AWS waf documentation change
Summary
Updated documentation to include references to 'protection packs' alongside existing web ACL terminology throughout the document, and added a section about the new console experience
Security assessment
The changes primarily expand existing security configuration references to include 'protection packs' as another controlled resource type, but do not address specific vulnerabilities or introduce new security features. The updates appear to document product capability expansions rather than security fixes.
Diff
diff --git a/waf/latest/developerguide/aws-managed-rule-groups-atp.md b/waf/latest/developerguide/aws-managed-rule-groups-atp.md index 233375ba2..a8323b92c 100644 --- a//waf/latest/developerguide/aws-managed-rule-groups-atp.md +++ b//waf/latest/developerguide/aws-managed-rule-groups-atp.md @@ -6,0 +7,4 @@ Using this rule groupLabels added by this rule groupRules listing +**Introducing a new console experience for AWS WAF** + +You can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see [Working with the updated console experience](./working-with-console.html). + @@ -42 +46 @@ To keep your costs down and to be sure you're managing your web traffic as you w -This rule group isn't available for use with Amazon Cognito user pools. You can't associate a web ACL that uses this rule group with a user pool, and you can't add this rule group to a web ACL that's already associated with a user pool. +This rule group isn't available for use with Amazon Cognito user pools. You can't associate a protection pack or web ACL that uses this rule group with a user pool, and you can't add this rule group to a protection pack or web ACL that's already associated with a user pool. @@ -46 +50 @@ This rule group isn't available for use with Amazon Cognito user pools. You can' -This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see [Web request labeling](./waf-labels.html) and [Label metrics and dimensions](./waf-metrics.html#waf-metrics-label). +This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your protection pack or web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see [Web request labeling](./waf-labels.html) and [Label metrics and dimensions](./waf-metrics.html#waf-metrics-label). @@ -95 +99 @@ Following the prefix, the rest of the label provides detailed token status infor - * A domain specification that's valid for the web ACL. + * A domain specification that's valid for the protection pack or web ACL. @@ -105 +109 @@ Along with the rejected label, token management adds a custom label namespace an - * `rejected:expired` – The token's challenge or CAPTCHA timestamp has expired, according to your web ACL's configured token immunity times. + * `rejected:expired` – The token's challenge or CAPTCHA timestamp has expired, according to your protection pack or web ACL's configured token immunity times. @@ -107 +111 @@ Along with the rejected label, token management adds a custom label namespace an - * `rejected:domain_mismatch` – The token's domain isn't a match for your web ACL's token domain configuration. + * `rejected:domain_mismatch` – The token's domain isn't a match for your protection pack or web ACL's token domain configuration. @@ -111 +115 @@ Along with the rejected label, token management adds a custom label namespace an -Example: The labels `awswaf:managed:captcha:rejected` and `awswaf:managed:captcha:rejected:expired` together indicate that the request didn't have a valid CAPTCHA solve because the CAPTCHA timestamp in the token has exceeded the CAPTCHA token immunity time that's configured in the web ACL. +Example: The labels `awswaf:managed:captcha:rejected` and `awswaf:managed:captcha:rejected:expired` together indicate that the request didn't have a valid CAPTCHA solve because the CAPTCHA timestamp in the token has exceeded the CAPTCHA token immunity time that's configured in the protection pack or web ACL. @@ -172 +176 @@ The thresholds that this rule applies can vary slightly due to latency. A few re -AWS WAF only evaluates this rule in web ACLs that protect Amazon CloudFront distributions. +AWS WAF only evaluates this rule in protection pack or web ACLs that protect Amazon CloudFront distributions. @@ -181 +185 @@ The thresholds that this rule applies can vary slightly due to latency. It's pos -AWS WAF only evaluates this rule in web ACLs that protect Amazon CloudFront distributions. +AWS WAF only evaluates this rule in protection pack or web ACLs that protect Amazon CloudFront distributions.