEADERS, WAF_LOG_GROUP_NAME_PREFIX, } from "./defaults.js";
+import { toFilterProperty } from "./logging-filter.js";
+import { webAclBaseName } from "./names.js";
+const MAX_REDACTED_FIELDS = 100;
+const LOGGING_SOURCE = "https://docs.aws.amazon.com/waf/latest/developerguide/logging.html";
+function loggingFilter(filter) {
+    if (filter === "all")
+        return undefined;
+    return toFilterProperty(typeof filter === "object" ? filter : DEFAULT_LOGGING_FILTER);
+}
+function redactedFields(owner, redact) {
+    const headers = new Map();
+    for (const name of [...DEFAULT_LOGGING_REDACTED_HEADERS, ...(redact?.headers ?? [])]) {
+        headers.set(name.toLowerCase(), name);
+    }
+    // `FieldToMatch`'s members are `any` in CDK, so `SingleHeader` needs CloudFormation's `Name`.
+    const fields = [...headers.values()].map((Name) => ({ singleHeader: { Name } }));
+    if (redact?.queryString)
+        fields.push({ queryString: {} });
+    if (redact?.uriPath)
+        fields.push({ uriPath: {} });
+    if (redact?.method)
+        fields.push({ method: {} });
+    if (fields.length > MAX_REDACTED_FIELDS) {
+        throw new Error(`${owner}: logging redacts ${String(fields.length)} fields; AWS WAF allows at most ${String(MAX_REDACTED_FIELDS)}. See ${LOGGING_SOURCE}.`);
+    }
+    return fields;
+}
+function checkLogGroupName(owner, name) {
+    // The builder always seeds a name, but `configure` can replace it with a token.
+    if (name === undefined || Token.isUnresolved(name))
+        return;
+    if (!name.startsWith(WAF_LOG_GROUP_NAME_PREFIX)) {
+        throw new Error(`${owner}: the WAF log group is named "${name}", but AWS WAF only logs to log groups ` +
+            `whose names start with "${WAF_LOG_GROUP_NAME_PREFIX}". Rename it, or leave the ` +
+            `name to the builder. See ${LOGGING_SOURCE}.`);
+    }
+}
+/**
+ * Creates the WAF log group and returns it with the ARN WAF accepts for it.
+ */
+function createLogGroup(scope, id, owner, webAcl, configure, context) {
+    let builder = createLogGroupBuilder().logGroupName(`${WAF_LOG_GROUP_NAME_PREFIX}${webAclBaseName(webAcl)}`);
+    if (configure)
+        builder = configure(builder);
+    checkLogGroupName(owner, builder.logGroupName());
+    const logGroup = builder.build(scope, `${id}Logs`, context).logGroup;
+    // WAF rejects the `:*` that `logGroupArn` ends in.
+    const arn = logGroup.stack.formatArn({
+        service: "logs",
+        resource: "log-group",
+        resourceName: logGroup.logGroupName,
+        arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+    });
+    return { logGroup, arn };
+}
+/**
+ * Creates the web ACL's logging configuration and, unless a destination was
+ * given, its log group.
+ *
+ * @internal
+ */
+export function configureLogging(scope, id, owner, webAcl, config, context) {
+    if (config === false)
+        return {};
+    const { configure, destination, filter, redact } = config;
+    if (configure !== undefined && destination !== undefined) {
+        throw new Error(`${owner}: logging 'configure' cannot be combined with 'destination' — the ` +
+            `destination is user-managed and not built by this builder.`);
+    }
+    const { logGroup, arn } = destination === undefined
+        ? createLogGroup(scope, id, owner, webAcl, configure, context)
+        : { logGroup: undefined, arn: resolve(destination, context) };
+    const logging = new CfnLoggingConfiguration(scope, `${id}Logging`, {
+        resourceArn: webAcl.attrArn,
+        logDestinationConfigs: [arn],
+        loggingFilter: loggingFilter(filter),
+        redactedFields: redactedFields(owner, redact),
+    });
+    if (logGroup)
+        logging.node.addDependency(logGroup);
+    return { logGroup, logging };
+}
+//# sourceMappingURL=logging.js.map

package/dist/esm/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../src/logging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EACL,uBAAuB,GAGxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAA4B,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAuD5C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,SAAS,aAAa,CAAC,MAAqC;IAC1D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,gBAAgB,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,MAAsC;IAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,gCAAgC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,8FAA8F;IAC9F,MAAM,MAAM,GAAmD,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CACtF,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CACvC,CAAC;IACF,IAAI,MAAM,EAAE,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,qBAAqB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mCAAmC,MAAM,CAAC,mBAAmB,CAAC,SAAS,cAAc,GAAG,CAC3I,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,IAAwB;IAChE,gFAAgF;IAChF,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO;IAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iCAAiC,IAAI,yCAAyC;YACpF,2BAA2B,yBAAyB,6BAA6B;YACjF,4BAA4B,cAAc,GAAG,CAChD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,KAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAAiB,EACjB,SAA2C,EAC3C,OAA+B;IAE/B,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC,YAAY,CAChD,GAAG,yBAAyB,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CACxD,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACrE,mDAAmD;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,SAAS,EAAE,SAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAiB,EACjB,EAAU,EACV,KAAa,EACb,MAAiB,EACjB,MAAmC,EACnC,OAA+B;IAE/B,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1D,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,oEAAoE;YAC1E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GACrB,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;QAC9D,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;QACjE,WAAW,EAAE,MAAM,CAAC,OAAO;QAC3B,qBAAqB,EAAE,CAAC,GAAG,CAAC;QAC5B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC;QACpC,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/esm/metrics.d.ts

@@ -0,0 +1,58 @@
+import { Duration } from "aws-cdk-lib";
+import { Metric, type MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import type { CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+/**
+ * The request-count metrics WAF publishes for a web ACL, a rule, or the
+ * default action. Each is a Sum over 5 minutes unless `options` say
+ * otherwise. WAF publishes a datapoint only when the count is non-zero.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html
+ */
+export interface WebAclRequestMetrics {
+    allowedRequests(options?: MetricOptions): Metric;
+    blockedRequests(options?: MetricOptions): Metric;
+    countedRequests(options?: MetricOptions): Metric;
+    captchaRequests(options?: MetricOptions): Metric;
+    challengeRequests(options?: MetricOptions): Metric;
+}
+/**
+ * The metrics of a web ACL, with dimensions built from the names the builder
+ * gave it and its rules, so they match what WAF publishes. The top-level
+ * metrics cover every rule (`Rule=ALL`).
+ */
+export interface WebAclMetrics extends WebAclRequestMetrics {
+    /** Requests no rule terminated, which the default action decided. */
+    readonly defaultAction: WebAclRequestMetrics;
+    /**
+     * The metrics of one rule, by the name given to `addRule`.
+     *
+     * @throws when the web ACL has no rule of that name.
+     */
+    rule(name: string): WebAclRequestMetrics;
+    /**
+     * Days until a pinned managed rule group version expires. Published only
+     * for a group the web ACL uses at that version.
+     *
+     * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-using-managed-rule-groups-expiration.html
+     */
+    daysToExpiry(group: ManagedRuleGroupVersion, options?: MetricOptions): Metric;
+}
+/** A managed rule group at a pinned version. */
+export interface ManagedRuleGroupVersion {
+    readonly vendorName: string;
+    readonly name: string;
+    readonly version: string;
+}
+/** @internal — the period of every request metric unless overridden. */
+export declare const REQUEST_METRIC_PERIOD: Duration;
+/**
+ * Builds a web ACL's {@link WebAclMetrics}.
+ *
+ * @param metricName - The web ACL's own metric name, which WAF publishes the
+ *   default action's metrics under as the `Rule` dimension.
+ * @param ruleMetricNames - Each rule's metric name, by rule name.
+ *
+ * @internal
+ */
+export declare function webAclMetrics(webAcl: CfnWebACL, metricName: string, ruleMetricNames: ReadonlyMap<string, string>): WebAclMetrics;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/esm/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAoB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAS,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACjD,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACjD,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACjD,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACjD,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CACpD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAE7C;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAEzC;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC/E;AAED,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAGD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,UAAsB,CAAC;AAezD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3C,aAAa,CA8Cf"}

package/dist/esm/metrics.js

@@ -0,0 +1,63 @@
+import { Duration, Fn, Stack, Token } from "aws-cdk-lib";
+import { Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+const NAMESPACE = "AWS/WAFV2";
+/** @internal — the period of every request metric unless overridden. */
+export const REQUEST_METRIC_PERIOD = Duration.minutes(5);
+const ALL_RULES = "ALL";
+/**
+ * The value of a web ACL's `WebACL` dimension: its name. WAF publishes the
+ * name here, not the `VisibilityConfig` metric name the documentation
+ * describes. A web ACL without a literal name reads it from `Ref`, which is
+ * `name|id|scope`.
+ */
+function webAclDimension(webAcl) {
+    const { name } = webAcl;
+    if (name !== undefined && !Token.isUnresolved(name))
+        return name;
+    return Fn.select(0, Fn.split("|", webAcl.ref));
+}
+/**
+ * Builds a web ACL's {@link WebAclMetrics}.
+ *
+ * @param metricName - The web ACL's own metric name, which WAF publishes the
+ *   default action's metrics under as the `Rule` dimension.
+ * @param ruleMetricNames - Each rule's metric name, by rule name.
+ *
+ * @internal
+ */
+export function webAclMetrics(webAcl, metricName, ruleMetricNames) {
+    // CloudFront metrics have no `Region` dimension.
+    const regionDimension = webAcl.scope === "CLOUDFRONT" ? {} : { Region: Stack.of(webAcl).region };
+    const webAclName = webAclDimension(webAcl);
+    const metric = (name, dimensionsMap, options) => new Metric({
+        namespace: NAMESPACE,
+        metricName: name,
+        statistic: Stats.SUM,
+        period: REQUEST_METRIC_PERIOD,
+        ...options,
+        dimensionsMap: { ...dimensionsMap, ...regionDimension, ...options?.dimensionsMap },
+    });
+    const requests = (rule) => {
+        const dimensions = { WebACL: webAclName, Rule: rule };
+        return {
+            allowedRequests: (o) => metric("AllowedRequests", dimensions, o),
+            blockedRequests: (o) => metric("BlockedRequests", dimensions, o),
+            countedRequests: (o) => metric("CountedRequests", dimensions, o),
+            captchaRequests: (o) => metric("CaptchaRequests", dimensions, o),
+            challengeRequests: (o) => metric("ChallengeRequests", dimensions, o),
+        };
+    };
+    return {
+        ...requests(ALL_RULES),
+        defaultAction: requests(metricName),
+        rule: (name) => {
+            const ruleMetricName = ruleMetricNames.get(name);
+            if (ruleMetricName === undefined) {
+                throw new Error(`The web ACL has no rule named "${name}". Rules: ${[...ruleMetricNames.keys()].join(", ") || "none"}.`);
+            }
+            return requests(ruleMetricName);
+        },
+        daysToExpiry: (group, options) => metric("DaysToExpiry", { Vendor: group.vendorName, ManagedRuleGroup: group.name, Version: group.version }, { statistic: Stats.MINIMUM, period: Duration.hours(1), ...options }),
+    };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/esm/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,MAAM,EAAsB,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAkD/E,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAiB;IACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,UAAkB,EAClB,eAA4C;IAE5C,iDAAiD;IACjD,MAAM,eAAe,GACnB,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,aAAqC,EAAE,OAAuB,EAAE,EAAE,CAC9F,IAAI,MAAM,CAAC;QACT,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,GAAG;QACpB,MAAM,EAAE,qBAAqB;QAC7B,GAAG,OAAO;QACV,aAAa,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE;KACnF,CAAC,CAAC;IAEL,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAwB,EAAE;QACtD,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACtD,OAAO;YACL,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;YAChE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;YAChE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;YAChE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;YAChE,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC;SACrE,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,QAAQ,CAAC,SAAS,CAAC;QACtB,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACb,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,aAAa,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CACvG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAC/B,MAAM,CACJ,cAAc,EACd,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAClF,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CACpE;KACJ,CAAC;AACJ,CAAC"}

package/dist/esm/names.d.ts

@@ -0,0 +1,46 @@
+import type { CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+/**
+ * Validates a web ACL name.
+ *
+ * @throws on invalid input.
+ */
+export declare function validateWebAclName(raw: string): void;
+/**
+ * Validates the name of a rule in a web ACL.
+ *
+ * @throws on invalid input.
+ */
+export declare function validateRuleName(raw: string): void;
+/**
+ * Validates a CloudWatch metric name for a web ACL or rule. `All` and
+ * `Default_Action` are rejected: WAF uses them for its own metrics.
+ *
+ * @throws on invalid input.
+ */
+export declare function validateMetricName(raw: string): void;
+/**
+ * The web ACL's name when it is a literal, and otherwise a name derived from
+ * its construct path, unique in the app. The base of its default metric and
+ * log group names.
+ *
+ * @internal
+ */
+export declare function webAclBaseName(webAcl: CfnWebACL): string;
+/**
+ * Turns a construct path or other derived string into a legal metric name, for
+ * when the user has not chosen one.
+ *
+ * @internal
+ */
+export declare function sanitizeMetricName(raw: string): string;
+/**
+ * Validates a label a rule adds to matching requests: up to five
+ * colon-separated namespaces and a name, each 1–128 characters of
+ * `[A-Za-z0-9_-]`, none of them one of WAF's reserved words. WAF adds the
+ * `awswaf:<account>:webacl:<name>:` prefix itself, so it is not part of the
+ * label.
+ *
+ * @throws on invalid input.
+ */
+export declare function validateRuleLabel(raw: string): void;
+//# sourceMappingURL=names.d.ts.map