aws-waf-inserted-header-values
WAF can insert static request or response headers; using real authentication values exposes them to origins or clients.
Where it sits
| location | GetWebACL.WebACL.Rules[].Action.{Allow,Captcha,Challenge}.CustomRequestHandling.InsertHeaders[].Value / WebACL.Rules[].Action.Block.CustomResponse.ResponseHeaders[].Value / WebACL.DefaultAction.Allow.CustomRequestHandling.InsertHeaders[].Value / WebACL.DefaultAction.Block.CustomResponse.ResponseHeaders[].Value |
|---|
| location kind | config_field |
|---|
| data kinds | credential api_key bearer_token sensitive_data |
|---|
| emits edge | ContainsCredential |
|---|
| service | WAF/Shield (aws:waf) |
|---|
Collection recipe
| access mode | read_api |
|---|
| operation | GetWebACL |
|---|
| response path | WebACL.Rules[].Action.{Allow,Captcha,Challenge}.CustomRequestHandling.InsertHeaders[].Value / WebACL.Rules[].Action.Block.CustomResponse.ResponseHeaders[].Value / WebACL.DefaultAction.Allow.CustomRequestHandling.InsertHeaders[].Value / WebACL.DefaultAction.Block.CustomResponse.ResponseHeaders[].Value |
|---|
| encoding | json |
|---|
| params | {"Id": "\u003cweb-acl-id\u003e", "Name": "\u003cweb-acl-name\u003e", "Scope": "\u003cscope\u003e"} |
|---|
Required permissions
References