aws-waf-traffic-log-destination
WAF logs can capture HTTP headers, cookies, query strings, and request metadata unless sensitive fields are redacted.
Where it sits
| location | Kinesis Firehose/S3/CloudWatch WAF log record |
|---|
| location kind | log_field |
|---|
| data kinds | credential password api_key bearer_token session_token pii sensitive_data |
|---|
| emits edge | ContainsCredential |
|---|
| service | WAF/Shield (aws:waf) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | GetLoggingConfiguration then destination read |
|---|
| response path | destination log record |
|---|
| encoding | json |
|---|
| params | {"ResourceArn": "\u003cweb-acl-arn\u003e"} |
|---|
Required permissions
wafv2:GetLoggingConfiguration
References