feat(client-wafv2): test and verified, safe to release

awstools · awstools · commit d30039c4f7fc · 2025-08-22T18:22:02.000Z
diff --git a/clients/client-wafv2/src/commands/UpdateWebACLCommand.ts b/clients/client-wafv2/src/commands/UpdateWebACLCommand.ts
@@ -1153,6 +1153,16 @@ export interface UpdateWebACLCommandOutput extends UpdateWebACLResponse, __Metad
  *   OnSourceDDoSProtectionConfig: { // OnSourceDDoSProtectionConfig
  *     ALBLowReputationMode: "ACTIVE_UNDER_DDOS" || "ALWAYS_ON", // required
  *   },
+ *   ApplicationConfig: { // ApplicationConfig
+ *     Attributes: [ // ApplicationAttributes
+ *       { // ApplicationAttribute
+ *         Name: "STRING_VALUE",
+ *         Values: [ // AttributeValues
+ *           "STRING_VALUE",
+ *         ],
+ *       },
+ *     ],
+ *   },
  * };
  * const command = new UpdateWebACLCommand(input);
  * const response = await client.send(command);
diff --git a/clients/client-wafv2/src/models/models_0.ts b/clients/client-wafv2/src/models/models_0.ts
@@ -2899,7 +2899,7 @@ export interface RuleAction {
 /**
  * <p>Action setting to use in the place of a rule action that is configured inside the rule group. You specify one override for each rule whose action you want to change. </p>
  *          <note>
- *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+ *             <p>Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn't exactly match the case-sensitive name of an existing rule in the rule group.</p>
  *          </note>
  *          <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>
  * @public
@@ -2908,7 +2908,7 @@ export interface RuleActionOverride {
   /**
    * <p>The name of the rule to override.</p>
    *          <note>
-   *             <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>
+   *             <p>Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn't exactly match the case-sensitive name of an existing rule in the rule group.</p>
    *          </note>
    * @public
    */
@@ -9542,6 +9542,22 @@ export interface UpdateWebACLRequest {
    * @public
    */
   OnSourceDDoSProtectionConfig?: OnSourceDDoSProtectionConfig | undefined;
+
+  /**
+   * <p>Configures the ability for the WAF console to store and retrieve application attributes.
+   *          Application attributes help WAF give recommendations for protection packs.</p>
+   *          <p>When using <code>UpdateWebACL</code>, <code>ApplicationConfig</code> follows these rules:</p>
+   *          <ul>
+   *             <li>
+   *                <p>If you omit <code>ApplicationConfig</code> from the request, all existing entries in the web ACL are retained.</p>
+   *             </li>
+   *             <li>
+   *                <p>If you include <code>ApplicationConfig</code>, entries must match the existing values exactly. Any attempt to modify existing entries will result in an error.</p>
+   *             </li>
+   *          </ul>
+   * @public
+   */
+  ApplicationConfig?: ApplicationConfig | undefined;
 }
 
 /**
diff --git a/clients/client-wafv2/src/protocols/Aws_json1_1.ts b/clients/client-wafv2/src/protocols/Aws_json1_1.ts
@@ -3132,6 +3132,7 @@ const se_UpdateRuleGroupRequest = (input: UpdateRuleGroupRequest, context: __Ser
  */
 const se_UpdateWebACLRequest = (input: UpdateWebACLRequest, context: __SerdeContext): any => {
   return take(input, {
+    ApplicationConfig: _json,
     AssociationConfig: _json,
     CaptchaConfig: _json,
     ChallengeConfig: _json,
diff --git a/codegen/sdk-codegen/aws-models/wafv2.json b/codegen/sdk-codegen/aws-models/wafv2.json
@@ -1481,17 +1481,6 @@
                 "UseDualStack": true
               }
             },
-            {
-              "documentation": "For region us-iso-east-1 with FIPS enabled and DualStack enabled",
-              "expect": {
-                "error": "FIPS and DualStack are enabled, but this partition does not support one or both"
-              },
-              "params": {
-                "Region": "us-iso-east-1",
-                "UseFIPS": true,
-                "UseDualStack": true
-              }
-            },
             {
               "documentation": "For region us-iso-east-1 with FIPS enabled and DualStack disabled",
               "expect": {
@@ -1505,17 +1494,6 @@
                 "UseDualStack": false
               }
             },
-            {
-              "documentation": "For region us-iso-east-1 with FIPS disabled and DualStack enabled",
-              "expect": {
-                "error": "DualStack is enabled but this partition does not support DualStack"
-              },
-              "params": {
-                "Region": "us-iso-east-1",
-                "UseFIPS": false,
-                "UseDualStack": true
-              }
-            },
             {
               "documentation": "For region us-iso-east-1 with FIPS disabled and DualStack disabled",
               "expect": {
@@ -1529,17 +1507,6 @@
                 "UseDualStack": false
               }
             },
-            {
-              "documentation": "For region us-isob-east-1 with FIPS enabled and DualStack enabled",
-              "expect": {
-                "error": "FIPS and DualStack are enabled, but this partition does not support one or both"
-              },
-              "params": {
-                "Region": "us-isob-east-1",
-                "UseFIPS": true,
-                "UseDualStack": true
-              }
-            },
             {
               "documentation": "For region us-isob-east-1 with FIPS enabled and DualStack disabled",
               "expect": {
@@ -1553,17 +1520,6 @@
                 "UseDualStack": false
               }
             },
-            {
-              "documentation": "For region us-isob-east-1 with FIPS disabled and DualStack enabled",
-              "expect": {
-                "error": "DualStack is enabled but this partition does not support DualStack"
-              },
-              "params": {
-                "Region": "us-isob-east-1",
-                "UseFIPS": false,
-                "UseDualStack": true
-              }
-            },
             {
               "documentation": "For region us-isob-east-1 with FIPS disabled and DualStack disabled",
               "expect": {
@@ -1975,7 +1931,7 @@
       "traits": {
         "smithy.api#length": {
           "min": 1,
-          "max": 10
+          "max": 50
         }
       }
     },
@@ -11380,7 +11336,7 @@
         "Name": {
           "target": "com.amazonaws.wafv2#EntityName",
           "traits": {
-            "smithy.api#documentation": "<p>The name of the rule to override.</p>\n         <note>\n            <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>\n         </note>",
+            "smithy.api#documentation": "<p>The name of the rule to override.</p>\n         <note>\n            <p>Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn't exactly match the case-sensitive name of an existing rule in the rule group.</p>\n         </note>",
             "smithy.api#required": {}
           }
         },
@@ -11393,7 +11349,7 @@
         }
       },
       "traits": {
-        "smithy.api#documentation": "<p>Action setting to use in the place of a rule action that is configured inside the rule group. You specify one override for each rule whose action you want to change. </p>\n         <note>\n            <p>Take care to verify the rule names in your overrides. If you provide a rule name that doesn't match the name of any rule in the rule group, WAF doesn't return an error and doesn't apply the override setting.</p>\n         </note>\n         <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>"
+        "smithy.api#documentation": "<p>Action setting to use in the place of a rule action that is configured inside the rule group. You specify one override for each rule whose action you want to change. </p>\n         <note>\n            <p>Verify the rule names in your overrides carefully. With managed rule groups, WAF silently ignores any override that uses an invalid rule name. With customer-owned rule groups, invalid rule names in your overrides will cause web ACL updates to fail. An invalid rule name is any name that doesn't exactly match the case-sensitive name of an existing rule in the rule group.</p>\n         </note>\n         <p>You can use overrides for testing, for example you can override all of rule actions to <code>Count</code> and then monitor the resulting count metrics to understand how the rule group would handle your web traffic. You can also permanently override some or all actions, to modify how the rule group manages your web traffic.</p>"
       }
     },
     "com.amazonaws.wafv2#RuleActionOverrides": {
@@ -13046,6 +13002,12 @@
           "traits": {
             "smithy.api#documentation": "<p>Specifies the type of DDoS protection to apply to web request data for a web ACL. For most scenarios, it is recommended to use the default protection level, <code>ACTIVE_UNDER_DDOS</code>. \n   If a web ACL is associated with multiple Application Load Balancers, the changes you make to DDoS protection in that web ACL will apply to all associated Application Load Balancers.</p>"
           }
+        },
+        "ApplicationConfig": {
+          "target": "com.amazonaws.wafv2#ApplicationConfig",
+          "traits": {
+            "smithy.api#documentation": "<p>Configures the ability for the WAF console to store and retrieve application attributes. \n         Application attributes help WAF give recommendations for protection packs.</p>\n         <p>When using <code>UpdateWebACL</code>, <code>ApplicationConfig</code> follows these rules:</p>\n         <ul>\n            <li>\n               <p>If you omit <code>ApplicationConfig</code> from the request, all existing entries in the web ACL are retained.</p>\n            </li>\n            <li>\n               <p>If you include <code>ApplicationConfig</code>, entries must match the existing values exactly. Any attempt to modify existing entries will result in an error.</p>\n            </li>\n         </ul>"
+          }
         }
       },
       "traits": {
