FieldToMatch
Specifies a web request component to be used in a rule match statement or in a logging configuration.
In a rule statement, this is the part of the web request that you want WAF to inspect. Include the single
FieldToMatchtype that you want to inspect, with additional specifications as needed, according to the type. You specify a single request component inFieldToMatchfor each rule statement that requires it. To inspect more than one component of the web request, create a separate rule statement for each component.Example JSON for aQueryStringfield to match:"FieldToMatch": { "QueryString": {} }Example JSON for aMethodfield to match specification:"FieldToMatch": { "Method": { "Name": "DELETE" } }In a logging configuration, this is used in the
RedactedFieldsproperty to specify a field to redact from the logging records. For this use case, note the following:Even though all
FieldToMatchsettings are available, the only valid settings for field redaction areUriPath,QueryString,SingleHeader, andMethod.In this documentation, the descriptions of the individual fields talk about specifying the web request component to inspect, but for field redaction, you are specifying the component type to redact from the logs.
If you have request sampling enabled, the redacted fields configuration for logging has no impact on sampling. You can only exclude fields from request sampling by disabling sampling in the web ACL visibility configuration or by configuring data protection for the web ACL.
Types
Properties
Inspect all query arguments.
Inspect a string containing the list of the request's header names, ordered as they appear in the web request that WAF receives for inspection. WAF generates the string and then uses that as the field to match component in its inspection. WAF separates the header names in the string using colons and no added spaces, for example host:user-agent:accept:authorization:referer.
Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
Available for use with Amazon CloudFront distributions and Application Load Balancers. Match against the request's JA4 fingerprint. The JA4 fingerprint is a 36-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. WAF calculates and logs this fingerprint for each request that has enough TLS Client Hello information for the calculation. Almost all web requests include this information.
Inspect the query string. This is the part of a URL that appears after a ? character, if any.
Inspect a single header. Provide the name of the header to inspect, for example, User-Agent or Referer. This setting isn't case sensitive.
Inspect a single query argument. Provide the name of the query argument to inspect, such as UserName or SalesRegion. The name can be up to 30 characters long and isn't case sensitive.
Inspect fragments of the request URI. You must configure scope and pattern matching filters in the UriFragment object, to define the fragment of a URI that WAF inspects.