WAFv2

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

IPSet # GA

IPSet is the Schema for managing WAFv2 IPSets.

kubectl get ipsets · example on GitHub

Example

# IPSet — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#ipset
apiVersion: aws.konfig.io/v1alpha1
kind: IPSet
metadata:
  name: example-ipset
  namespace: default
spec:
  addresses:
  - example
  description: Managed by konfig-konector
  ipAddressVersion: IPV4
  name: example-ipset
  providerRef:
    name: example-ipset
    region: us-east-1
  scope: CLOUDFRONT
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`addresses`	array<string>	yes	Addresses are the CIDR blocks to include in the IP set.
`description`	string	—	Description is a human-readable description.
`ipAddressVersion`	enum	yes	IPAddressVersion is IPV4 or IPV6. Allowed: `IPV4, IPV6`
`name`	string	yes	Name is the name of the IP set.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`scope`	enum	yes	Scope is CLOUDFRONT or REGIONAL. Allowed: `CLOUDFRONT, REGIONAL`
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the IP set.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the IPSet ID.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`lockToken`	string	—	LockToken is the WAFv2 lock token required for updates/deletes.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

WAFRegexPatternSet # GA

WAFRegexPatternSet is the Schema for managing WAFv2 regex pattern sets.

kubectl get wafregexpatternsets · example on GitHub

Example

# WAFRegexPatternSet — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#wafregexpatternset
apiVersion: aws.konfig.io/v1alpha1
kind: WAFRegexPatternSet
metadata:
  name: example-wafregexpatternset
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-wafregexpatternset
  providerRef:
    name: example-wafregexpatternset
    region: us-east-1
  regularExpressionList:
  - example
  scope: CLOUDFRONT
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description is a description of the set.
`name`	string	yes	Name is the name of the regex pattern set.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`regularExpressionList`	array<string>	yes	RegularExpressionList is the list of regex patterns.
`scope`	enum	yes	Scope is CLOUDFRONT or REGIONAL. Allowed: `CLOUDFRONT, REGIONAL`
`tags`	map<string>	—	Tags are metadata tags for the regex pattern set.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the regex pattern set.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the identifier of the regex pattern set.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`lockToken`	string	—	LockToken is required for updates and deletes.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

WAFRuleGroup # GA

WAFRuleGroup is the Schema for managing WAFv2 rule groups.

kubectl get wafrulegroups · example on GitHub

Example

# WAFRuleGroup — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#wafrulegroup
apiVersion: aws.konfig.io/v1alpha1
kind: WAFRuleGroup
metadata:
  name: example-wafrulegroup
  namespace: default
spec:
  capacity: 2
  description: Managed by konfig-konector
  name: example-wafrulegroup
  providerRef:
    name: example-wafrulegroup
    region: us-east-1
  scope: CLOUDFRONT
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`capacity`	integer	yes	Capacity is the web ACL capacity units (WCUs) required for the rule group.
`description`	string	—	Description is a description of the rule group.
`name`	string	yes	Name is the name of the rule group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`scope`	enum	yes	Scope is CLOUDFRONT or REGIONAL. Allowed: `CLOUDFRONT, REGIONAL`
`tags`	map<string>	—	Tags are metadata tags for the rule group.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the rule group.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the identifier of the rule group.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`lockToken`	string	—	LockToken is required for updates and deletes.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

WAFv2LoggingConfiguration # CLOUD CONTROL · AWS::WAFv2::LoggingConfiguration

WAFv2LoggingConfiguration manages AWS::WAFv2::LoggingConfiguration through the AWS Cloud Control API.

kubectl get wafv2loggingconfigurations · example on GitHub

Example

# WAFv2LoggingConfiguration — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#wafv2loggingconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: WAFv2LoggingConfiguration
metadata:
  name: example-wafv2loggingconfiguration
  namespace: default
spec:
  logDestinationConfigs:
  - example
  loggingFilter:
    defaultBehavior: KEEP
    filters:
    - behavior: KEEP
      requirement: MEETS_ALL
  providerRef:
    name: example-wafv2loggingconfiguration
    region: us-east-1
  redactedFields:
  - singleHeader:
      name: example-singleheader
  resourceArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`logDestinationConfigs`	array<string>	yes	The Amazon Resource Names (ARNs) of the logging destinations that you want to associate with the web ACL.
`loggingFilter`	object	—	Filtering that specifies which web requests are kept in the logs and which are dropped.
`loggingFilter.defaultBehavior`	enum	yes	Default handling for logs that don't match any of the specified filtering conditions. Allowed: `KEEP, DROP`
`loggingFilter.filters`	array<object>	yes	The filters that you want to apply to the logs.
`loggingFilter.filters[].behavior`	enum	yes	How to handle logs that satisfy the filter's conditions and requirement. Allowed: `KEEP, DROP`
`loggingFilter.filters[].conditions`	array<object>	yes	Match conditions for the filter.
`loggingFilter.filters[].conditions[].actionCondition`	object	—	A single action condition.
`loggingFilter.filters[].conditions[].actionCondition.action`	enum	yes	Logic to apply to the filtering conditions. Allowed: `ALLOW, BLOCK, COUNT, CAPTCHA, CHALLENGE, MONETIZE, EXCLUDED_AS_COUNT`
`loggingFilter.filters[].conditions[].labelNameCondition`	object	—	A single label name condition.
`loggingFilter.filters[].conditions[].labelNameCondition.labelName`	string	yes	The label name that a log record must contain in order to meet the condition.
`loggingFilter.filters[].requirement`	enum	yes	Logic to apply to the filtering conditions. Allowed: `MEETS_ALL, MEETS_ANY`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`redactedFields`	array<object>	—	The parts of the request that you want to keep out of the logs.
`redactedFields[].method`	object	—	Inspect the HTTP method.
`redactedFields[].queryString`	object	—	Inspect the query string.
`redactedFields[].singleHeader`	object	—	Inspect a single header.
`redactedFields[].singleHeader.name`	string	yes	The name of the query header to inspect.
`redactedFields[].uriPath`	object	—	Inspect the request URI path.
`resourceArn`	string	yes	The Amazon Resource Name (ARN) of the web ACL that you want to associate with LogDestinationConfigs.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`managedByFirewallManager`	boolean	—	Indicates whether the logging configuration was created by AWS Firewall Manager, as part of an AWS WAF policy configuration.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

WAFv2WebACLAssociation # CLOUD CONTROL · AWS::WAFv2::WebACLAssociation

WAFv2WebACLAssociation manages AWS::WAFv2::WebACLAssociation through the AWS Cloud Control API.

kubectl get wafv2webaclassociations · example on GitHub

Example

# WAFv2WebACLAssociation — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#wafv2webaclassociation
apiVersion: aws.konfig.io/v1alpha1
kind: WAFv2WebACLAssociation
metadata:
  name: example-wafv2webaclassociation
  namespace: default
spec:
  providerRef:
    name: example-wafv2webaclassociation
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role
  webACLArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`webACLArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

WebACL # GA

WebACL is the Schema for managing WAFv2 WebACLs.

kubectl get webacls · example on GitHub

Example

# WebACL — WAFv2
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/wafv2.html#webacl
apiVersion: aws.konfig.io/v1alpha1
kind: WebACL
metadata:
  name: example-webacl
  namespace: default
spec:
  defaultAction:
    allow: false
    block: false
  description: Managed by konfig-konector
  name: example-webacl
  providerRef:
    name: example-webacl
    region: us-east-1
  scope: CLOUDFRONT
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`defaultAction`	object	yes	DefaultAction is the action for requests that don't match any rule.
`defaultAction.allow`	boolean	—	Allow allows requests that don't match any rule.
`defaultAction.block`	boolean	—	Block blocks requests that don't match any rule.
`description`	string	—	Description is a human-readable description.
`name`	string	yes	Name is the name of the WebACL.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`scope`	enum	yes	Scope is CLOUDFRONT or REGIONAL. Allowed: `CLOUDFRONT, REGIONAL`
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the WebACL.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the WebACL ID.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`lockToken`	string	—	LockToken is the WAFv2 lock token required for updates/deletes.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.