aws-cdk-lib 2.186.0__py3-none-any.whl → 2.188.0__py3-none-any.whl

aws_cdk/aws_wafv2/__init__.py

@@ -1602,7 +1602,7 @@ class CfnRegexPatternSet(
         :param scope_: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param regular_expression_list: The regular expression patterns in the set.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
         :param description: A description of the set that helps with identification.
         :param name: The name of the set. You cannot change the name after you create the set.
         :param tags: Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource. .. epigraph:: To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
@@ -1770,7 +1770,7 @@ class CfnRegexPatternSetProps:
         '''Properties for defining a ``CfnRegexPatternSet``.
 
         :param regular_expression_list: The regular expression patterns in the set.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
         :param description: A description of the set that helps with identification.
         :param name: The name of the set. You cannot change the name after you create the set.
         :param tags: Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource. .. epigraph:: To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
@@ -1829,7 +1829,7 @@ class CfnRegexPatternSetProps:
     def scope(self) -> builtins.str:
         '''Specifies whether this is for an Amazon CloudFront distribution or for a regional application.
 
-        A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
+        For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
         .. epigraph::
 
            For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
@@ -1908,502 +1908,7 @@ class CfnRuleGroup(
 
     Example::
 
-        # The code below shows an example of how to instantiate this type.
-        # The values are placeholders you should change.
-        from aws_cdk import aws_wafv2 as wafv2
-        
-        # all: Any
-        # allow: Any
-        # all_query_arguments: Any
-        # block: Any
-        # captcha: Any
-        # challenge: Any
-        # count: Any
-        # forwarded_ip: Any
-        # http_method: Any
-        # ip: Any
-        # method: Any
-        # query_string: Any
-        # single_header: Any
-        # single_query_argument: Any
-        # statement_property_: wafv2.CfnRuleGroup.StatementProperty
-        # uri_path: Any
-        
-        cfn_rule_group = wafv2.CfnRuleGroup(self, "MyCfnRuleGroup",
-            capacity=123,
-            scope="scope",
-            visibility_config=wafv2.CfnRuleGroup.VisibilityConfigProperty(
-                cloud_watch_metrics_enabled=False,
-                metric_name="metricName",
-                sampled_requests_enabled=False
-            ),
-        
-            # the properties below are optional
-            available_labels=[wafv2.CfnRuleGroup.LabelSummaryProperty(
-                name="name"
-            )],
-            consumed_labels=[wafv2.CfnRuleGroup.LabelSummaryProperty(
-                name="name"
-            )],
-            custom_response_bodies={
-                "custom_response_bodies_key": wafv2.CfnRuleGroup.CustomResponseBodyProperty(
-                    content="content",
-                    content_type="contentType"
-                )
-            },
-            description="description",
-            name="name",
-            rules=[wafv2.CfnRuleGroup.RuleProperty(
-                name="name",
-                priority=123,
-                statement=wafv2.CfnRuleGroup.StatementProperty(
-                    and_statement=wafv2.CfnRuleGroup.AndStatementProperty(
-                        statements=[statement_property_]
-                    ),
-                    byte_match_statement=wafv2.CfnRuleGroup.ByteMatchStatementProperty(
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
-        
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        positional_constraint="positionalConstraint",
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )],
-        
-                        # the properties below are optional
-                        search_string="searchString",
-                        search_string_base64="searchStringBase64"
-                    ),
-                    geo_match_statement=wafv2.CfnRuleGroup.GeoMatchStatementProperty(
-                        country_codes=["countryCodes"],
-                        forwarded_ip_config=wafv2.CfnRuleGroup.ForwardedIPConfigurationProperty(
-                            fallback_behavior="fallbackBehavior",
-                            header_name="headerName"
-                        )
-                    ),
-                    ip_set_reference_statement={
-                        "arn": "arn",
-        
-                        # the properties below are optional
-                        "ip_set_forwarded_ip_config": {
-                            "fallback_behavior": "fallbackBehavior",
-                            "header_name": "headerName",
-                            "position": "position"
-                        }
-                    },
-                    label_match_statement=wafv2.CfnRuleGroup.LabelMatchStatementProperty(
-                        key="key",
-                        scope="scope"
-                    ),
-                    not_statement=wafv2.CfnRuleGroup.NotStatementProperty(
-                        statement=statement_property_
-                    ),
-                    or_statement=wafv2.CfnRuleGroup.OrStatementProperty(
-                        statements=[statement_property_]
-                    ),
-                    rate_based_statement=wafv2.CfnRuleGroup.RateBasedStatementProperty(
-                        aggregate_key_type="aggregateKeyType",
-                        limit=123,
-        
-                        # the properties below are optional
-                        custom_keys=[wafv2.CfnRuleGroup.RateBasedStatementCustomKeyProperty(
-                            cookie=wafv2.CfnRuleGroup.RateLimitCookieProperty(
-                                name="name",
-                                text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                    priority=123,
-                                    type="type"
-                                )]
-                            ),
-                            forwarded_ip=forwarded_ip,
-                            header=wafv2.CfnRuleGroup.RateLimitHeaderProperty(
-                                name="name",
-                                text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                    priority=123,
-                                    type="type"
-                                )]
-                            ),
-                            http_method=http_method,
-                            ip=ip,
-                            ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
-                                namespace="namespace"
-                            ),
-                            query_argument=wafv2.CfnRuleGroup.RateLimitQueryArgumentProperty(
-                                name="name",
-                                text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                    priority=123,
-                                    type="type"
-                                )]
-                            ),
-                            query_string=wafv2.CfnRuleGroup.RateLimitQueryStringProperty(
-                                text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                    priority=123,
-                                    type="type"
-                                )]
-                            ),
-                            uri_path=wafv2.CfnRuleGroup.RateLimitUriPathProperty(
-                                text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                    priority=123,
-                                    type="type"
-                                )]
-                            )
-                        )],
-                        evaluation_window_sec=123,
-                        forwarded_ip_config=wafv2.CfnRuleGroup.ForwardedIPConfigurationProperty(
-                            fallback_behavior="fallbackBehavior",
-                            header_name="headerName"
-                        ),
-                        scope_down_statement=statement_property_
-                    ),
-                    regex_match_statement=wafv2.CfnRuleGroup.RegexMatchStatementProperty(
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
         
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        regex_string="regexString",
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )]
-                    ),
-                    regex_pattern_set_reference_statement=wafv2.CfnRuleGroup.RegexPatternSetReferenceStatementProperty(
-                        arn="arn",
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
-        
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )]
-                    ),
-                    size_constraint_statement=wafv2.CfnRuleGroup.SizeConstraintStatementProperty(
-                        comparison_operator="comparisonOperator",
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
-        
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        size=123,
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )]
-                    ),
-                    sqli_match_statement=wafv2.CfnRuleGroup.SqliMatchStatementProperty(
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
-        
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )],
-        
-                        # the properties below are optional
-                        sensitivity_level="sensitivityLevel"
-                    ),
-                    xss_match_statement=wafv2.CfnRuleGroup.XssMatchStatementProperty(
-                        field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                            all_query_arguments=all_query_arguments,
-                            body=wafv2.CfnRuleGroup.BodyProperty(
-                                oversize_handling="oversizeHandling"
-                            ),
-                            cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                    all=all,
-                                    excluded_cookies=["excludedCookies"],
-                                    included_cookies=["includedCookies"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                    all=all,
-                                    excluded_headers=["excludedHeaders"],
-                                    included_headers=["includedHeaders"]
-                                ),
-                                match_scope="matchScope",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                fallback_behavior="fallbackBehavior"
-                            ),
-                            json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                    all=all,
-                                    included_paths=["includedPaths"]
-                                ),
-                                match_scope="matchScope",
-        
-                                # the properties below are optional
-                                invalid_fallback_behavior="invalidFallbackBehavior",
-                                oversize_handling="oversizeHandling"
-                            ),
-                            method=method,
-                            query_string=query_string,
-                            single_header=single_header,
-                            single_query_argument=single_query_argument,
-                            uri_path=uri_path
-                        ),
-                        text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                            priority=123,
-                            type="type"
-                        )]
-                    )
-                ),
-                visibility_config=wafv2.CfnRuleGroup.VisibilityConfigProperty(
-                    cloud_watch_metrics_enabled=False,
-                    metric_name="metricName",
-                    sampled_requests_enabled=False
-                ),
-        
-                # the properties below are optional
-                action=wafv2.CfnRuleGroup.RuleActionProperty(
-                    allow=allow,
-                    block=block,
-                    captcha=captcha,
-                    challenge=challenge,
-                    count=count
-                ),
-                captcha_config=wafv2.CfnRuleGroup.CaptchaConfigProperty(
-                    immunity_time_property=wafv2.CfnRuleGroup.ImmunityTimePropertyProperty(
-                        immunity_time=123
-                    )
-                ),
-                challenge_config=wafv2.CfnRuleGroup.ChallengeConfigProperty(
-                    immunity_time_property=wafv2.CfnRuleGroup.ImmunityTimePropertyProperty(
-                        immunity_time=123
-                    )
-                ),
-                rule_labels=[wafv2.CfnRuleGroup.LabelProperty(
-                    name="name"
-                )]
-            )],
-            tags=[CfnTag(
-                key="key",
-                value="value"
-            )]
-        )
     '''
 
     def __init__(
@@ -2426,7 +1931,7 @@ class CfnRuleGroup(
         :param scope_: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param capacity: The web ACL capacity units (WCUs) required for this rule group. When you create your own rule group, you define this, and you cannot change it after creation. When you add or modify the rules in a rule group, AWS WAF enforces this limit. AWS WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
         :param visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection.
         :param available_labels: The labels that one or more rules in this rule group add to matching web requests. These labels are defined in the ``RuleLabels`` for a ``Rule`` .
         :param consumed_labels: The labels that one or more rules in this rule group match against in label match statements. These labels are defined in a ``LabelMatchStatement`` specification, in the ``Statement`` definition of a rule.
@@ -2833,6 +2338,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             positional_constraint="positionalConstraint",
@@ -2976,6 +2484,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             regex_string="regexString",
@@ -3030,6 +2541,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -3083,6 +2597,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             size=123,
@@ -3136,6 +2653,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -3191,6 +2711,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -3314,7 +2837,7 @@ class CfnRuleGroup(
 
             This is used to indicate the web request component to inspect, in the ``FieldToMatch`` specification.
 
-            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
+            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-body.html
             :exampleMetadata: fixture=_generated
@@ -3344,6 +2867,7 @@ class CfnRuleGroup(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             The options for oversize handling are the following:
 
@@ -3464,6 +2988,9 @@ class CfnRuleGroup(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     positional_constraint="positionalConstraint",
@@ -4457,6 +3984,7 @@ class CfnRuleGroup(
             "query_string": "queryString",
             "single_header": "singleHeader",
             "single_query_argument": "singleQueryArgument",
+            "uri_fragment": "uriFragment",
             "uri_path": "uriPath",
         },
     )
@@ -4475,6 +4003,7 @@ class CfnRuleGroup(
             query_string: typing.Any = None,
             single_header: typing.Any = None,
             single_query_argument: typing.Any = None,
+            uri_fragment: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRuleGroup.UriFragmentProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             uri_path: typing.Any = None,
         ) -> None:
             '''Specifies a web request component to be used in a rule match statement or in a logging configuration.
@@ -4495,16 +4024,17 @@ class CfnRuleGroup(
             - If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling. You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration or by configuring data protection for the web ACL.
 
             :param all_query_arguments: Inspect all query arguments.
-            :param body: Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``Body`` object configuration.
+            :param body: Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. For information about how to handle oversized request bodies, see the ``Body`` object configuration.
             :param cookies: Inspect the request cookies. You must configure scope and pattern matching filters in the ``Cookies`` object, to define the set of cookies and the parts of the cookies that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the ``Cookies`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param headers: Inspect the request headers. You must configure scope and pattern matching filters in the ``Headers`` object, to define the set of headers to and the parts of the headers that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the ``Headers`` object. AWS WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
             :param ja3_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA3 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
             :param ja4_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
-            :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
+            :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
             :param method: Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
             :param query_string: Inspect the query string. This is the part of a URL that appears after a ``?`` character, if any.
             :param single_header: Inspect a single header. Provide the name of the header to inspect, for example, ``User-Agent`` or ``Referer`` . This setting isn't case sensitive. Example JSON: ``"SingleHeader": { "Name": "haystack" }`` Alternately, you can filter and inspect all headers with the ``Headers`` ``FieldToMatch`` setting.
             :param single_query_argument: Inspect a single query argument. Provide the name of the query argument to inspect, such as *UserName* or *SalesRegion* . The name can be up to 30 characters long and isn't case sensitive. Example JSON: ``"SingleQueryArgument": { "Name": "myArgument" }``
+            :param uri_fragment: Inspect fragments of the request URI. You must configure scope and pattern matching filters in the ``UriFragment`` object, to define the fragment of a URI that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's URI fragments and only the first 200 URI fragments are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize URI fragment content in the ``UriFragment`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param uri_path: Inspect the request URI path. This is the part of the web request that identifies a resource, for example, ``/images/daily-ad.jpg`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-fieldtomatch.html
@@ -4568,6 +4098,9 @@ class CfnRuleGroup(
                     query_string=query_string,
                     single_header=single_header,
                     single_query_argument=single_query_argument,
+                    uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     uri_path=uri_path
                 )
             '''
@@ -4584,6 +4117,7 @@ class CfnRuleGroup(
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
                 check_type(argname="argument single_header", value=single_header, expected_type=type_hints["single_header"])
                 check_type(argname="argument single_query_argument", value=single_query_argument, expected_type=type_hints["single_query_argument"])
+                check_type(argname="argument uri_fragment", value=uri_fragment, expected_type=type_hints["uri_fragment"])
                 check_type(argname="argument uri_path", value=uri_path, expected_type=type_hints["uri_path"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
             if all_query_arguments is not None:
@@ -4608,6 +4142,8 @@ class CfnRuleGroup(
                 self._values["single_header"] = single_header
             if single_query_argument is not None:
                 self._values["single_query_argument"] = single_query_argument
+            if uri_fragment is not None:
+                self._values["uri_fragment"] = uri_fragment
             if uri_path is not None:
                 self._values["uri_path"] = uri_path
 
@@ -4632,6 +4168,7 @@ class CfnRuleGroup(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             For information about how to handle oversized request bodies, see the ``Body`` object configuration.
 
@@ -4722,6 +4259,7 @@ class CfnRuleGroup(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
 
@@ -4780,6 +4318,21 @@ class CfnRuleGroup(
             result = self._values.get("single_query_argument")
             return typing.cast(typing.Any, result)
 
+        @builtins.property
+        def uri_fragment(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.UriFragmentProperty"]]:
+            '''Inspect fragments of the request URI.
+
+            You must configure scope and pattern matching filters in the ``UriFragment`` object, to define the fragment of a URI that AWS WAF inspects.
+
+            Only the first 8 KB (8192 bytes) of a request's URI fragments and only the first 200 URI fragments are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize URI fragment content in the ``UriFragment`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-fieldtomatch.html#cfn-wafv2-rulegroup-fieldtomatch-urifragment
+            '''
+            result = self._values.get("uri_fragment")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.UriFragmentProperty"]], result)
+
         @builtins.property
         def uri_path(self) -> typing.Any:
             '''Inspect the request URI path.
@@ -5646,7 +5199,7 @@ class CfnRuleGroup(
             :param match_pattern: The patterns to look for in the JSON body. AWS WAF inspects the results of these pattern matches against the rule inspection criteria.
             :param match_scope: The parts of the JSON to match against using the ``MatchPattern`` . If you specify ``ALL`` , AWS WAF matches against keys and values. ``All`` does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical ``AND`` statement to combine two match rules, one that inspects the keys and another that inspects the values.
             :param invalid_fallback_behavior: What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:. - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters. .. epigraph:: AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
-            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
+            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-jsonbody.html
             :exampleMetadata: fixture=_generated
@@ -5740,6 +5293,7 @@ class CfnRuleGroup(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             The options for oversize handling are the following:
 
@@ -6122,6 +5676,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             positional_constraint="positionalConstraint",
@@ -6263,6 +5820,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             regex_string="regexString",
@@ -6317,6 +5877,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -6370,6 +5933,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             size=123,
@@ -6423,6 +5989,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -6478,6 +6047,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -6609,6 +6181,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             positional_constraint="positionalConstraint",
@@ -6750,6 +6325,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             regex_string="regexString",
@@ -6804,6 +6382,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -6857,6 +6438,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             size=123,
@@ -6910,6 +6494,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -6965,6 +6552,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -7513,6 +7103,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             positional_constraint="positionalConstraint",
@@ -7598,6 +7191,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             regex_string="regexString",
@@ -7652,6 +7248,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -7705,6 +7304,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             size=123,
@@ -7758,6 +7360,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -7813,6 +7418,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -8594,6 +8202,9 @@ class CfnRuleGroup(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     regex_string="regexString",
@@ -8751,6 +8362,9 @@ class CfnRuleGroup(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -9077,6 +8691,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             positional_constraint="positionalConstraint",
@@ -9220,6 +8837,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             regex_string="regexString",
@@ -9274,6 +8894,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -9327,6 +8950,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             size=123,
@@ -9380,6 +9006,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -9435,6 +9064,9 @@ class CfnRuleGroup(
                                 query_string=query_string,
                                 single_header=single_header,
                                 single_query_argument=single_query_argument,
+                                uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                    fallback_behavior="fallbackBehavior"
+                                ),
                                 uri_path=uri_path
                             ),
                             text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -9837,6 +9469,9 @@ class CfnRuleGroup(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     size=123,
@@ -10003,6 +9638,9 @@ class CfnRuleGroup(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -10201,6 +9839,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         positional_constraint="positionalConstraint",
@@ -10344,6 +9985,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         regex_string="regexString",
@@ -10398,6 +10042,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -10451,6 +10098,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         size=123,
@@ -10504,6 +10154,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -10559,6 +10212,9 @@ class CfnRuleGroup(
                             query_string=query_string,
                             single_header=single_header,
                             single_query_argument=single_query_argument,
+                            uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                                fallback_behavior="fallbackBehavior"
+                            ),
                             uri_path=uri_path
                         ),
                         text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
@@ -10915,6 +10571,78 @@ class CfnRuleGroup(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.UriFragmentProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class UriFragmentProperty:
+        def __init__(
+            self,
+            *,
+            fallback_behavior: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''Inspect fragments of the request URI.
+
+            You can specify the parts of the URI fragment to inspect and you can narrow the set of URI fragments to inspect by including or excluding specific keys.
+
+            This is used to indicate the web request component to inspect, in the ``FieldToMatch`` specification.
+
+            Example JSON: ``"UriFragment": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" }``
+
+            :param fallback_behavior: What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:. - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters. Example JSON: ``{ "UriFragment": { "FallbackBehavior": "MATCH"} }`` .. epigraph:: AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-urifragment.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                uri_fragment_property = wafv2.CfnRuleGroup.UriFragmentProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__fe1c476d259659923a1664b8e966720fc48cf48f725562b81ef2c02997f8998a)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if fallback_behavior is not None:
+                self._values["fallback_behavior"] = fallback_behavior
+
+        @builtins.property
+        def fallback_behavior(self) -> typing.Optional[builtins.str]:
+            '''What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:.
+
+            - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters.
+
+            Example JSON: ``{ "UriFragment": { "FallbackBehavior": "MATCH"} }``
+            .. epigraph::
+
+               AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-urifragment.html#cfn-wafv2-rulegroup-urifragment-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "UriFragmentProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroup.VisibilityConfigProperty",
         jsii_struct_bases=[],
@@ -11077,636 +10805,144 @@ class CfnRuleGroup(
                             match_scope="matchScope",
                             oversize_handling="oversizeHandling"
                         ),
-                        headers=wafv2.CfnRuleGroup.HeadersProperty(
-                            match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                all=all,
-                                excluded_headers=["excludedHeaders"],
-                                included_headers=["includedHeaders"]
-                            ),
-                            match_scope="matchScope",
-                            oversize_handling="oversizeHandling"
-                        ),
-                        ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                            fallback_behavior="fallbackBehavior"
-                        ),
-                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                            fallback_behavior="fallbackBehavior"
-                        ),
-                        json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                            match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                all=all,
-                                included_paths=["includedPaths"]
-                            ),
-                            match_scope="matchScope",
-                
-                            # the properties below are optional
-                            invalid_fallback_behavior="invalidFallbackBehavior",
-                            oversize_handling="oversizeHandling"
-                        ),
-                        method=method,
-                        query_string=query_string,
-                        single_header=single_header,
-                        single_query_argument=single_query_argument,
-                        uri_path=uri_path
-                    ),
-                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                        priority=123,
-                        type="type"
-                    )]
-                )
-            '''
-            if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__e502ec1c8bc4096eb797b55f6c0a1f9c506e23db360770a855cc273d36ce4b4a)
-                check_type(argname="argument field_to_match", value=field_to_match, expected_type=type_hints["field_to_match"])
-                check_type(argname="argument text_transformations", value=text_transformations, expected_type=type_hints["text_transformations"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "field_to_match": field_to_match,
-                "text_transformations": text_transformations,
-            }
-
-        @builtins.property
-        def field_to_match(
-            self,
-        ) -> typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.FieldToMatchProperty"]:
-            '''The part of the web request that you want AWS WAF to inspect.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-xssmatchstatement.html#cfn-wafv2-rulegroup-xssmatchstatement-fieldtomatch
-            '''
-            result = self._values.get("field_to_match")
-            assert result is not None, "Required property 'field_to_match' is missing"
-            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.FieldToMatchProperty"], result)
-
-        @builtins.property
-        def text_transformations(
-            self,
-        ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.TextTransformationProperty"]]]:
-            '''Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
-
-            If you specify one or more transformations in a rule statement, AWS WAF performs all transformations on the content of the request component identified by ``FieldToMatch`` , starting from the lowest priority setting, before inspecting the content for a match.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-xssmatchstatement.html#cfn-wafv2-rulegroup-xssmatchstatement-texttransformations
-            '''
-            result = self._values.get("text_transformations")
-            assert result is not None, "Required property 'text_transformations' is missing"
-            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.TextTransformationProperty"]]], result)
-
-        def __eq__(self, rhs: typing.Any) -> builtins.bool:
-            return isinstance(rhs, self.__class__) and rhs._values == self._values
-
-        def __ne__(self, rhs: typing.Any) -> builtins.bool:
-            return not (rhs == self)
-
-        def __repr__(self) -> str:
-            return "XssMatchStatementProperty(%s)" % ", ".join(
-                k + "=" + repr(v) for k, v in self._values.items()
-            )
-
-
-@jsii.data_type(
-    jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroupProps",
-    jsii_struct_bases=[],
-    name_mapping={
-        "capacity": "capacity",
-        "scope": "scope",
-        "visibility_config": "visibilityConfig",
-        "available_labels": "availableLabels",
-        "consumed_labels": "consumedLabels",
-        "custom_response_bodies": "customResponseBodies",
-        "description": "description",
-        "name": "name",
-        "rules": "rules",
-        "tags": "tags",
-    },
-)
-class CfnRuleGroupProps:
-    def __init__(
-        self,
-        *,
-        capacity: jsii.Number,
-        scope: builtins.str,
-        visibility_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.VisibilityConfigProperty, typing.Dict[builtins.str, typing.Any]]],
-        available_labels: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.LabelSummaryProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        consumed_labels: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.LabelSummaryProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        custom_response_bodies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.CustomResponseBodyProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        description: typing.Optional[builtins.str] = None,
-        name: typing.Optional[builtins.str] = None,
-        rules: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RuleProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
-        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
-    ) -> None:
-        '''Properties for defining a ``CfnRuleGroup``.
-
-        :param capacity: The web ACL capacity units (WCUs) required for this rule group. When you create your own rule group, you define this, and you cannot change it after creation. When you add or modify the rules in a rule group, AWS WAF enforces this limit. AWS WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
-        :param visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection.
-        :param available_labels: The labels that one or more rules in this rule group add to matching web requests. These labels are defined in the ``RuleLabels`` for a ``Rule`` .
-        :param consumed_labels: The labels that one or more rules in this rule group match against in label match statements. These labels are defined in a ``LabelMatchStatement`` specification, in the ``Statement`` definition of a rule.
-        :param custom_response_bodies: A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the rule group, and then use them in the rules that you define in the rule group. For information about customizing web requests and responses, see `Customizing web requests and responses in AWS WAF <https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html>`_ in the *AWS WAF Developer Guide* . For information about the limits on count and size for custom request and response settings, see `AWS WAF quotas <https://docs.aws.amazon.com/waf/latest/developerguide/limits.html>`_ in the *AWS WAF Developer Guide* .
-        :param description: A description of the rule group that helps with identification.
-        :param name: The name of the rule group. You cannot change the name of a rule group after you create it.
-        :param rules: The rule statements used to identify the web requests that you want to allow, block, or count. Each rule includes one top-level statement that AWS WAF uses to identify matching web requests, and parameters that govern how AWS WAF handles them.
-        :param tags: Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource. .. epigraph:: To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
-
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-rulegroup.html
-        :exampleMetadata: fixture=_generated
-
-        Example::
-
-            # The code below shows an example of how to instantiate this type.
-            # The values are placeholders you should change.
-            from aws_cdk import aws_wafv2 as wafv2
-            
-            # all: Any
-            # allow: Any
-            # all_query_arguments: Any
-            # block: Any
-            # captcha: Any
-            # challenge: Any
-            # count: Any
-            # forwarded_ip: Any
-            # http_method: Any
-            # ip: Any
-            # method: Any
-            # query_string: Any
-            # single_header: Any
-            # single_query_argument: Any
-            # statement_property_: wafv2.CfnRuleGroup.StatementProperty
-            # uri_path: Any
-            
-            cfn_rule_group_props = wafv2.CfnRuleGroupProps(
-                capacity=123,
-                scope="scope",
-                visibility_config=wafv2.CfnRuleGroup.VisibilityConfigProperty(
-                    cloud_watch_metrics_enabled=False,
-                    metric_name="metricName",
-                    sampled_requests_enabled=False
-                ),
-            
-                # the properties below are optional
-                available_labels=[wafv2.CfnRuleGroup.LabelSummaryProperty(
-                    name="name"
-                )],
-                consumed_labels=[wafv2.CfnRuleGroup.LabelSummaryProperty(
-                    name="name"
-                )],
-                custom_response_bodies={
-                    "custom_response_bodies_key": wafv2.CfnRuleGroup.CustomResponseBodyProperty(
-                        content="content",
-                        content_type="contentType"
-                    )
-                },
-                description="description",
-                name="name",
-                rules=[wafv2.CfnRuleGroup.RuleProperty(
-                    name="name",
-                    priority=123,
-                    statement=wafv2.CfnRuleGroup.StatementProperty(
-                        and_statement=wafv2.CfnRuleGroup.AndStatementProperty(
-                            statements=[statement_property_]
-                        ),
-                        byte_match_statement=wafv2.CfnRuleGroup.ByteMatchStatementProperty(
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
-                            ),
-                            positional_constraint="positionalConstraint",
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )],
-            
-                            # the properties below are optional
-                            search_string="searchString",
-                            search_string_base64="searchStringBase64"
-                        ),
-                        geo_match_statement=wafv2.CfnRuleGroup.GeoMatchStatementProperty(
-                            country_codes=["countryCodes"],
-                            forwarded_ip_config=wafv2.CfnRuleGroup.ForwardedIPConfigurationProperty(
-                                fallback_behavior="fallbackBehavior",
-                                header_name="headerName"
-                            )
-                        ),
-                        ip_set_reference_statement={
-                            "arn": "arn",
-            
-                            # the properties below are optional
-                            "ip_set_forwarded_ip_config": {
-                                "fallback_behavior": "fallbackBehavior",
-                                "header_name": "headerName",
-                                "position": "position"
-                            }
-                        },
-                        label_match_statement=wafv2.CfnRuleGroup.LabelMatchStatementProperty(
-                            key="key",
-                            scope="scope"
-                        ),
-                        not_statement=wafv2.CfnRuleGroup.NotStatementProperty(
-                            statement=statement_property_
-                        ),
-                        or_statement=wafv2.CfnRuleGroup.OrStatementProperty(
-                            statements=[statement_property_]
-                        ),
-                        rate_based_statement=wafv2.CfnRuleGroup.RateBasedStatementProperty(
-                            aggregate_key_type="aggregateKeyType",
-                            limit=123,
-            
-                            # the properties below are optional
-                            custom_keys=[wafv2.CfnRuleGroup.RateBasedStatementCustomKeyProperty(
-                                cookie=wafv2.CfnRuleGroup.RateLimitCookieProperty(
-                                    name="name",
-                                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                        priority=123,
-                                        type="type"
-                                    )]
-                                ),
-                                forwarded_ip=forwarded_ip,
-                                header=wafv2.CfnRuleGroup.RateLimitHeaderProperty(
-                                    name="name",
-                                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                        priority=123,
-                                        type="type"
-                                    )]
-                                ),
-                                http_method=http_method,
-                                ip=ip,
-                                ja3_fingerprint=wafv2.CfnRuleGroup.RateLimitJA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.RateLimitJA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                label_namespace=wafv2.CfnRuleGroup.RateLimitLabelNamespaceProperty(
-                                    namespace="namespace"
-                                ),
-                                query_argument=wafv2.CfnRuleGroup.RateLimitQueryArgumentProperty(
-                                    name="name",
-                                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                        priority=123,
-                                        type="type"
-                                    )]
-                                ),
-                                query_string=wafv2.CfnRuleGroup.RateLimitQueryStringProperty(
-                                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                        priority=123,
-                                        type="type"
-                                    )]
-                                ),
-                                uri_path=wafv2.CfnRuleGroup.RateLimitUriPathProperty(
-                                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                        priority=123,
-                                        type="type"
-                                    )]
-                                )
-                            )],
-                            evaluation_window_sec=123,
-                            forwarded_ip_config=wafv2.CfnRuleGroup.ForwardedIPConfigurationProperty(
-                                fallback_behavior="fallbackBehavior",
-                                header_name="headerName"
-                            ),
-                            scope_down_statement=statement_property_
-                        ),
-                        regex_match_statement=wafv2.CfnRuleGroup.RegexMatchStatementProperty(
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
-                            ),
-                            regex_string="regexString",
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )]
-                        ),
-                        regex_pattern_set_reference_statement=wafv2.CfnRuleGroup.RegexPatternSetReferenceStatementProperty(
-                            arn="arn",
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
-                            ),
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )]
-                        ),
-                        size_constraint_statement=wafv2.CfnRuleGroup.SizeConstraintStatementProperty(
-                            comparison_operator="comparisonOperator",
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
-                            ),
-                            size=123,
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )]
-                        ),
-                        sqli_match_statement=wafv2.CfnRuleGroup.SqliMatchStatementProperty(
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
-                            ),
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )],
-            
-                            # the properties below are optional
-                            sensitivity_level="sensitivityLevel"
-                        ),
-                        xss_match_statement=wafv2.CfnRuleGroup.XssMatchStatementProperty(
-                            field_to_match=wafv2.CfnRuleGroup.FieldToMatchProperty(
-                                all_query_arguments=all_query_arguments,
-                                body=wafv2.CfnRuleGroup.BodyProperty(
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                cookies=wafv2.CfnRuleGroup.CookiesProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.CookieMatchPatternProperty(
-                                        all=all,
-                                        excluded_cookies=["excludedCookies"],
-                                        included_cookies=["includedCookies"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                headers=wafv2.CfnRuleGroup.HeadersProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
-                                        all=all,
-                                        excluded_headers=["excludedHeaders"],
-                                        included_headers=["includedHeaders"]
-                                    ),
-                                    match_scope="matchScope",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
-                                    fallback_behavior="fallbackBehavior"
-                                ),
-                                json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
-                                    match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
-                                        all=all,
-                                        included_paths=["includedPaths"]
-                                    ),
-                                    match_scope="matchScope",
-            
-                                    # the properties below are optional
-                                    invalid_fallback_behavior="invalidFallbackBehavior",
-                                    oversize_handling="oversizeHandling"
-                                ),
-                                method=method,
-                                query_string=query_string,
-                                single_header=single_header,
-                                single_query_argument=single_query_argument,
-                                uri_path=uri_path
+                        headers=wafv2.CfnRuleGroup.HeadersProperty(
+                            match_pattern=wafv2.CfnRuleGroup.HeaderMatchPatternProperty(
+                                all=all,
+                                excluded_headers=["excludedHeaders"],
+                                included_headers=["includedHeaders"]
                             ),
-                            text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
-                                priority=123,
-                                type="type"
-                            )]
-                        )
-                    ),
-                    visibility_config=wafv2.CfnRuleGroup.VisibilityConfigProperty(
-                        cloud_watch_metrics_enabled=False,
-                        metric_name="metricName",
-                        sampled_requests_enabled=False
-                    ),
-            
-                    # the properties below are optional
-                    action=wafv2.CfnRuleGroup.RuleActionProperty(
-                        allow=allow,
-                        block=block,
-                        captcha=captcha,
-                        challenge=challenge,
-                        count=count
-                    ),
-                    captcha_config=wafv2.CfnRuleGroup.CaptchaConfigProperty(
-                        immunity_time_property=wafv2.CfnRuleGroup.ImmunityTimePropertyProperty(
-                            immunity_time=123
-                        )
-                    ),
-                    challenge_config=wafv2.CfnRuleGroup.ChallengeConfigProperty(
-                        immunity_time_property=wafv2.CfnRuleGroup.ImmunityTimePropertyProperty(
-                            immunity_time=123
-                        )
+                            match_scope="matchScope",
+                            oversize_handling="oversizeHandling"
+                        ),
+                        ja3_fingerprint=wafv2.CfnRuleGroup.JA3FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
+                        ja4_fingerprint=wafv2.CfnRuleGroup.JA4FingerprintProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
+                        json_body=wafv2.CfnRuleGroup.JsonBodyProperty(
+                            match_pattern=wafv2.CfnRuleGroup.JsonMatchPatternProperty(
+                                all=all,
+                                included_paths=["includedPaths"]
+                            ),
+                            match_scope="matchScope",
+                
+                            # the properties below are optional
+                            invalid_fallback_behavior="invalidFallbackBehavior",
+                            oversize_handling="oversizeHandling"
+                        ),
+                        method=method,
+                        query_string=query_string,
+                        single_header=single_header,
+                        single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnRuleGroup.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
+                        uri_path=uri_path
                     ),
-                    rule_labels=[wafv2.CfnRuleGroup.LabelProperty(
-                        name="name"
+                    text_transformations=[wafv2.CfnRuleGroup.TextTransformationProperty(
+                        priority=123,
+                        type="type"
                     )]
-                )],
-                tags=[CfnTag(
-                    key="key",
-                    value="value"
-                )]
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__e502ec1c8bc4096eb797b55f6c0a1f9c506e23db360770a855cc273d36ce4b4a)
+                check_type(argname="argument field_to_match", value=field_to_match, expected_type=type_hints["field_to_match"])
+                check_type(argname="argument text_transformations", value=text_transformations, expected_type=type_hints["text_transformations"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "field_to_match": field_to_match,
+                "text_transformations": text_transformations,
+            }
+
+        @builtins.property
+        def field_to_match(
+            self,
+        ) -> typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.FieldToMatchProperty"]:
+            '''The part of the web request that you want AWS WAF to inspect.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-xssmatchstatement.html#cfn-wafv2-rulegroup-xssmatchstatement-fieldtomatch
+            '''
+            result = self._values.get("field_to_match")
+            assert result is not None, "Required property 'field_to_match' is missing"
+            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.FieldToMatchProperty"], result)
+
+        @builtins.property
+        def text_transformations(
+            self,
+        ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.TextTransformationProperty"]]]:
+            '''Text transformations eliminate some of the unusual formatting that attackers use in web requests in an effort to bypass detection.
+
+            If you specify one or more transformations in a rule statement, AWS WAF performs all transformations on the content of the request component identified by ``FieldToMatch`` , starting from the lowest priority setting, before inspecting the content for a match.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-rulegroup-xssmatchstatement.html#cfn-wafv2-rulegroup-xssmatchstatement-texttransformations
+            '''
+            result = self._values.get("text_transformations")
+            assert result is not None, "Required property 'text_transformations' is missing"
+            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRuleGroup.TextTransformationProperty"]]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "XssMatchStatementProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
             )
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_wafv2.CfnRuleGroupProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "capacity": "capacity",
+        "scope": "scope",
+        "visibility_config": "visibilityConfig",
+        "available_labels": "availableLabels",
+        "consumed_labels": "consumedLabels",
+        "custom_response_bodies": "customResponseBodies",
+        "description": "description",
+        "name": "name",
+        "rules": "rules",
+        "tags": "tags",
+    },
+)
+class CfnRuleGroupProps:
+    def __init__(
+        self,
+        *,
+        capacity: jsii.Number,
+        scope: builtins.str,
+        visibility_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.VisibilityConfigProperty, typing.Dict[builtins.str, typing.Any]]],
+        available_labels: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.LabelSummaryProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        consumed_labels: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.LabelSummaryProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        custom_response_bodies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Mapping[builtins.str, typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.CustomResponseBodyProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        description: typing.Optional[builtins.str] = None,
+        name: typing.Optional[builtins.str] = None,
+        rules: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.RuleProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ) -> None:
+        '''Properties for defining a ``CfnRuleGroup``.
+
+        :param capacity: The web ACL capacity units (WCUs) required for this rule group. When you create your own rule group, you define this, and you cannot change it after creation. When you add or modify the rules in a rule group, AWS WAF enforces this limit. AWS WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. AWS WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
+        :param visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection.
+        :param available_labels: The labels that one or more rules in this rule group add to matching web requests. These labels are defined in the ``RuleLabels`` for a ``Rule`` .
+        :param consumed_labels: The labels that one or more rules in this rule group match against in label match statements. These labels are defined in a ``LabelMatchStatement`` specification, in the ``Statement`` definition of a rule.
+        :param custom_response_bodies: A map of custom response keys and content bodies. When you create a rule with a block action, you can send a custom response to the web request. You define these for the rule group, and then use them in the rules that you define in the rule group. For information about customizing web requests and responses, see `Customizing web requests and responses in AWS WAF <https://docs.aws.amazon.com/waf/latest/developerguide/waf-custom-request-response.html>`_ in the *AWS WAF Developer Guide* . For information about the limits on count and size for custom request and response settings, see `AWS WAF quotas <https://docs.aws.amazon.com/waf/latest/developerguide/limits.html>`_ in the *AWS WAF Developer Guide* .
+        :param description: A description of the rule group that helps with identification.
+        :param name: The name of the rule group. You cannot change the name of a rule group after you create it.
+        :param rules: The rule statements used to identify the web requests that you want to allow, block, or count. Each rule includes one top-level statement that AWS WAF uses to identify matching web requests, and parameters that govern how AWS WAF handles them.
+        :param tags: Key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource. .. epigraph:: To modify tags on existing resources, use the AWS WAF APIs or command line interface. With AWS CloudFormation , you can only add tags to AWS WAF resources during resource creation.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-rulegroup.html
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c8dfa44d9c30297c12ad00bd34bbd4b85ea5438f4127e7e97226c16565c6ef5b)
@@ -11758,7 +10994,7 @@ class CfnRuleGroupProps:
     def scope(self) -> builtins.str:
         '''Specifies whether this is for an Amazon CloudFront distribution or for a regional application.
 
-        A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
+        For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
         .. epigraph::
 
            For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
@@ -11899,7 +11135,7 @@ class CfnWebACL(
 
     The rules in a web ACL can be a combination of explicitly defined rules and rule groups that you reference from the web ACL. The rule groups can be rule groups that you manage or rule groups that are managed by others.
 
-    You can associate a web ACL with one or more AWS resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer , an AWS AppSync GraphQL API , an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance.
+    You can associate a web ACL with one or more AWS resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer , an AWS AppSync GraphQL API , an Amazon Cognito user pool, an AWS App Runner service, an AWS Amplify application, or an AWS Verified Access instance.
 
     For more information, see `Web access control lists (web ACLs) <https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html>`_ in the *AWS WAF developer guide* .
 
@@ -11945,7 +11181,7 @@ class CfnWebACL(
         :param scope_: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
         :param default_action: The action to perform if none of the ``Rules`` contained in the ``WebACL`` match.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` . For information about how to define the association of the web ACL with your resource, see ``WebACLAssociation`` .
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` . For information about how to define the association of the web ACL with your resource, see ``WebACLAssociation`` .
         :param visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection.
         :param association_config: Specifies custom configurations for the associations between the web ACL and protected resources. Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes). .. epigraph:: You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see `AWS WAF Pricing <https://docs.aws.amazon.com/waf/pricing/>`_ . For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
         :param captcha_config: Specifies how AWS WAF should handle ``CAPTCHA`` evaluations for rules that don't have their own ``CaptchaConfig`` settings. If you don't specify this, AWS WAF uses its default settings for ``CaptchaConfig`` .
@@ -12987,7 +12223,7 @@ class CfnWebACL(
 
             This is used to indicate the web request component to inspect, in the ``FieldToMatch`` specification.
 
-            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
+            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-body.html
             :exampleMetadata: fixture=_generated
@@ -13017,6 +12253,7 @@ class CfnWebACL(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             The options for oversize handling are the following:
 
@@ -13137,6 +12374,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     positional_constraint="positionalConstraint",
@@ -14572,6 +13812,7 @@ class CfnWebACL(
             "query_string": "queryString",
             "single_header": "singleHeader",
             "single_query_argument": "singleQueryArgument",
+            "uri_fragment": "uriFragment",
             "uri_path": "uriPath",
         },
     )
@@ -14590,6 +13831,7 @@ class CfnWebACL(
             query_string: typing.Any = None,
             single_header: typing.Any = None,
             single_query_argument: typing.Any = None,
+            uri_fragment: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnWebACL.UriFragmentProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             uri_path: typing.Any = None,
         ) -> None:
             '''Specifies a web request component to be used in a rule match statement or in a logging configuration.
@@ -14610,16 +13852,17 @@ class CfnWebACL(
             - If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling. You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration or by configuring data protection for the web ACL.
 
             :param all_query_arguments: Inspect all query arguments.
-            :param body: Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``Body`` object configuration.
+            :param body: Inspect the request body as plain text. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. For information about how to handle oversized request bodies, see the ``Body`` object configuration.
             :param cookies: Inspect the request cookies. You must configure scope and pattern matching filters in the ``Cookies`` object, to define the set of cookies and the parts of the cookies that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's cookies and only the first 200 cookies are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize cookie content in the ``Cookies`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param headers: Inspect the request headers. You must configure scope and pattern matching filters in the ``Headers`` object, to define the set of headers to and the parts of the headers that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's headers and only the first 200 headers are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize header content in the ``Headers`` object. AWS WAF applies the pattern matching filters to the headers that it receives from the underlying host service.
             :param ja3_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA3 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA3 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
             :param ja4_fingerprint: Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. AWS WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information. .. epigraph:: You can use this choice only with a string match ``ByteMatchStatement`` with the ``PositionalConstraint`` set to ``EXACTLY`` . You can obtain the JA4 fingerprint for client requests from the web ACL logs. If AWS WAF is able to calculate the fingerprint, it includes it in the logs. For information about the logging fields, see `Log fields <https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html>`_ in the *AWS WAF Developer Guide* . Provide the JA4 fingerprint string from the logs in your string match statement specification, to match with any future requests that have the same TLS configuration.
-            :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
+            :param json_body: Inspect the request body as JSON. The request body immediately follows the request headers. This is the part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
             :param method: Inspect the HTTP method. The method indicates the type of operation that the request is asking the origin to perform.
             :param query_string: Inspect the query string. This is the part of a URL that appears after a ``?`` character, if any.
             :param single_header: Inspect a single header. Provide the name of the header to inspect, for example, ``User-Agent`` or ``Referer`` . This setting isn't case sensitive. Example JSON: ``"SingleHeader": { "Name": "haystack" }`` Alternately, you can filter and inspect all headers with the ``Headers`` ``FieldToMatch`` setting.
             :param single_query_argument: Inspect a single query argument. Provide the name of the query argument to inspect, such as *UserName* or *SalesRegion* . The name can be up to 30 characters long and isn't case sensitive. Example JSON: ``"SingleQueryArgument": { "Name": "myArgument" }``
+            :param uri_fragment: Inspect fragments of the request URI. You must configure scope and pattern matching filters in the ``UriFragment`` object, to define the fragment of a URI that AWS WAF inspects. Only the first 8 KB (8192 bytes) of a request's URI fragments and only the first 200 URI fragments are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize URI fragment content in the ``UriFragment`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
             :param uri_path: Inspect the request URI path. This is the part of the web request that identifies a resource, for example, ``/images/daily-ad.jpg`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-fieldtomatch.html
@@ -14683,6 +13926,9 @@ class CfnWebACL(
                     query_string=query_string,
                     single_header=single_header,
                     single_query_argument=single_query_argument,
+                    uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                        fallback_behavior="fallbackBehavior"
+                    ),
                     uri_path=uri_path
                 )
             '''
@@ -14699,6 +13945,7 @@ class CfnWebACL(
                 check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
                 check_type(argname="argument single_header", value=single_header, expected_type=type_hints["single_header"])
                 check_type(argname="argument single_query_argument", value=single_query_argument, expected_type=type_hints["single_query_argument"])
+                check_type(argname="argument uri_fragment", value=uri_fragment, expected_type=type_hints["uri_fragment"])
                 check_type(argname="argument uri_path", value=uri_path, expected_type=type_hints["uri_path"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
             if all_query_arguments is not None:
@@ -14723,6 +13970,8 @@ class CfnWebACL(
                 self._values["single_header"] = single_header
             if single_query_argument is not None:
                 self._values["single_query_argument"] = single_query_argument
+            if uri_fragment is not None:
+                self._values["uri_fragment"] = uri_fragment
             if uri_path is not None:
                 self._values["uri_path"] = uri_path
 
@@ -14747,6 +13996,7 @@ class CfnWebACL(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             For information about how to handle oversized request bodies, see the ``Body`` object configuration.
 
@@ -14837,6 +14087,7 @@ class CfnWebACL(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             For information about how to handle oversized request bodies, see the ``JsonBody`` object configuration.
 
@@ -14895,6 +14146,21 @@ class CfnWebACL(
             result = self._values.get("single_query_argument")
             return typing.cast(typing.Any, result)
 
+        @builtins.property
+        def uri_fragment(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.UriFragmentProperty"]]:
+            '''Inspect fragments of the request URI.
+
+            You must configure scope and pattern matching filters in the ``UriFragment`` object, to define the fragment of a URI that AWS WAF inspects.
+
+            Only the first 8 KB (8192 bytes) of a request's URI fragments and only the first 200 URI fragments are forwarded to AWS WAF for inspection by the underlying host service. You must configure how to handle any oversize URI fragment content in the ``UriFragment`` object. AWS WAF applies the pattern matching filters to the cookies that it receives from the underlying host service.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-fieldtomatch.html#cfn-wafv2-webacl-fieldtomatch-urifragment
+            '''
+            result = self._values.get("uri_fragment")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnWebACL.UriFragmentProperty"]], result)
+
         @builtins.property
         def uri_path(self) -> typing.Any:
             '''Inspect the request URI path.
@@ -15838,7 +15104,7 @@ class CfnWebACL(
             :param match_pattern: The patterns to look for in the JSON body. AWS WAF inspects the results of these pattern matches against the rule inspection criteria.
             :param match_scope: The parts of the JSON to match against using the ``MatchPattern`` . If you specify ``ALL`` , AWS WAF matches against keys and values. ``All`` does not require a match to be found in the keys and a match to be found in the values. It requires a match to be found in the keys or the values or both. To require a match in the keys and in the values, use a logical ``AND`` statement to combine two match rules, one that inspects the keys and another that inspects the values.
             :param invalid_fallback_behavior: What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:. - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters. .. epigraph:: AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
-            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
+            :param oversize_handling: What AWS WAF should do if the body is larger than AWS WAF can inspect. AWS WAF does not support inspecting the entire contents of the web request body if the body exceeds the limit for the resource type. When a web request body is larger than the limit, the underlying host service only forwards the contents that are within the limit to AWS WAF for inspection. - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes). - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees. - For AWS Amplify , use the CloudFront limit. The options for oversize handling are the following: - ``CONTINUE`` - Inspect the available body contents normally, according to the rule inspection criteria. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. You can combine the ``MATCH`` or ``NO_MATCH`` settings for oversize handling with your rule and web ACL action settings, so that you block any request whose body is over the limit. Default: ``CONTINUE``
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-jsonbody.html
             :exampleMetadata: fixture=_generated
@@ -15932,6 +15198,7 @@ class CfnWebACL(
 
             - For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
             - For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB (16,384 bytes), and you can increase the limit for each resource type in the web ACL ``AssociationConfig`` , for additional processing fees.
+            - For AWS Amplify , use the CloudFront limit.
 
             The options for oversize handling are the following:
 
@@ -17983,6 +17250,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     regex_string="regexString",
@@ -18140,6 +17410,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     text_transformations=[wafv2.CfnWebACL.TextTransformationProperty(
@@ -20055,6 +19328,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     size=123,
@@ -20221,6 +19497,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     text_transformations=[wafv2.CfnWebACL.TextTransformationProperty(
@@ -20748,6 +20027,78 @@ class CfnWebACL(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.UriFragmentProperty",
+        jsii_struct_bases=[],
+        name_mapping={"fallback_behavior": "fallbackBehavior"},
+    )
+    class UriFragmentProperty:
+        def __init__(
+            self,
+            *,
+            fallback_behavior: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''Inspect fragments of the request URI.
+
+            You can specify the parts of the URI fragment to inspect and you can narrow the set of URI fragments to inspect by including or excluding specific keys.
+
+            This is used to indicate the web request component to inspect, in the ``FieldToMatch`` specification.
+
+            Example JSON: ``"UriFragment": { "MatchPattern": { "All": {} }, "MatchScope": "KEY", "OversizeHandling": "MATCH" }``
+
+            :param fallback_behavior: What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:. - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string. - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request. - ``NO_MATCH`` - Treat the web request as not matching the rule statement. If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters. Example JSON: ``{ "UriFragment": { "FallbackBehavior": "MATCH"} }`` .. epigraph:: AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-urifragment.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_wafv2 as wafv2
+                
+                uri_fragment_property = wafv2.CfnWebACL.UriFragmentProperty(
+                    fallback_behavior="fallbackBehavior"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ff710cae8471ff92b17239c2eddf3d9fc58fc160b82b4603e07b06b6dc3a6dd1)
+                check_type(argname="argument fallback_behavior", value=fallback_behavior, expected_type=type_hints["fallback_behavior"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if fallback_behavior is not None:
+                self._values["fallback_behavior"] = fallback_behavior
+
+        @builtins.property
+        def fallback_behavior(self) -> typing.Optional[builtins.str]:
+            '''What AWS WAF should do if it fails to completely parse the JSON body. The options are the following:.
+
+            - ``EVALUATE_AS_STRING`` - Inspect the body as plain text. AWS WAF applies the text transformations and inspection criteria that you defined for the JSON inspection to the body text string.
+            - ``MATCH`` - Treat the web request as matching the rule statement. AWS WAF applies the rule action to the request.
+            - ``NO_MATCH`` - Treat the web request as not matching the rule statement.
+
+            If you don't provide this setting, AWS WAF parses and evaluates the content only up to the first parsing failure that it encounters.
+
+            Example JSON: ``{ "UriFragment": { "FallbackBehavior": "MATCH"} }``
+            .. epigraph::
+
+               AWS WAF parsing doesn't fully validate the input JSON string, so parsing can succeed even for invalid JSON. When parsing succeeds, AWS WAF doesn't apply the fallback behavior. For more information, see `JSON body <https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-fields-list.html#waf-rule-statement-request-component-json-body>`_ in the *AWS WAF Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-urifragment.html#cfn-wafv2-webacl-urifragment-fallbackbehavior
+            '''
+            result = self._values.get("fallback_behavior")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "UriFragmentProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_wafv2.CfnWebACL.VisibilityConfigProperty",
         jsii_struct_bases=[],
@@ -20940,6 +20291,9 @@ class CfnWebACL(
                         query_string=query_string,
                         single_header=single_header,
                         single_query_argument=single_query_argument,
+                        uri_fragment=wafv2.CfnWebACL.UriFragmentProperty(
+                            fallback_behavior="fallbackBehavior"
+                        ),
                         uri_path=uri_path
                     ),
                     text_transformations=[wafv2.CfnWebACL.TextTransformationProperty(
@@ -21007,7 +20361,7 @@ class CfnWebACLAssociation(
 
     For information, including how to migrate your AWS WAF resources from the prior release, see the `AWS WAF developer guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html>`_ .
 
-    Use a web ACL association to define an association between a web ACL and a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance.
+    Use a web ACL association to define an association between a web ACL and a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, an AWS Amplify application, or an AWS Verified Access instance.
 
     For Amazon CloudFront , don't use this resource. Instead, use your CloudFront distribution configuration. To associate a web ACL with a distribution, provide the Amazon Resource Name (ARN) of the ``WebACL`` to your CloudFront distribution configuration. To disassociate a web ACL, provide an empty ARN. For information, see `AWS::CloudFront::Distribution <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html>`_ .
 
@@ -21054,7 +20408,7 @@ class CfnWebACLAssociation(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param resource_arn: The Amazon Resource Name (ARN) of the resource to associate with the web ACL. The ARN must be in one of the following formats: - For an Application Load Balancer: ``arn: *partition* :elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`` - For an Amazon API Gateway REST API: ``arn: *partition* :apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`` - For an AWS AppSync GraphQL API: ``arn: *partition* :appsync: *region* : *account-id* :apis/ *GraphQLApiId*`` - For an Amazon Cognito user pool: ``arn: *partition* :cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`` - For an AWS App Runner service: ``arn: *partition* :apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*`` - For an AWS Verified Access instance: ``arn: *partition* :ec2: *region* : *account-id* :verified-access-instance/ *instance-id*``
+        :param resource_arn: The Amazon Resource Name (ARN) of the resource to associate with the web ACL. The ARN must be in one of the following formats: - For an Application Load Balancer: ``arn: *partition* :elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`` - For an Amazon API Gateway REST API: ``arn: *partition* :apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`` - For an AWS AppSync GraphQL API: ``arn: *partition* :appsync: *region* : *account-id* :apis/ *GraphQLApiId*`` - For an Amazon Cognito user pool: ``arn: *partition* :cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`` - For an AWS App Runner service: ``arn: *partition* :apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*`` - For an AWS Verified Access instance: ``arn: *partition* :ec2: *region* : *account-id* :verified-access-instance/ *instance-id*`` - For an AWS Amplify instance: ``arn: *partition* :amplify: *region* : *account-id* :apps/ *app-id*``
         :param web_acl_arn: The Amazon Resource Name (ARN) of the web ACL that you want to associate with the resource.
         '''
         if __debug__:
@@ -21143,7 +20497,7 @@ class CfnWebACLAssociationProps:
     ) -> None:
         '''Properties for defining a ``CfnWebACLAssociation``.
 
-        :param resource_arn: The Amazon Resource Name (ARN) of the resource to associate with the web ACL. The ARN must be in one of the following formats: - For an Application Load Balancer: ``arn: *partition* :elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`` - For an Amazon API Gateway REST API: ``arn: *partition* :apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`` - For an AWS AppSync GraphQL API: ``arn: *partition* :appsync: *region* : *account-id* :apis/ *GraphQLApiId*`` - For an Amazon Cognito user pool: ``arn: *partition* :cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`` - For an AWS App Runner service: ``arn: *partition* :apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*`` - For an AWS Verified Access instance: ``arn: *partition* :ec2: *region* : *account-id* :verified-access-instance/ *instance-id*``
+        :param resource_arn: The Amazon Resource Name (ARN) of the resource to associate with the web ACL. The ARN must be in one of the following formats: - For an Application Load Balancer: ``arn: *partition* :elasticloadbalancing: *region* : *account-id* :loadbalancer/app/ *load-balancer-name* / *load-balancer-id*`` - For an Amazon API Gateway REST API: ``arn: *partition* :apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*`` - For an AWS AppSync GraphQL API: ``arn: *partition* :appsync: *region* : *account-id* :apis/ *GraphQLApiId*`` - For an Amazon Cognito user pool: ``arn: *partition* :cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*`` - For an AWS App Runner service: ``arn: *partition* :apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*`` - For an AWS Verified Access instance: ``arn: *partition* :ec2: *region* : *account-id* :verified-access-instance/ *instance-id*`` - For an AWS Amplify instance: ``arn: *partition* :amplify: *region* : *account-id* :apps/ *app-id*``
         :param web_acl_arn: The Amazon Resource Name (ARN) of the web ACL that you want to associate with the resource.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.html
@@ -21182,6 +20536,7 @@ class CfnWebACLAssociationProps:
         - For an Amazon Cognito user pool: ``arn: *partition* :cognito-idp: *region* : *account-id* :userpool/ *user-pool-id*``
         - For an AWS App Runner service: ``arn: *partition* :apprunner: *region* : *account-id* :service/ *apprunner-service-name* / *apprunner-service-id*``
         - For an AWS Verified Access instance: ``arn: *partition* :ec2: *region* : *account-id* :verified-access-instance/ *instance-id*``
+        - For an AWS Amplify instance: ``arn: *partition* :amplify: *region* : *account-id* :apps/ *app-id*``
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.html#cfn-wafv2-webaclassociation-resourcearn
         '''
@@ -21251,7 +20606,7 @@ class CfnWebACLProps:
         '''Properties for defining a ``CfnWebACL``.
 
         :param default_action: The action to perform if none of the ``Rules`` contained in the ``WebACL`` match.
-        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` . For information about how to define the association of the web ACL with your resource, see ``WebACLAssociation`` .
+        :param scope: Specifies whether this is for an Amazon CloudFront distribution or for a regional application. For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` . .. epigraph:: For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` . For information about how to define the association of the web ACL with your resource, see ``WebACLAssociation`` .
         :param visibility_config: Defines and enables Amazon CloudWatch metrics and web request sample collection.
         :param association_config: Specifies custom configurations for the associations between the web ACL and protected resources. Use this to customize the maximum size of the request body that your protected resources forward to AWS WAF for inspection. You can customize this setting for CloudFront, API Gateway, Amazon Cognito, App Runner, or Verified Access resources. The default setting is 16 KB (16,384 bytes). .. epigraph:: You are charged additional fees when your protected resources forward body sizes that are larger than the default. For more information, see `AWS WAF Pricing <https://docs.aws.amazon.com/waf/pricing/>`_ . For Application Load Balancer and AWS AppSync , the limit is fixed at 8 KB (8,192 bytes).
         :param captcha_config: Specifies how AWS WAF should handle ``CAPTCHA`` evaluations for rules that don't have their own ``CaptchaConfig`` settings. If you don't specify this, AWS WAF uses its default settings for ``CaptchaConfig`` .
@@ -21328,7 +20683,7 @@ class CfnWebACLProps:
     def scope(self) -> builtins.str:
         '''Specifies whether this is for an Amazon CloudFront distribution or for a regional application.
 
-        A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
+        For an AWS Amplify application, use ``CLOUDFRONT`` . A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AWS AppSync GraphQL API, an Amazon Cognito user pool, an AWS App Runner service, or an AWS Verified Access instance. Valid Values are ``CLOUDFRONT`` and ``REGIONAL`` .
         .. epigraph::
 
            For ``CLOUDFRONT`` , you must create your WAFv2 resources in the US East (N. Virginia) Region, ``us-east-1`` .
@@ -22015,6 +21370,7 @@ def _typecheckingstub__dcb790c3130e52c64e6b7cf00db86b37d1b54427689c46b6c9e6a7122
     query_string: typing.Any = None,
     single_header: typing.Any = None,
     single_query_argument: typing.Any = None,
+    uri_fragment: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRuleGroup.UriFragmentProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     uri_path: typing.Any = None,
 ) -> None:
     """Type checking stubs"""
@@ -22337,6 +21693,13 @@ def _typecheckingstub__cbdf04ef9e923368f792f61fdb73e804a219fcd9c66ffb20e85214a5a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__fe1c476d259659923a1664b8e966720fc48cf48f725562b81ef2c02997f8998a(
+    *,
+    fallback_behavior: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__ffc3de9fa9cd77d11c4487ad80fc48948664b917c8642b35ca709762ce71fddf(
     *,
     cloud_watch_metrics_enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
@@ -22693,6 +22056,7 @@ def _typecheckingstub__25d147c856e9a8fd64f4cc05856e4813e584f37ef787792ad3c4e0790
     query_string: typing.Any = None,
     single_header: typing.Any = None,
     single_query_argument: typing.Any = None,
+    uri_fragment: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnWebACL.UriFragmentProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     uri_path: typing.Any = None,
 ) -> None:
     """Type checking stubs"""
@@ -23142,6 +22506,13 @@ def _typecheckingstub__a7a1f13087f44f2554ec3d9d35f967247b32fc5b6c94bf2eacd3379ce
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__ff710cae8471ff92b17239c2eddf3d9fc58fc160b82b4603e07b06b6dc3a6dd1(
+    *,
+    fallback_behavior: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__f805e71e3de782928ad1bdb95c4cddf9f28e9dbda49ae45324c0dc8316955eaa(
     *,
     cloud_watch_metrics_enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],