LoggingConfiguration

Source: src/AWS/WAFv2/LoggingConfiguration.ts

The logging configuration of an AWS WAFv2 WebACL — streams full web request logs to a Kinesis Data Firehose delivery stream, a CloudWatch Logs log group, or an S3 bucket.

The destination must be named with the aws-waf-logs- prefix. A web ACL has at most one logging configuration; deleting this resource disables logging.

Configuring Logging

Log to CloudWatch Logs

const logGroup = yield* AWS.Logs.LogGroup("WafLogs", {
  logGroupName: "aws-waf-logs-my-firewall",
});

yield* AWS.WAFv2.LoggingConfiguration("Logging", {
  resourceArn: acl.webAclArn,
  logDestinationConfigs: [logGroup.logGroupArn],
});

Redact Headers and Filter to Blocked Requests

yield* AWS.WAFv2.LoggingConfiguration("Logging", {
  resourceArn: acl.webAclArn,
  logDestinationConfigs: [logGroup.logGroupArn],
  redactedFields: [{ SingleHeader: { Name: "authorization" } }],
  loggingFilter: {
    DefaultBehavior: "DROP",
    Filters: [
      {
        Behavior: "KEEP",
        Requirement: "MEETS_ANY",
        Conditions: [{ ActionCondition: { Action: "BLOCK" } }],
      },
    ],
  },
});