aws-cdk-lib 2.181.1__py3-none-any.whl → 2.183.0__py3-none-any.whl

aws_cdk/aws_wafv2/__init__.py

@@ -1987,6 +1987,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2064,6 +2067,12 @@ class CfnRuleGroup(
                             ),
                             http_method=http_method,
                             ip=ip,
+                            ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                 namespace="namespace"
                             ),
@@ -2121,6 +2130,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2172,6 +2184,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2222,6 +2237,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2272,6 +2290,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2324,6 +2345,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -2791,6 +2815,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -2868,6 +2895,12 @@ class CfnRuleGroup(
                                 ),
                                 http_method=http_method,
                                 ip=ip,
+                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                     namespace="namespace"
                                 ),
@@ -2925,6 +2958,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -2976,6 +3012,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -3026,6 +3065,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -3076,6 +3118,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -3128,6 +3173,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -3398,6 +3446,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -4400,6 +4451,7 @@ class CfnRuleGroup(
             "cookies": "cookies",
             "headers": "headers",
             "ja3_fingerprint": "ja3Fingerprint",
+            "ja4_fingerprint": "ja4Fingerprint",
             "json_body": "jsonBody",
             "method": "method",
             "query_string": "queryString",
@@ -4417,6 +4469,7 @@ class CfnRuleGroup(
             cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.CookiesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.HeadersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.JA3FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.JA4FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             json_body: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.JsonBodyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             method: typing.Any = None,
             query_string: typing.Any = None,
@@ -4446,6 +4499,7 @@ class CfnRuleGroup(
             :param cookies: Inspect the request cookies. You must configure scope and pattern matching filters in the ``Cookies`` object, to define the set of cookies and the parts of the cookies that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the ``Cookies`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param headers: Inspect the request headers. You must configure scope and pattern matching filters in the ``Headers`` object, to define the set of headers to and the parts of the headers that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the ``Headers`` object. AWS WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
             :param ja3_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA3 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+            :param ja4_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
             :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
             :param method: Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
             :param query_string: Inspect the query string. This is the part of a URL that appears after a ``?`` character, if any.
@@ -4496,6 +4550,9 @@ class CfnRuleGroup(
                     ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                         fallback_behavior="fallbackBehavior"
                     ),
+                    ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                         match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                             all=all,
@@ -4521,6 +4578,7 @@ class CfnRuleGroup(
                 check_type(argname="argument cookies", value=cookies, expected_type=type_hints["cookies"])
                 check_type(argname="argument headers", value=headers, expected_type=type_hints["headers"])
                 check_type(argname="argument ja3_fingerprint", value=ja3_fingerprint, expected_type=type_hints["ja3_fingerprint"])
+                check_type(argname="argument ja4_fingerprint", value=ja4_fingerprint, expected_type=type_hints["ja4_fingerprint"])
                 check_type(argname="argument json_body", value=json_body, expected_type=type_hints["json_body"])
                 check_type(argname="argument method", value=method, expected_type=type_hints["method"])
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
@@ -4538,6 +4596,8 @@ class CfnRuleGroup(
                 self._values["headers"] = headers
             if ja3_fingerprint is not None:
                 self._values["ja3_fingerprint"] = ja3_fingerprint
+            if ja4_fingerprint is not None:
+                self._values["ja4_fingerprint"] = ja4_fingerprint
             if json_body is not None:
                 self._values["json_body"] = json_body
             if method is not None:
@@ -4630,6 +4690,26 @@ class CfnRuleGroup(
             result = self._values.get("ja3_fingerprint")
             return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.JA3FingerprintProperty"]], result)
 
+        @builtins.property
+        def ja4_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.JA4FingerprintProperty"]]:
+            '''Available for use with Amazon CloudFront distributions and Application Load Balancers.
+
+            Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
+            .. epigraph::
+
+               You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` .
+
+            You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* .
+
+            Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-fieldtomatch.html#cfn-wafv2-rulegroup-fieldtomatch-ja4fingerprint
+            '''
+            result = self._values.get("ja4_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.JA4FingerprintProperty"]], result)
+
         @builtins.property
         def json_body(
             self,
@@ -5468,6 +5548,72 @@ class CfnRuleGroup(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.JA4FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class JA4FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Available for use with Amazon CloudFront distributions and Application Load Balancers.
+
+            Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
+            .. epigraph::
+
+               You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` .
+
+            You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* .
+
+            Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+
+            :param fallback_behavior: The match status to assign to the web request if the request doesn't have a JA4 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ja4fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                j_a4_fingerprint_property = wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__98d25072bace816c3ee0005576dfb4321dc85cb549d85f10845ec1379f11441b)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if the request doesn't have a JA4 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ja4fingerprint.html#cfn-wafv2-rulegroup-ja4fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "JA4FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.JsonBodyProperty",
         jsii_struct_bases=[],
@@ -5958,6 +6104,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6033,6 +6182,12 @@ class CfnRuleGroup(
                                 ),
                                 http_method=http_method,
                                 ip=ip,
+                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                     namespace="namespace"
                                 ),
@@ -6090,6 +6245,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6141,6 +6299,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6191,6 +6352,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6241,6 +6405,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6293,6 +6460,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6421,6 +6591,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6496,6 +6669,12 @@ class CfnRuleGroup(
                                 ),
                                 http_method=http_method,
                                 ip=ip,
+                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                     namespace="namespace"
                                 ),
@@ -6553,6 +6732,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6604,6 +6786,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6654,6 +6839,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6704,6 +6892,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6756,6 +6947,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -6822,6 +7016,8 @@ class CfnRuleGroup(
             "header": "header",
             "http_method": "httpMethod",
             "ip": "ip",
+            "ja3_fingerprint": "ja3Fingerprint",
+            "ja4_fingerprint": "ja4Fingerprint",
             "label_namespace": "labelNamespace",
             "query_argument": "queryArgument",
             "query_string": "queryString",
@@ -6837,6 +7033,8 @@ class CfnRuleGroup(
             header: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitHeaderProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             http_method: typing.Any = None,
             ip: typing.Any = None,
+            ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitJA3FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitJA4FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             label_namespace: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitLabelNamespaceProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             query_argument: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitQueryArgumentProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             query_string: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.RateLimitQueryStringProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -6853,6 +7051,8 @@ class CfnRuleGroup(
             :param header: Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
             :param http_method: Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
             :param ip: Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying ``IP`` in your rate-based statement's ``AggregateKeyType`` .
+            :param ja3_fingerprint: Use the request's JA3 fingerprint as an aggregate key. If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+            :param ja4_fingerprint: Use the request's JA4 fingerprint as an aggregate key. If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
             :param label_namespace: Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see `Label syntax and naming requirements <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html>`_ in the *AWS WAF Developer Guide* .
             :param query_argument: Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
             :param query_string: Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
@@ -6889,6 +7089,12 @@ class CfnRuleGroup(
                     ),
                     http_method=http_method,
                     ip=ip,
+                    ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
+                    ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                         namespace="namespace"
                     ),
@@ -6920,6 +7126,8 @@ class CfnRuleGroup(
                 check_type(argname="argument header", value=header, expected_type=type_hints["header"])
                 check_type(argname="argument http_method", value=http_method, expected_type=type_hints["http_method"])
                 check_type(argname="argument ip", value=ip, expected_type=type_hints["ip"])
+                check_type(argname="argument ja3_fingerprint", value=ja3_fingerprint, expected_type=type_hints["ja3_fingerprint"])
+                check_type(argname="argument ja4_fingerprint", value=ja4_fingerprint, expected_type=type_hints["ja4_fingerprint"])
                 check_type(argname="argument label_namespace", value=label_namespace, expected_type=type_hints["label_namespace"])
                 check_type(argname="argument query_argument", value=query_argument, expected_type=type_hints["query_argument"])
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
@@ -6935,6 +7143,10 @@ class CfnRuleGroup(
                 self._values["http_method"] = http_method
             if ip is not None:
                 self._values["ip"] = ip
+            if ja3_fingerprint is not None:
+                self._values["ja3_fingerprint"] = ja3_fingerprint
+            if ja4_fingerprint is not None:
+                self._values["ja4_fingerprint"] = ja4_fingerprint
             if label_namespace is not None:
                 self._values["label_namespace"] = label_namespace
             if query_argument is not None:
@@ -7007,6 +7219,32 @@ class CfnRuleGroup(
             result = self._values.get("ip")
             return typing.cast(typing.Any, result)
 
+        @builtins.property
+        def ja3_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.RateLimitJA3FingerprintProperty"]]:
+            '''Use the request's JA3 fingerprint as an aggregate key.
+
+            If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratebasedstatementcustomkey.html#cfn-wafv2-rulegroup-ratebasedstatementcustomkey-ja3fingerprint
+            '''
+            result = self._values.get("ja3_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.RateLimitJA3FingerprintProperty"]], result)
+
+        @builtins.property
+        def ja4_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.RateLimitJA4FingerprintProperty"]]:
+            '''Use the request's JA4 fingerprint as an aggregate key.
+
+            If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratebasedstatementcustomkey.html#cfn-wafv2-rulegroup-ratebasedstatementcustomkey-ja4fingerprint
+            '''
+            result = self._values.get("ja4_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.RateLimitJA4FingerprintProperty"]], result)
+
         @builtins.property
         def label_namespace(
             self,
@@ -7192,6 +7430,12 @@ class CfnRuleGroup(
                         ),
                         http_method=http_method,
                         ip=ip,
+                        ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                             namespace="namespace"
                         ),
@@ -7251,6 +7495,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7333,6 +7580,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7384,6 +7634,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7434,6 +7687,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7484,6 +7740,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7536,6 +7795,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -7861,6 +8123,124 @@ class CfnRuleGroup(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class RateLimitJA3FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Use the request's JA3 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
+
+            If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :param fallback_behavior: The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA3 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratelimitja3fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                rate_limit_jA3_fingerprint_property = wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__01cbbd4025c041374160f1ace2284204fed871076ebb05f8dbb9425055cf3060)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA3 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratelimitja3fingerprint.html#cfn-wafv2-rulegroup-ratelimitja3fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "RateLimitJA3FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class RateLimitJA4FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Use the request's JA4 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
+
+            If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :param fallback_behavior: The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA4 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratelimitja4fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                rate_limit_jA4_fingerprint_property = wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__7133c91d3834ea8b9f0c3938b2bfa71b20890314ee89527acbfc32927f991d59)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA4 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-ratelimitja4fingerprint.html#cfn-wafv2-rulegroup-ratelimitja4fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "RateLimitJA4FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty",
         jsii_struct_bases=[],
@@ -8196,6 +8576,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -8350,6 +8733,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -8673,6 +9059,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -8750,6 +9139,12 @@ class CfnRuleGroup(
                                 ),
                                 http_method=http_method,
                                 ip=ip,
+                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                     namespace="namespace"
                                 ),
@@ -8807,6 +9202,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -8858,6 +9256,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -8908,6 +9309,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -8958,6 +9362,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -9010,6 +9417,9 @@ class CfnRuleGroup(
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -9409,6 +9819,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -9572,6 +9985,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -9767,6 +10183,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -9844,6 +10263,12 @@ class CfnRuleGroup(
                             ),
                             http_method=http_method,
                             ip=ip,
+                            ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                 namespace="namespace"
                             ),
@@ -9901,6 +10326,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -9952,6 +10380,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -10002,6 +10433,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -10052,6 +10486,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -10104,6 +10541,9 @@ class CfnRuleGroup(
                             ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                 fallback_behavior="fallbackBehavior"
                             ),
+                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                 match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                     all=all,
@@ -10649,6 +11089,9 @@ class CfnRuleGroup(
                         ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                             match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                 all=all,
@@ -10847,6 +11290,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -10924,6 +11370,12 @@ class CfnRuleGroupProps:
                                 ),
                                 http_method=http_method,
                                 ip=ip,
+                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
                                     namespace="namespace"
                                 ),
@@ -10981,6 +11433,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -11032,6 +11487,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -11082,6 +11540,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -11132,6 +11593,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -11184,6 +11648,9 @@ class CfnRuleGroupProps:
                                 ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
                                     fallback_behavior="fallbackBehavior"
                                 ),
+                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
                                     match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
                                         all=all,
@@ -12631,6 +13098,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -13882,6 +14352,7 @@ class CfnWebACL(
             "cookies": "cookies",
             "headers": "headers",
             "ja3_fingerprint": "ja3Fingerprint",
+            "ja4_fingerprint": "ja4Fingerprint",
             "json_body": "jsonBody",
             "method": "method",
             "query_string": "queryString",
@@ -13899,6 +14370,7 @@ class CfnWebACL(
             cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.CookiesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.HeadersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.JA3FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.JA4FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             json_body: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.JsonBodyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             method: typing.Any = None,
             query_string: typing.Any = None,
@@ -13928,6 +14400,7 @@ class CfnWebACL(
             :param cookies: Inspect the request cookies. You must configure scope and pattern matching filters in the ``Cookies`` object, to define the set of cookies and the parts of the cookies that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the ``Cookies`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param headers: Inspect the request headers. You must configure scope and pattern matching filters in the ``Headers`` object, to define the set of headers to and the parts of the headers that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the ``Headers`` object. AWS WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
             :param ja3_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA3 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+            :param ja4_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
             :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
             :param method: Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
             :param query_string: Inspect the query string. This is the part of a URL that appears after a ``?`` character, if any.
@@ -13978,6 +14451,9 @@ class CfnWebACL(
                     ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                         fallback_behavior="fallbackBehavior"
                     ),
+                    ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     json_body=wafv2.CfnWebACL.JsonBodyProperty(
                         match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                             all=all,
@@ -14003,6 +14479,7 @@ class CfnWebACL(
                 check_type(argname="argument cookies", value=cookies, expected_type=type_hints["cookies"])
                 check_type(argname="argument headers", value=headers, expected_type=type_hints["headers"])
                 check_type(argname="argument ja3_fingerprint", value=ja3_fingerprint, expected_type=type_hints["ja3_fingerprint"])
+                check_type(argname="argument ja4_fingerprint", value=ja4_fingerprint, expected_type=type_hints["ja4_fingerprint"])
                 check_type(argname="argument json_body", value=json_body, expected_type=type_hints["json_body"])
                 check_type(argname="argument method", value=method, expected_type=type_hints["method"])
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
@@ -14020,6 +14497,8 @@ class CfnWebACL(
                 self._values["headers"] = headers
             if ja3_fingerprint is not None:
                 self._values["ja3_fingerprint"] = ja3_fingerprint
+            if ja4_fingerprint is not None:
+                self._values["ja4_fingerprint"] = ja4_fingerprint
             if json_body is not None:
                 self._values["json_body"] = json_body
             if method is not None:
@@ -14112,6 +14591,26 @@ class CfnWebACL(
             result = self._values.get("ja3_fingerprint")
             return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.JA3FingerprintProperty"]], result)
 
+        @builtins.property
+        def ja4_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.JA4FingerprintProperty"]]:
+            '''Available for use with Amazon CloudFront distributions and Application Load Balancers.
+
+            Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
+            .. epigraph::
+
+               You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` .
+
+            You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* .
+
+            Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-fieldtomatch.html#cfn-wafv2-webacl-fieldtomatch-ja4fingerprint
+            '''
+            result = self._values.get("ja4_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.JA4FingerprintProperty"]], result)
+
         @builtins.property
         def json_body(
             self,
@@ -14950,6 +15449,72 @@ class CfnWebACL(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.JA4FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class JA4FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Available for use with Amazon CloudFront distributions and Application Load Balancers.
+
+            Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
+            .. epigraph::
+
+               You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` .
+
+            You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* .
+
+            Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
+
+            :param fallback_behavior: The match status to assign to the web request if the request doesn't have a JA4 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ja4fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                j_a4_fingerprint_property = wafv2.CfnWebACL.JA4FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__d291ee91c69174f3c85a4f366df59f9a94555bb2191f94bfec169a28f40438d6)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if the request doesn't have a JA4 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ja4fingerprint.html#cfn-wafv2-webacl-ja4fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "JA4FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.JsonBodyProperty",
         jsii_struct_bases=[],
@@ -15980,6 +16545,8 @@ class CfnWebACL(
             "header": "header",
             "http_method": "httpMethod",
             "ip": "ip",
+            "ja3_fingerprint": "ja3Fingerprint",
+            "ja4_fingerprint": "ja4Fingerprint",
             "label_namespace": "labelNamespace",
             "query_argument": "queryArgument",
             "query_string": "queryString",
@@ -15995,6 +16562,8 @@ class CfnWebACL(
             header: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitHeaderProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             http_method: typing.Any = None,
             ip: typing.Any = None,
+            ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitJA3FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitJA4FingerprintProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             label_namespace: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitLabelNamespaceProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             query_argument: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitQueryArgumentProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             query_string: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.RateLimitQueryStringProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -16011,6 +16580,8 @@ class CfnWebACL(
             :param header: Use the value of a header in the request as an aggregate key. Each distinct value in the header contributes to the aggregation instance. If you use a single header as your custom key, then each value fully defines an aggregation instance.
             :param http_method: Use the request's HTTP method as an aggregate key. Each distinct HTTP method contributes to the aggregation instance. If you use just the HTTP method as your custom key, then each method fully defines an aggregation instance.
             :param ip: Use the request's originating IP address as an aggregate key. Each distinct IP address contributes to the aggregation instance. When you specify an IP or forwarded IP in the custom key settings, you must also specify at least one other key to use. You can aggregate on only the IP address by specifying ``IP`` in your rate-based statement's ``AggregateKeyType`` .
+            :param ja3_fingerprint: Use the request's JA3 fingerprint as an aggregate key. If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+            :param ja4_fingerprint: Use the request's JA4 fingerprint as an aggregate key. If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
             :param label_namespace: Use the specified label namespace as an aggregate key. Each distinct fully qualified label name that has the specified label namespace contributes to the aggregation instance. If you use just one label namespace as your custom key, then each label name fully defines an aggregation instance. This uses only labels that have been added to the request by rules that are evaluated before this rate-based rule in the web ACL. For information about label namespaces and names, see `Label syntax and naming requirements <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-label-requirements.html>`_ in the *AWS WAF Developer Guide* .
             :param query_argument: Use the specified query argument as an aggregate key. Each distinct value for the named query argument contributes to the aggregation instance. If you use a single query argument as your custom key, then each value fully defines an aggregation instance.
             :param query_string: Use the request's query string as an aggregate key. Each distinct string contributes to the aggregation instance. If you use just the query string as your custom key, then each string fully defines an aggregation instance.
@@ -16047,6 +16618,12 @@ class CfnWebACL(
                     ),
                     http_method=http_method,
                     ip=ip,
+                    ja3_fingerprint=wafv2.CfnWebACL.RateLimitJA3FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
+                    ja4_fingerprint=wafv2.CfnWebACL.RateLimitJA4FingerprintProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     label_namespace=wafv2.CfnWebACL.RateLimitLabelNamespaceProperty(
                         namespace="namespace"
                     ),
@@ -16078,6 +16655,8 @@ class CfnWebACL(
                 check_type(argname="argument header", value=header, expected_type=type_hints["header"])
                 check_type(argname="argument http_method", value=http_method, expected_type=type_hints["http_method"])
                 check_type(argname="argument ip", value=ip, expected_type=type_hints["ip"])
+                check_type(argname="argument ja3_fingerprint", value=ja3_fingerprint, expected_type=type_hints["ja3_fingerprint"])
+                check_type(argname="argument ja4_fingerprint", value=ja4_fingerprint, expected_type=type_hints["ja4_fingerprint"])
                 check_type(argname="argument label_namespace", value=label_namespace, expected_type=type_hints["label_namespace"])
                 check_type(argname="argument query_argument", value=query_argument, expected_type=type_hints["query_argument"])
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
@@ -16093,6 +16672,10 @@ class CfnWebACL(
                 self._values["http_method"] = http_method
             if ip is not None:
                 self._values["ip"] = ip
+            if ja3_fingerprint is not None:
+                self._values["ja3_fingerprint"] = ja3_fingerprint
+            if ja4_fingerprint is not None:
+                self._values["ja4_fingerprint"] = ja4_fingerprint
             if label_namespace is not None:
                 self._values["label_namespace"] = label_namespace
             if query_argument is not None:
@@ -16165,6 +16748,32 @@ class CfnWebACL(
             result = self._values.get("ip")
             return typing.cast(typing.Any, result)
 
+        @builtins.property
+        def ja3_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.RateLimitJA3FingerprintProperty"]]:
+            '''Use the request's JA3 fingerprint as an aggregate key.
+
+            If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratebasedstatementcustomkey.html#cfn-wafv2-webacl-ratebasedstatementcustomkey-ja3fingerprint
+            '''
+            result = self._values.get("ja3_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.RateLimitJA3FingerprintProperty"]], result)
+
+        @builtins.property
+        def ja4_fingerprint(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.RateLimitJA4FingerprintProperty"]]:
+            '''Use the request's JA4 fingerprint as an aggregate key.
+
+            If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratebasedstatementcustomkey.html#cfn-wafv2-webacl-ratebasedstatementcustomkey-ja4fingerprint
+            '''
+            result = self._values.get("ja4_fingerprint")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.RateLimitJA4FingerprintProperty"]], result)
+
         @builtins.property
         def label_namespace(
             self,
@@ -16612,6 +17221,124 @@ class CfnWebACL(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitJA3FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class RateLimitJA3FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Use the request's JA3 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
+
+            If you use a single JA3 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :param fallback_behavior: The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA3 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratelimitja3fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                rate_limit_jA3_fingerprint_property = wafv2.CfnWebACL.RateLimitJA3FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__6e8bd22e62b0bf12b8760a47f017961b595e2b5836296741e4be4bc580092564)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA3 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratelimitja3fingerprint.html#cfn-wafv2-webacl-ratelimitja3fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "RateLimitJA3FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitJA4FingerprintProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class RateLimitJA4FingerprintProperty:
+        def __init__(self, *, fallback_behavior: builtins.str) -> None:
+            '''Use the request's JA4 fingerprint derived from the TLS Client Hello of an incoming request as an aggregate key.
+
+            If you use a single JA4 fingerprint as your custom key, then each value fully defines an aggregation instance.
+
+            :param fallback_behavior: The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA4 fingerprint. You can specify the following fallback behaviors: - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratelimitja4fingerprint.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                rate_limit_jA4_fingerprint_property = wafv2.CfnWebACL.RateLimitJA4FingerprintProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__0fb6ee2c595dd2947dc6947a55f9aef69ae22832d84e4a5bdc269461247f50b4)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "fallback_behavior": fallback_behavior,
+            }
+
+        @builtins.property
+        def fallback_behavior(self) -> builtins.str:
+            '''The match status to assign to the web request if there is insufficient TSL Client Hello information to compute the JA4 fingerprint.
+
+            You can specify the following fallback behaviors:
+
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ratelimitja4fingerprint.html#cfn-wafv2-webacl-ratelimitja4fingerprint-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            assert result is not None, "Required property 'fallback_behavior' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "RateLimitJA4FingerprintProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.RateLimitLabelNamespaceProperty",
         jsii_struct_bases=[],
@@ -16947,6 +17674,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -17101,6 +17831,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -19013,6 +19746,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -19176,6 +19912,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -19892,6 +20631,9 @@ class CfnWebACL(
                         ja3_fingerprint=wafv2.CfnWebACL.JA3FingerprintProperty(
                             fallback_behavior="fallbackBehavior"
                         ),
+                        ja4_fingerprint=wafv2.CfnWebACL.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         json_body=wafv2.CfnWebACL.JsonBodyProperty(
                             match_pattern=wafv2.CfnWebACL.JsonMatchPatternProperty(
                                 all=all,
@@ -20955,6 +21697,7 @@ def _typecheckingstub__dcb790c3130e52c64e6b7cf00db86b37d1b54427689c46b6c9e6a7122
     cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.CookiesProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.HeadersProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.JA3FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.JA4FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     json_body: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.JsonBodyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     method: typing.Any = None,
     query_string: typing.Any = None,
@@ -21030,6 +21773,13 @@ def _typecheckingstub__1cba50229767598d7603bfa317a8bd11cfc2b12ca28d38737119d57d5
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__98d25072bace816c3ee0005576dfb4321dc85cb549d85f10845ec1379f11441b(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__602ab3bf019e524b1f85e0a2cdb3225626316719b294dfa66fcfd8b7fc9e7a09(
     *,
     match_pattern: typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.JsonMatchPatternProperty, typing.Dict[builtins.str, typing.Any]]],
@@ -21091,6 +21841,8 @@ def _typecheckingstub__6bc232408309212f7b145d76c0106073269f111e106ab6d74a4d2168f
     header: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitHeaderProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     http_method: typing.Any = None,
     ip: typing.Any = None,
+    ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitJA3FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitJA4FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     label_namespace: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitLabelNamespaceProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     query_argument: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitQueryArgumentProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     query_string: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RateLimitQueryStringProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -21127,6 +21879,20 @@ def _typecheckingstub__fdb02cef74b9bb28719ad3e0dbe3149e38c2bcf0347d4db5a38e8fae7
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__01cbbd4025c041374160f1ace2284204fed871076ebb05f8dbb9425055cf3060(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__7133c91d3834ea8b9f0c3938b2bfa71b20890314ee89527acbfc32927f991d59(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__1b9d57259a6a98849a716499d960fb16a9c2fff26fa8916f287a6d4cbe4a1303(
     *,
     namespace: builtins.str,
@@ -21585,6 +22351,7 @@ def _typecheckingstub__25d147c856e9a8fd64f4cc05856e4813e584f37ef787792ad3c4e0790
     cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.CookiesProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.HeadersProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.JA3FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.JA4FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     json_body: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.JsonBodyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     method: typing.Any = None,
     query_string: typing.Any = None,
@@ -21660,6 +22427,13 @@ def _typecheckingstub__129b51143b193ce4679091a559f9a4073c03a2bccc1ccb884fe1b4dd3
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__d291ee91c69174f3c85a4f366df59f9a94555bb2191f94bfec169a28f40438d6(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b371d01e6e192e377c25d061f5a40b73b3aca7d15781a83f612151eddebe6fa2(
     *,
     match_pattern: typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.JsonMatchPatternProperty, typing.Dict[builtins.str, typing.Any]]],
@@ -21748,6 +22522,8 @@ def _typecheckingstub__2edac52bcb13f69d4349ba55a4d083851908f1dd71831794e88ac043e
     header: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitHeaderProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     http_method: typing.Any = None,
     ip: typing.Any = None,
+    ja3_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitJA3FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ja4_fingerprint: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitJA4FingerprintProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     label_namespace: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitLabelNamespaceProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     query_argument: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitQueryArgumentProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     query_string: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.RateLimitQueryStringProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -21784,6 +22560,20 @@ def _typecheckingstub__da3edefddbc454f4818df98348789f048fa440013638ab8b17bcf3ee2
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__6e8bd22e62b0bf12b8760a47f017961b595e2b5836296741e4be4bc580092564(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__0fb6ee2c595dd2947dc6947a55f9aef69ae22832d84e4a5bdc269461247f50b4(
+    *,
+    fallback_behavior: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__cd332af4365738eada762a2b31aa36cbf28e27c021a06c4030d009ae6e2ec6e8(
     *,
     namespace: builtins.str,