/* * Copyright 2018-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with * the License. A copy of the License is located at * * http://aws.amazon.com/apache2.0 * * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions * and limitations under the License. */ package com.amazonaws.services.wafv2.model; import java.io.Serializable; import javax.annotation.Generated; import com.amazonaws.protocol.StructuredPojo; import com.amazonaws.protocol.ProtocolMarshaller; /** *

* A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. The rule * categorizes requests according to your aggregation criteria, collects them into aggregation instances, and counts and * rate limits the requests for each instance. *

*

* You can specify individual aggregation keys, like IP address or HTTP method. You can also specify aggregation key * combinations, like IP address and HTTP method, or HTTP method, query argument, and cookie. *

*

* Each unique set of values for the aggregation keys that you specify is a separate aggregation instance, with the * value from each key contributing to the aggregation instance definition. *

*

* For example, assume the rule evaluates web requests with the following IP address and HTTP method values: *

* *

* The rule would create different aggregation instances according to your aggregation criteria, for example: *

* *

* For any n-tuple of aggregation keys, each unique combination of values for the keys defines a separate aggregation * instance, which WAF counts and rate-limits individually. *

*

* You can optionally nest another statement inside the rate-based statement, to narrow the scope of the rule so that it * only counts and rate limits requests that match the nested statement. You can use this nested scope-down statement in * conjunction with your aggregation key specifications or you can just count and rate limit all requests that match the * scope-down statement, without additional aggregation. When you choose to just manage all requests that match a * scope-down statement, the aggregation instance is singular for the rule. *

*

* You cannot nest a RateBasedStatement inside another statement, for example inside a * NotStatement or OrStatement. You can define a RateBasedStatement inside a web * ACL and inside a rule group. *

*

* For additional information about the options, see Rate limiting web requests * using rate-based rules in the WAF Developer Guide. *

*

* If you only aggregate on the individual IP address or forwarded IP address, you can retrieve the list of IP addresses * that WAF is currently rate limiting for a rule through the API call GetRateBasedStatementManagedKeys. * This option is not available for other aggregation configurations. *

*

* WAF tracks and manages web requests separately for each instance of a rate-based rule that you use. For example, if * you provide the same rate-based rule settings in two web ACLs, each of the two rule statements represents a separate * instance of the rate-based rule and gets its own tracking and management by WAF. If you define a rate-based rule * inside a rule group, and then use that rule group in multiple places, each use creates a separate instance of the * rate-based rule that gets its own tracking and management by WAF. *

* * @see AWS API * Documentation */ @Generated("com.amazonaws:aws-java-sdk-code-generator") public class RateBasedStatement implements Serializable, Cloneable, StructuredPojo { /** *

* The limit on requests per 5-minute period for a single aggregation instance for the rate-based rule. If the * rate-based statement includes a ScopeDownStatement, this limit is applied only to the requests that * match the statement. *

*

* Examples: *

* */ private Long limit; /** *

* Setting that indicates how to aggregate the request counts. *

* *

* Web requests that are missing any of the components specified in the aggregation keys are omitted from the * rate-based rule evaluation and handling. *

* * */ private String aggregateKeyType; /** *

* An optional nested statement that narrows the scope of the web requests that are evaluated and managed by the * rate-based statement. When you use a scope-down statement, the rate-based rule only tracks and rate limits * requests that match the scope-down statement. You can use any nestable Statement in the scope-down * statement, and you can nest statements at any level, the same as you can for a rule statement. *

*/ private Statement scopeDownStatement; /** *

* The configuration for inspecting IP addresses in an HTTP header that you specify, instead of using the IP address * that's reported by the web request origin. Commonly, this is the X-Forwarded-For (XFF) header, but you can * specify any header name. *

* *

* If the specified header isn't present in the request, WAF doesn't apply the rule to the web request at all. *

* *

* This is required if you specify a forwarded IP in the rule's aggregate key settings. *

*/ private ForwardedIPConfig forwardedIPConfig; /** *

* Specifies the aggregate keys to use in a rate-base rule. *

*/ private java.util.List customKeys; /** *

* The limit on requests per 5-minute period for a single aggregation instance for the rate-based rule. If the * rate-based statement includes a ScopeDownStatement, this limit is applied only to the requests that * match the statement. *

*

* Examples: *

* * * @param limit * The limit on requests per 5-minute period for a single aggregation instance for the rate-based rule. If * the rate-based statement includes a ScopeDownStatement, this limit is applied only to the * requests that match the statement.

*

* Examples: *

*