/** * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. * SPDX-License-Identifier: Apache-2.0. */ #pragma once #include #include #include #include #include #include #include namespace Aws { namespace Utils { namespace Json { class JsonValue; class JsonView; } // namespace Json } // namespace Utils namespace WAFV2 { namespace Model { class Statement; /** *

A rate-based rule counts incoming requests and rate limits requests when they * are coming at too fast a rate. The rule categorizes requests according to your * aggregation criteria, collects them into aggregation instances, and counts and * rate limits the requests for each instance.

You can specify individual * aggregation keys, like IP address or HTTP method. You can also specify * aggregation key combinations, like IP address and HTTP method, or HTTP method, * query argument, and cookie.

Each unique set of values for the * aggregation keys that you specify is a separate aggregation instance, with the * value from each key contributing to the aggregation instance definition.

*

For example, assume the rule evaluates web requests with the following IP * address and HTTP method values:

  • IP address 10.1.1.1, HTTP * method POST

  • IP address 10.1.1.1, HTTP method GET

  • *
  • IP address 127.0.0.0, HTTP method POST

  • IP address * 10.1.1.1, HTTP method GET

The rule would create different * aggregation instances according to your aggregation criteria, for example:

*
  • If the aggregation criteria is just the IP address, then each * individual address is an aggregation instance, and WAF counts requests * separately for each. The aggregation instances and request counts for our * example would be the following:

    • IP address 10.1.1.1: count * 3

    • IP address 127.0.0.0: count 1

  • *

    If the aggregation criteria is HTTP method, then each individual HTTP method * is an aggregation instance. The aggregation instances and request counts for our * example would be the following:

    • HTTP method POST: count 2

      *
    • HTTP method GET: count 2

  • If the * aggregation criteria is IP address and HTTP method, then each IP address and * each HTTP method would contribute to the combined aggregation instance. The * aggregation instances and request counts for our example would be the following: *

    • IP address 10.1.1.1, HTTP method POST: count 1

    • *

      IP address 10.1.1.1, HTTP method GET: count 2

    • IP address * 127.0.0.0, HTTP method POST: count 1

For any * n-tuple of aggregation keys, each unique combination of values for the keys * defines a separate aggregation instance, which WAF counts and rate-limits * individually.

You can optionally nest another statement inside the * rate-based statement, to narrow the scope of the rule so that it only counts and * rate limits requests that match the nested statement. You can use this nested * scope-down statement in conjunction with your aggregation key specifications or * you can just count and rate limit all requests that match the scope-down * statement, without additional aggregation. When you choose to just manage all * requests that match a scope-down statement, the aggregation instance is singular * for the rule.

You cannot nest a RateBasedStatement inside * another statement, for example inside a NotStatement or * OrStatement. You can define a RateBasedStatement * inside a web ACL and inside a rule group.

For additional information * about the options, see Rate * limiting web requests using rate-based rules in the WAF Developer * Guide.

If you only aggregate on the individual IP address or * forwarded IP address, you can retrieve the list of IP addresses that WAF is * currently rate limiting for a rule through the API call * GetRateBasedStatementManagedKeys. This option is not available for * other aggregation configurations.

WAF tracks and manages web requests * separately for each instance of a rate-based rule that you use. For example, if * you provide the same rate-based rule settings in two web ACLs, each of the two * rule statements represents a separate instance of the rate-based rule and gets * its own tracking and management by WAF. If you define a rate-based rule inside a * rule group, and then use that rule group in multiple places, each use creates a * separate instance of the rate-based rule that gets its own tracking and * management by WAF.

See Also:

AWS * API Reference

*/ class RateBasedStatement { public: AWS_WAFV2_API RateBasedStatement(); AWS_WAFV2_API RateBasedStatement(Aws::Utils::Json::JsonView jsonValue); AWS_WAFV2_API RateBasedStatement& operator=(Aws::Utils::Json::JsonView jsonValue); AWS_WAFV2_API Aws::Utils::Json::JsonValue Jsonize() const; /** *

The limit on requests per 5-minute period for a single aggregation instance * for the rate-based rule. If the rate-based statement includes a * ScopeDownStatement, this limit is applied only to the requests that * match the statement.

Examples:

  • If you aggregate on just * the IP address, this is the limit on requests from any single IP address.

    *
  • If you aggregate on the HTTP method and the query argument name * "city", then this is the limit on requests for any single method, city pair. *

*/ inline long long GetLimit() const{ return m_limit; } /** *

The limit on requests per 5-minute period for a single aggregation instance * for the rate-based rule. If the rate-based statement includes a * ScopeDownStatement, this limit is applied only to the requests that * match the statement.

Examples:

  • If you aggregate on just * the IP address, this is the limit on requests from any single IP address.

    *
  • If you aggregate on the HTTP method and the query argument name * "city", then this is the limit on requests for any single method, city pair. *

*/ inline bool LimitHasBeenSet() const { return m_limitHasBeenSet; } /** *

The limit on requests per 5-minute period for a single aggregation instance * for the rate-based rule. If the rate-based statement includes a * ScopeDownStatement, this limit is applied only to the requests that * match the statement.

Examples:

  • If you aggregate on just * the IP address, this is the limit on requests from any single IP address.

    *
  • If you aggregate on the HTTP method and the query argument name * "city", then this is the limit on requests for any single method, city pair. *

*/ inline void SetLimit(long long value) { m_limitHasBeenSet = true; m_limit = value; } /** *

The limit on requests per 5-minute period for a single aggregation instance * for the rate-based rule. If the rate-based statement includes a * ScopeDownStatement, this limit is applied only to the requests that * match the statement.

Examples:

  • If you aggregate on just * the IP address, this is the limit on requests from any single IP address.

    *
  • If you aggregate on the HTTP method and the query argument name * "city", then this is the limit on requests for any single method, city pair. *

*/ inline RateBasedStatement& WithLimit(long long value) { SetLimit(value); return *this;} /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline const RateBasedStatementAggregateKeyType& GetAggregateKeyType() const{ return m_aggregateKeyType; } /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline bool AggregateKeyTypeHasBeenSet() const { return m_aggregateKeyTypeHasBeenSet; } /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline void SetAggregateKeyType(const RateBasedStatementAggregateKeyType& value) { m_aggregateKeyTypeHasBeenSet = true; m_aggregateKeyType = value; } /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline void SetAggregateKeyType(RateBasedStatementAggregateKeyType&& value) { m_aggregateKeyTypeHasBeenSet = true; m_aggregateKeyType = std::move(value); } /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline RateBasedStatement& WithAggregateKeyType(const RateBasedStatementAggregateKeyType& value) { SetAggregateKeyType(value); return *this;} /** *

Setting that indicates how to aggregate the request counts.

*

Web requests that are missing any of the components specified in the * aggregation keys are omitted from the rate-based rule evaluation and handling. *

  • CONSTANT - Count and limit the requests * that match the rate-based rule's scope-down statement. With this option, the * counted requests aren't further aggregated. The scope-down statement is the only * specification used. When the count of all requests that satisfy the scope-down * statement goes over the limit, WAF applies the rule action to all requests that * satisfy the scope-down statement.

    With this option, you must configure * the ScopeDownStatement property.

  • * CUSTOM_KEYS - Aggregate the request counts using one or more web * request components as the aggregate keys.

    With this option, you must * specify the aggregate keys in the CustomKeys property.

    To * aggregate on only the IP address or only the forwarded IP address, don't use * custom keys. Instead, set the aggregate key type to IP or * FORWARDED_IP.

  • FORWARDED_IP - * Aggregate the request counts on the first IP address in an HTTP header.

    *

    With this option, you must specify the header to use in the * ForwardedIPConfig property.

    To aggregate on a combination * of the forwarded IP address with other aggregate keys, use * CUSTOM_KEYS.

  • IP - Aggregate the * request counts on the IP address from the web request origin.

    To * aggregate on a combination of the IP address with other aggregate keys, use * CUSTOM_KEYS.

*/ inline RateBasedStatement& WithAggregateKeyType(RateBasedStatementAggregateKeyType&& value) { SetAggregateKeyType(std::move(value)); return *this;} /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API const Statement& GetScopeDownStatement() const; /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API bool ScopeDownStatementHasBeenSet() const; /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API void SetScopeDownStatement(const Statement& value); /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API void SetScopeDownStatement(Statement&& value); /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API RateBasedStatement& WithScopeDownStatement(const Statement& value); /** *

An optional nested statement that narrows the scope of the web requests that * are evaluated and managed by the rate-based statement. When you use a scope-down * statement, the rate-based rule only tracks and rate limits requests that match * the scope-down statement. You can use any nestable Statement in the * scope-down statement, and you can nest statements at any level, the same as you * can for a rule statement.

*/ AWS_WAFV2_API RateBasedStatement& WithScopeDownStatement(Statement&& value); /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline const ForwardedIPConfig& GetForwardedIPConfig() const{ return m_forwardedIPConfig; } /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline bool ForwardedIPConfigHasBeenSet() const { return m_forwardedIPConfigHasBeenSet; } /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline void SetForwardedIPConfig(const ForwardedIPConfig& value) { m_forwardedIPConfigHasBeenSet = true; m_forwardedIPConfig = value; } /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline void SetForwardedIPConfig(ForwardedIPConfig&& value) { m_forwardedIPConfigHasBeenSet = true; m_forwardedIPConfig = std::move(value); } /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline RateBasedStatement& WithForwardedIPConfig(const ForwardedIPConfig& value) { SetForwardedIPConfig(value); return *this;} /** *

The configuration for inspecting IP addresses in an HTTP header that you * specify, instead of using the IP address that's reported by the web request * origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can specify * any header name.

If the specified header isn't present in the * request, WAF doesn't apply the rule to the web request at all.

*

This is required if you specify a forwarded IP in the rule's aggregate key * settings.

*/ inline RateBasedStatement& WithForwardedIPConfig(ForwardedIPConfig&& value) { SetForwardedIPConfig(std::move(value)); return *this;} /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline const Aws::Vector& GetCustomKeys() const{ return m_customKeys; } /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline bool CustomKeysHasBeenSet() const { return m_customKeysHasBeenSet; } /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline void SetCustomKeys(const Aws::Vector& value) { m_customKeysHasBeenSet = true; m_customKeys = value; } /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline void SetCustomKeys(Aws::Vector&& value) { m_customKeysHasBeenSet = true; m_customKeys = std::move(value); } /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline RateBasedStatement& WithCustomKeys(const Aws::Vector& value) { SetCustomKeys(value); return *this;} /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline RateBasedStatement& WithCustomKeys(Aws::Vector&& value) { SetCustomKeys(std::move(value)); return *this;} /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline RateBasedStatement& AddCustomKeys(const RateBasedStatementCustomKey& value) { m_customKeysHasBeenSet = true; m_customKeys.push_back(value); return *this; } /** *

Specifies the aggregate keys to use in a rate-base rule.

*/ inline RateBasedStatement& AddCustomKeys(RateBasedStatementCustomKey&& value) { m_customKeysHasBeenSet = true; m_customKeys.push_back(std::move(value)); return *this; } private: long long m_limit; bool m_limitHasBeenSet = false; RateBasedStatementAggregateKeyType m_aggregateKeyType; bool m_aggregateKeyTypeHasBeenSet = false; std::shared_ptr m_scopeDownStatement; bool m_scopeDownStatementHasBeenSet = false; ForwardedIPConfig m_forwardedIPConfig; bool m_forwardedIPConfigHasBeenSet = false; Aws::Vector m_customKeys; bool m_customKeysHasBeenSet = false; }; } // namespace Model } // namespace WAFV2 } // namespace Aws